# Entea Data Processing Addendum — draft scope

Last updated: 18 September 2026  
Status: Draft for review — not approved and not for signature

**Important:** This document is a transparent working draft, not legal advice or an executed agreement. The Entea contracting entity, registered address, governing law, data-transfer mechanism, liability terms, security exhibit, and authorized signatories must be completed and reviewed by qualified counsel before use.

## 1. Roles

The customer acts as controller or business for personal data submitted to Entea. The Entea contracting entity acts as processor or service provider only to provide, secure, support, and maintain the service under the customer’s documented instructions.

## 2. Processing scope

- **Subject:** operation of the Entea application engineering service.
- **Duration:** the agreement term plus the approved deletion and backup-expiry periods.
- **Data subjects:** customer users, people represented in application requirements or connected sources, support contacts, and end users of generated applications where Entea processes their data.
- **Data categories:** account and organization records, application requirements, source and configuration metadata, operational and audit records, support communications, and data deliberately supplied through connected services.
- **Sensitive data:** not authorized by default. Any sensitive-data processing requires written scope, controls, and lawful basis.

## 3. Processor commitments in the final agreement

The final DPA should require Entea to:

1. process personal data only on documented instructions;
2. bind personnel to confidentiality;
3. maintain appropriate technical and organizational safeguards;
4. assist with data-subject requests, security incidents, risk assessments, and regulator inquiries;
5. impose equivalent obligations on approved subprocessors;
6. notify the customer of qualifying personal-data breaches without undue delay;
7. delete or return personal data at the end of service, subject to lawful retention;
8. provide reasonable audit information; and
9. notify the customer if an instruction appears to violate applicable data-protection law.

## 4. International transfers

No transfer mechanism is selected in this draft. The final agreement must identify processing regions and, where required, incorporate the applicable Standard Contractual Clauses, UK Addendum, or another lawful transfer mechanism.

## 5. Security exhibit

The security exhibit should incorporate the published security architecture, access controls, authenticated encryption for stored secrets, tenant isolation, audit evidence, backup and recovery controls, incident response, vulnerability management, and customer responsibility for connected cloud and model providers.

## 6. Subprocessors

The current technical inventory is published at https://entea.in/trust/subprocessors.md. The final DPA must define notification, objection, and replacement procedures.

## 7. Required completion fields

- Entea legal entity and registered address
- Customer legal entity and registered address
- Governing law and venue
- Primary processing locations
- Approved transfer mechanism
- Contractual retention and deletion windows
- Security and privacy contacts
- Liability and indemnity alignment with the main agreement
- Authorized signatories

Request a reviewed DPA through https://entea.in/pilot before sending production personal data.