Last updated: 22 August 2026. Draft template — this is the section that most needs an actual lawyer's review before being offered to any customer that requires a signed DPA (typically EU/UK customers under GDPR, or larger customers with their own compliance requirements). Do not treat this page as a substitute for that review.
For personal data processed through BaseHelm on your behalf (e.g. contact records, email content), you are the Data Controller and BaseHelm is the Data Processor, processing personal data only on your documented instructions (i.e., the features you use and configure).
Processing continues for the duration of your subscription and any post-termination retention period described in the Privacy Policy.
We use sub-processors for hosting, database storage, and AI model inference. [List of named sub-processors to be maintained and kept current before this DPA is offered to any real customer.] We will notify you of any change in sub-processors with an opportunity to object.
Encryption of connected-account credentials at rest; access-controlled, per-tenant data isolation; audit logging of account actions; rate limiting on outbound-send features.
We will provide reasonable assistance to help you respond to data subject access, correction, or deletion requests relating to data processed through BaseHelm.
[Placeholder — specify hosting region(s) and transfer mechanism (e.g. SCCs) once infrastructure location is finalized.]
On termination of your subscription, we will delete or return your data per the retention terms in the Privacy Policy.
[Placeholder — define what audit/documentation rights are offered, appropriate to customer size; this is typically negotiated per larger deal rather than offered identically to every self-serve customer.]