Benchyard Data Processing Addendum

Contract template. Effective only when incorporated into an order or agreement identifying both legal parties and completed processing schedules. This template alone is not an executed DPA or international-transfer instrument.

Version: 0.2 | Last updated: October 10, 2026

This Data Processing Addendum ("DPA") supplements the agreement for Benchyard services (the "Agreement") between the service provider legally identified in the parties' accepted order ("Benchyard") and the customer legally identified in that order ("Customer"). It takes effect on the date of the parties' documented acceptance incorporating this DPA and completed schedules. A brand name by itself does not identify a contracting party. An order must state both parties' legal names, addresses, authorized contacts, and acceptance record before this DPA can take effect.

1. Scope and roles

"Customer Personal Data" means personal data in Customer Content that Benchyard processes on Customer's behalf to deliver the Service. "Data Protection Law" means data-protection law applicable to the relevant processing, including the EU GDPR, UK GDPR, Swiss Federal Act on Data Protection, applicable United States state privacy laws, and other applicable local privacy laws. Listing a law does not assert that it applies to every customer or processing activity.

Customer acts as controller or data user, and Benchyard as processor, for the relevant Customer Personal Data. If Customer is itself a processor, Benchyard is its subprocessor and Customer warrants that its controller has authorized this engagement and the instructions. These labels describe the parties' functions; obligations under laws using different terminology remain applicable.

This DPA does not govern data Benchyard independently needs as a controller for its own account relationships, legally required invoicing, or independent legal obligations, as described in the Privacy Policy. A record is not excluded merely because it is called telemetry, a log, or usage data. The parties must classify it by its actual purpose and role.

2. Processing instructions

Benchyard will process Customer Personal Data only on Customer's documented instructions, including the Agreement, this DPA, the completed schedules, and authorized product settings and requests. These instructions permit processing only for providing the Service and its agreed support, security, maintenance, and return or deletion functions.

Benchyard will not use Customer Personal Data for its own advertising, sale, profiling unrelated to the Service, or model training. If law requires other processing, Benchyard will inform Customer before that processing unless legally prohibited. Benchyard will promptly inform Customer if an instruction appears to violate Data Protection Law and may suspend the affected processing pending resolution.

Customer is responsible for the lawfulness of its collection, instructions, and disclosures and for required notices and permissions. Benchyard remains responsible for its own statutory processor obligations. Neither party may instruct the other to evade a provider's eligibility requirements.

3. Personnel and security

Benchyard will ensure that persons authorized to process Customer Personal Data are subject to confidentiality duties and receive access only as needed for their role. Benchyard will maintain technical and organizational measures appropriate to the nature of the data and processing risks, including the measures agreed in Schedule B.

Benchyard may improve these measures without materially reducing the overall level of protection. A material reduction requires Customer's prior written agreement or another lawful contractual resolution. Benchyard will assist Customer with relevant security obligations, taking account of the processing and information available to Benchyard.

4. Subprocessors

Customer authorizes only the subprocessors identified in the completed Schedule C at acceptance. Benchyard will provide at least 30 days' prior written notice of a proposed addition or replacement before that provider processes Customer Personal Data. Customer may object within that period on reasonable data-protection grounds.

The parties will work in good faith to resolve an objection, including by using a reasonable alternative or disabling the affected optional function. If they cannot resolve it before the proposed processing, Benchyard will not transfer the affected Customer Personal Data to that provider; either party may terminate the affected service without penalty, with a refund of prepaid unused fees for that service.

Benchyard will impose written obligations on each subprocessor that provide protection materially equivalent to this DPA for the entrusted processing and will remain responsible for that subprocessor's performance of those obligations. These arrangements must also satisfy applicable law governing processor appointments and cross-border transfers.

5. Customer-selected recipients

Where Customer independently contracts with a provider and instructs Benchyard to transmit data to it, that provider's processing under Customer's separate arrangement is not automatically processing for Benchyard. Customer must authorize the destination and appropriate transfer arrangement. Benchyard remains accountable for its own transmission, credential handling, and compliance with Customer's instructions.

If Benchyard selects or contracts with a provider to perform processing on Benchyard's behalf, that provider must be treated as a subprocessor for that processing regardless of whether the product interface describes the connection as bring-your-own-key. The completed schedules must distinguish these arrangements.

6. Assistance and individual rights

Benchyard will promptly notify Customer of a request concerning Customer Personal Data from an individual or regulator unless prohibited by law. Benchyard will not independently respond on Customer's behalf except as authorized or legally required. It will provide reasonable assistance through appropriate technical and organizational measures so Customer can respond to access, correction, deletion, objection, restriction, portability, and other applicable requests.

Benchyard will assist with data-protection impact assessments, prior regulatory consultations, security obligations, and breach notifications, taking account of the nature of processing and information available to it. Any reasonable fees for extraordinary assistance must be agreed in advance, must not prevent timely statutory compliance, and do not apply to work needed to remedy Benchyard's breach.

7. Personal data breaches

Benchyard will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The initial notice will contain available information about the nature of the incident, affected data and individuals, likely consequences, a contact point, and measures taken or proposed to contain and mitigate it. Missing details may follow in stages without delaying the initial notice.

Benchyard will investigate, take reasonable corrective measures, preserve relevant evidence, and cooperate with Customer. Customer controls notices to its individuals and regulators, except where Benchyard has an independent legal duty. Notice of an incident is not an admission of liability. Unsuccessful attempts that do not compromise personal data are not automatically reportable breaches under this section.

Customer's incident contact is the security contact in the order or its subsequently notified replacement. Benchyard's contact is hello@benchyard.com, subject "Security incident." A separately agreed notification deadline cannot extend a shorter duty imposed by law.

8. Information and audits

Benchyard will make available information reasonably necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by Customer or its mandated independent auditor. The parties will use existing documentation first when sufficient. This does not replace an inspection where needed to satisfy applicable law or resolve a material concern.

Routine audits require reasonable notice, confidentiality, and safeguards for other customers and security. Ordinarily they occur no more than once annually, but that limit does not restrict a regulator, a legally required audit, or an additional audit reasonably needed after a breach or evidence of non-compliance. No certification or independent audit report is represented as existing unless actually supplied.

9. Return and deletion

At Customer's choice on termination or a valid deletion instruction, Benchyard will return Customer Personal Data in a reasonably usable format or delete it, including relevant copies, unless law requires continued storage. The agreed export window is [EXPORT_WINDOW_DAYS] days; the active-system deletion period is [ACTIVE_DELETION_DAYS] days; the snapshot grace period is [SNAPSHOT_GRACE_DAYS] days; and the maximum backup removal period is [BACKUP_DELETION_DAYS] days. Populate these fields with supported periods before acceptance.

Backups pending expiry will be restricted to recovery and security, protected under this DPA, and not restored to ordinary use without reapplying applicable deletion instructions. Data kept under a legal duty will be isolated, used only for that duty, and deleted when it ends. Benchyard will confirm completion on reasonable request.

Removing a visible workspace is not complete deletion if personal data remains in its search index, attachments, bundles, snapshots, usage records, or backups. Schedule A must specify legitimate retention for any records held for distinct purposes and identify the party's role. Copies controlled solely by Customer or its independently contracted recipients must be addressed through those parties.

10. International transfers

Benchyard will process Customer Personal Data only in the locations in completed Schedule C or as otherwise authorized under this DPA. Remote access from another country is included in the transfer assessment. No restricted transfer may begin until a valid legal mechanism and any required assessment or supplementary measures have been established.

Schedule D records the chosen mechanism. A reference to a DPA or a server region is not itself a transfer safeguard. Where required, the parties will execute the applicable standard contractual clauses, UK Addendum or IDTA, and relevant adaptations without undermining their mandatory provisions. If a mechanism becomes invalid or cannot be complied with, the parties will promptly adopt a valid alternative or suspend the affected transfer and, if necessary, terminate the affected processing.

11. United States service provider terms

To the extent Customer Personal Data is subject to a United States law requiring processor, service-provider, or contractor restrictions, Benchyard will use it only for the specified business purposes in Schedule A and as otherwise permitted by that law. Benchyard will not sell or share it for cross-context behavioral advertising, retain or use it outside the parties' direct business relationship, or combine it with other customers' or independently obtained personal information except as law permits for the specified services.

Benchyard certifies that it understands and will comply with these restrictions. It will provide the level of protection required by applicable law, notify Customer if it can no longer comply, and permit reasonable steps to verify compliance and stop or remediate unauthorized use. Subcontractors must accept the required restrictions. Nothing here allows processing prohibited by the rest of this DPA.

12. Precedence and execution

Mandatory transfer clauses prevail over conflicting terms, followed by this DPA for data-protection matters, then the Agreement. The Agreement's liability terms apply only to the extent they do not limit non-waivable individual rights, regulator powers, or mandatory transfer-clause obligations. This DPA survives while Benchyard retains Customer Personal Data.

The order or other acceptance record must identify each party's authorized representative, title, acceptance method, and date. Retain the accepted DPA version and attached schedules with that record. Formation of a new company or a brand-name change does not automatically assign an existing Agreement or DPA; any change must follow the Agreement and applicable law.

Schedule A Processing details

Schedule B Security measures

Contractual baseline to validate and accept; this schedule is not a certification of current production controls.

1. Access control: individual administrative identities, least privilege, prompt removal of access, appropriate multifactor protection, and recorded approval for exceptional content access.
2. Transport: protected browser and workspace control connections, certificate validation, and protection of external provider connections appropriate to their protocols.
3. Credentials and objects: authenticated encryption for supported stored secrets, separate protection of master keys, restricted key access, and controlled rotation and recovery procedures.
4. Storage: verified protection for databases, disks, snapshots, object storage, and backups. Complete [STORAGE_ENCRYPTION_DETAILS] for each actual backend. Selected-object encryption alone is insufficient evidence for a universal at-rest encryption claim.
5. Isolation: account authorization, workspace boundaries appropriate to each backend, preview-origin separation, and network controls. Record exceptions for privileged workspaces and customer-owned machines in [ISOLATION_CONFIGURATION].
6. Operations: supported software updates, vulnerability management, backup and restoration procedures, monitored service failures, and an incident response process with responsible personnel.
7. Data handling: documented retention, deletion across copies and indexes, access-request assistance, and recovery procedures that preserve deletion decisions.
8. Assurance: relevant configuration evidence and control reviews available under Section 8. No promise of SOC 2, ISO certification, penetration-test completion, end-to-end encryption, or universal audit coverage is made by this schedule.

Control owner and approval: [SECURITY_CONTROL_APPROVAL]. Record material exceptions explicitly before signature; do not silently leave unsupported measures in an executed contract.

Schedule C Locations and subprocessors

Attach a dated, completed copy of Subprocessors and Service Providers, limited to providers actually used for this Customer. For each entry record its legal entity, function, data categories, processing and access countries, agreement, and applicable transfer protection.

Primary hosting: [HOSTING_COUNTRIES]. Backup locations: [BACKUP_COUNTRIES]. Support and administrative access: [SUPPORT_ACCESS_COUNTRIES]. Independent Customer-selected recipients and authorized destinations: [CUSTOMER_SELECTED_RECIPIENTS]. Notice recipient for subprocessor changes: Customer's privacy contact in the accepted order.

Schedule D Transfer execution record

No transfer mechanism is activated by an incomplete entry. Use current official instruments and complete their required annexes before the relevant transfer.

Official reference instruments: European Commission SCC resources and ICO transfer clauses guidance and instruments. These links identify resources; they do not execute an instrument.