Data Processing Agreement

Version: 2026-10-07 · Last updated: 7 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between ASLM Digital Solutions LLC, a Wyoming limited liability company, of 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA ("Retainr", "we"), and the business that holds a Retainr OS workspace ("Customer", "you"). It applies whenever we process personal data in Customer Data on your behalf. You accept it when you accept the Terms. No signature is needed.

This is the agreement between you and us. It is different from the template DPA that Settings → Legal generates, which is for you to use with your own clients.

1. Definitions

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation 2016/679) and any law implementing or replacing them, as they apply to the processing. "Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in Data Protection Law. "Customer Personal Data" means personal data in Customer Data that we process on your behalf. Other capitalised terms have the meaning given in the Terms.

2. Roles

• For Customer Personal Data, you are the controller, or a processor acting for your own client, and we are your processor (or sub-processor).
• Where you act as a processor for your client, you confirm that your client has authorised you to appoint us, and that your instructions to us are consistent with theirs.
• For account, billing and website data about you and your users, we are a controller. Our Privacy Policy covers that processing, and this DPA does not.

3. Details of the processing

4. Our obligations

We will:

1. process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and your use and configuration of the Service, unless the law requires otherwise, in which case we will tell you first unless the law prohibits it. We will tell you if we think an instruction breaks Data Protection Law;
2. make sure everyone we authorise to process Customer Personal Data is bound by confidentiality;
3. keep the technical and organisational measures in Annex 2 in place, and only change them in ways that do not lower the overall level of protection;
4. engage sub-processors only as section 6 allows;
5. help you, taking into account the nature of the processing, to respond to data subjects exercising their rights. The Service's own tools (subject access export, erasure, anonymisation and retention settings) are the main way we do this;
6. help you with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to us;
7. delete or return Customer Personal Data at the end of the Service as section 11 sets out;
8. make available the information needed to show we comply with this DPA, and allow for audits as section 9 sets out.

5. Your obligations

You are responsible for having a lawful basis for the Customer Personal Data you put into the Service, for giving data subjects the information the law requires, and for the lawfulness of your instructions. You will configure the Service's access controls, retention settings and sharing features appropriately for your data.

6. Sub-processors

• You give us general written authorisation to engage sub-processors. The current list is in Annex 3 and in section 6 of our Privacy Policy.
• We will tell you at least 30 days before adding or replacing a sub-processor, by email to the workspace owner or in the Service. You may object on reasonable data protection grounds within that period. If we cannot reasonably address the objection, you may end the affected part of the Service and receive a refund of prepaid fees for the unused period.
• We impose on each sub-processor written data protection terms that protect Customer Personal Data to the same standard as this DPA, and we remain liable to you for their performance.

7. International transfers

• Customer Personal Data is stored in the EU (Ireland). Some sub-processors, and Retainr itself, are in the USA (Annex 3).
• Where a transfer of Customer Personal Data from the EEA to a country without an adequacy decision takes place under this DPA, the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("EU SCCs") are incorporated into this DPA by reference and apply as follows:
• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor;
• you are the data exporter and Retainr is the data importer;
• in Clause 7, the docking clause applies;
• in Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 6 of this DPA;
• in Clause 11, the optional language does not apply;
• in Clause 13, the supervisory authority is the one determined by Clause 13(a) for the data exporter, or if that cannot be determined, the Irish Data Protection Commission;
• in Clauses 17 and 18, the EU SCCs are governed by the law of Ireland and disputes go to the courts of Ireland;
• Annex I is completed by section 3 of this DPA and the parties' details above, Annex II by Annex 2, and Annex III by Annex 3.
• Where a transfer of Customer Personal Data from the UK takes place under this DPA, the EU SCCs apply as varied by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) ("UK Addendum"), which is incorporated by reference. Tables 1 to 3 of the UK Addendum are completed with the information in this DPA. For Table 4, neither party may end the UK Addendum under its Section 19.
• Where a transfer from Switzerland takes place, the EU SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
• If the EU SCCs or the UK Addendum conflict with this DPA or the Terms, the EU SCCs and the UK Addendum prevail.
• Where a sub-processor is outside the UK and EEA, we put in place an appropriate transfer mechanism with it, such as the EU SCCs with the UK Addendum, or its certification under the EU-US Data Privacy Framework and the UK Extension.

8. Personal data breaches

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will give you the information we have that you need to meet your own obligations, update it as we learn more, and take reasonable steps to contain and remedy the breach. Notifying you is not an admission of fault.

9. Audits

On written request, no more than once a year (or after a personal data breach, or when a supervisory authority requires it), we will answer reasonable written questions about our compliance with this DPA and share relevant documentation, under confidentiality. If that is not enough to show compliance, you, or an independent auditor bound by confidentiality, may carry out an audit with at least 30 days' notice, during business hours, in a way that does not disrupt our operations or compromise other customers' data. You pay the costs of an audit you request.

10. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, including the cap for breaches of data protection obligations. Nothing in this section limits either party's liability to data subjects under the EU SCCs or the UK Addendum.

11. Return and deletion

During the subscription you can export Customer Data at any time (Settings → GDPR → Download workspace export). After your subscription ends, the workspace is locked and Customer Data stays available to export for 60 days. We then delete Customer Personal Data within a further 30 days, except where the law requires us to keep it. Backups expire on their normal cycle (up to 7 days). If a workspace owner requests closure, deletion follows the closure process in the Terms.

12. General

This DPA lasts as long as we process Customer Personal Data. If it conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. Apart from the EU SCCs and the UK Addendum, which are governed as section 7 says, this DPA is governed by the law that governs the Terms.

Annex 1. Parties

• Data exporter: the Customer, as identified in its Retainr OS workspace and billing details. Contact: the workspace owner's email address. Role: controller (Module Two) or processor (Module Three).
• Data importer: ASLM Digital Solutions LLC, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA. Contact: support@getretainr-os.com (subject "Privacy"). Role: processor.
• Description of the transfer: as section 3 of this DPA. Transfers are continuous for the duration of the Service.

Annex 2. Technical and organisational measures

• Workspace isolation enforced in the database with row-level security, tested automatically on every change.
• Encryption in transit (TLS with HSTS) and at rest by our hosting providers. Integration tokens encrypted with AES-256-GCM. Portal passcodes stored only as scrypt hashes.
• Two-factor authentication (TOTP), which a workspace can require for all staff. Minimum password length of 12 characters, a breached-password check, and lockout after repeated failed sign-ins.
• Workspace controls for maximum session length, concurrent sessions and an optional IP allowlist.
• Role-based access in the Service, with money and rate data hidden from roles that may not see it.
• An append-only, hash-chained audit log of significant actions.
• A strict Content Security Policy and other protective browser headers. Rate limiting on sign-in and other sensitive actions.
• Daily backups kept for up to 7 days.
• Access to production systems restricted to authorised personnel who need it, using accounts protected by two-factor authentication.
• AI features run only when a user starts them or a workspace owner switches them on. Dictation audio is never stored.

Annex 3. Sub-processors