Data Processing Agreement - Compoundly
← Back to Home
Data Processing Agreement
Effective Date: June 15, 2026Last Updated: June 15, 2026
1. Definitions and Interpretation
Key Definitions
"Controller": The natural or legal person that determines the purposes and means of processing personal data"Processor": Compoundly, acting as the natural or legal person that processes personal data on behalf of the Controller"Personal Data": Any information relating to an identified or identifiable natural person"Processing": Any operation performed on personal data, including collection, storage, use, disclosure, or deletion"Data Subject": The natural person whose personal data is being processed"Sub-processor": Any processor engaged by Compoundly to assist in processing personal data
Reference: GDPR Article 4 (Definitions)
2. Scope and Purpose of Processing
Subject Matter of Processing
Financial assessment data and calculations
AI-powered financial advice generation (premium users)
Document analysis and temporary processing
Goal tracking and progress monitoring
User authentication and account management
Duration of Processing
Processing continues for the duration of the service relationship
Financial documents: Maximum 15 minutes automatic deletion
Account data: Until account deletion plus maximum 12 months retention
Legal hold: Extended retention if required by law or legal proceedings
Nature and Purpose
Primary Purpose: Provision of financial education and assessment servicesSecondary Purpose: Service improvement and platform optimizationCompliance Purpose: Legal obligations and regulatory requirements
Categories of Data Subjects
Individual users of financial assessment services
Premium subscribers accessing AI-powered features
Users uploading financial documents for analysis
Administrative contacts and support requesters
Categories of Personal Data
Identity Data: Name, email address, account identifiersFinancial Data: Income, expenses, assets, debts, financial goalsTechnical Data: IP addresses, device information, usage patternsCommunication Data: Support requests, feedback, correspondenceDocument Data: Temporarily processed financial documents (auto-deleted)
3. Processor Obligations
🛡️ GDPR Article 28 Compliance
Processing Instructions
Documented Instructions: Process personal data only based on documented instructions from the ControllerPurpose Limitation: Not process personal data for purposes other than those specifiedUnauthorized Processing: Immediately inform Controller of any inability to comply with instructions
Personnel and Confidentiality
Authorized Personnel: Ensure only authorized personnel have access to personal dataConfidentiality: All personnel are bound by confidentiality obligationsTraining: Regular data protection training for all staff handling personal data
Technical and Organizational Measures
Security: Implement appropriate technical and organizational measuresEncryption: Data encrypted in transit (TLS) and at rest (AES-256)Access Controls: Role-based access, multi-factor authenticationMonitoring: Continuous security monitoring and incident detection
4. Sub-processor Management
Authorized Sub-processors
Compoundly may engage the following sub-processors for specific processing activities:
Sub-processor
Service
Location
Safeguards
OpenAI, LLC
AI-powered advice generation
United States
Data anonymization, SCCs
Stripe, Inc.
Payment processing
United States/Global
PCI DSS compliance, SCCs
Amazon Web Services
Cloud hosting and storage
United States/EU
SOC 2, ISO 27001, SCCs
Google Analytics
Usage analytics (anonymized)
United States
Data anonymization, SCCs
Sub-processor Requirements
Written Agreements: All sub-processors bound by written data protection agreementsSame Obligations: Sub-processors subject to same data protection obligations as ProcessorLiability: Compoundly remains fully liable for sub-processor complianceAudit Rights: Controller may audit sub-processor compliance through Compoundly
Changes to Sub-processors
General Consent: Controller provides general authorization for sub-processor engagementNotification: 30 days advance notice of new or replacement sub-processorsObjection Rights: Controller may object to sub-processor changesTermination: If Controller objects, parties may terminate the agreement
5. Data Subject Rights Support
Rights Facilitation
Compoundly assists Controllers in responding to data subject rights requests:
Access Rights (Article 15)
Provide data exports in structured, machine-readable formats
Confirm what personal data is being processed
Response time: Within 5 business days of Controller request
Rectification Rights (Article 16)
Correct inaccurate or incomplete personal data
Update data across all processing systems
Notify relevant sub-processors of corrections
Erasure Rights (Article 17)
Delete personal data when legally required
Confirm complete removal from all systems
Exception: Legal obligations requiring retention
Data Portability (Article 20)
Provide data in structured, commonly used formats
Enable direct transfer to other controllers where technically feasible
Include all data provided by the data subject
Objection and Restriction (Articles 18, 21)
Temporarily restrict processing when requested
Mark restricted data to prevent future processing
Resume processing only with legal basis or consent
6. Security and Data Protection
Technical Safeguards
Encryption: AES-256 encryption for data at rest, TLS 1.3 for data in transitAccess Controls: Role-based access control (RBAC) with principle of least privilegeAuthentication: Multi-factor authentication for all administrative accessNetwork Security: Firewalls, intrusion detection, DDoS protectionSecure Deletion: Cryptographic erasure and secure disposal methods
Organizational Safeguards
Staff Training: Regular data protection and security awareness trainingBackground Checks: Security clearance for personnel with data accessIncident Response: Documented breach response and notification proceduresBusiness Continuity: Disaster recovery and data backup proceduresThird-party Management: Due diligence and ongoing monitoring of vendors
7. Data Breach Response
Breach Detection and Assessment
24/7 Monitoring: Continuous security monitoring and automated alertsIncident Classification: Risk-based assessment of security incidentsImpact Analysis: Evaluation of potential harm to data subjectsContainment: Immediate steps to contain and remediate breaches
Notification Requirements
Controller Notification: Notify Controller within 24 hours of breach discoveryInformation Provided: Nature of breach, categories and numbers of records affectedOngoing Updates: Regular updates as investigation progressesRegulatory Notification: Assist Controller with supervisory authority notifications
Data Subject Notification
Risk Assessment: Determine if breach poses high risk to individualsNotification Content: Clear description of breach and recommended actionsRemediation: Steps taken to address the breach and prevent recurrenceSupport: Provide assistance and monitoring services where appropriate
8. International Data Transfers
Transfer Mechanisms
Adequacy Decisions: EU Commission adequacy decisions where availableStandard Contractual Clauses: EU SCCs for transfers lacking adequacyBinding Corporate Rules: Internal data transfer mechanisms for global operationsDerogations: Limited use of Article 49 derogations for specific situations
Transfer Safeguards
Data Mapping: Clear documentation of all international data flowsImpact Assessments: Transfer risk assessments per Schrems II requirementsSupplementary Measures: Additional technical safeguards for high-risk transfersOngoing Monitoring: Regular review of transfer mechanisms and legal developments
9. Audit and Compliance
Audit Rights
Information Provision: Demonstrate compliance with data protection obligationsAudit Assistance: Allow and contribute to audits by Controller or appointed auditorDocumentation: Maintain records of processing activities and compliance measuresFrequency: Annual compliance reviews or upon reasonable request
Compliance Reporting
Regular Reports: Quarterly compliance and security reportsIncident Reports: Detailed incident response and remediation reportsChange Notifications: Advance notice of significant operational changesCertification Updates: Current security and privacy certifications
10. Return and Deletion of Data
Service Termination
Data Return: Return all personal data to Controller in structured formatSecure Deletion: Securely delete all copies unless legal retention requiredCertification: Provide written certification of data return and deletionTimeline: Complete data return/deletion within 30 days of termination
Automatic Deletion
Financial Documents: Automatic deletion after 15 minutesSession Data: Deletion upon session expiryBackup Data: Secure deletion from all backup systemsVerification: Technical verification of complete data removal
11. Liability and Indemnification
Processor Liability
GDPR Article 82: Joint and several liability for damages to data subjectsLimitation: Liability limited to damages caused by Processor's non-complianceExemption: No liability if Processor proves it is not responsible for damageInsurance: Professional liability and cyber security insurance coverage
Indemnification
Processor Breaches: Processor indemnifies Controller for damages from Processor non-complianceSub-processor Issues: Processor liable for sub-processor compliance failuresThird-party Claims: Defense and indemnification for covered claimsLegal Costs: Reasonable attorney fees and litigation expenses
12. Contact Information