This Data Processing Agreement ("DPA") forms part of the Terms of Service between Automation School International LTD, operating as Delta Drive ("Processor", "we"), and the customer that uses Delta Drive ("Customer", "you"). It applies whenever we process personal data on your behalf while providing the Service. By accepting the Terms you also accept this DPA. If you need a countersigned copy, email info@deltadrive.app.
1. Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the EU General Data Protection Regulation 2016/679 ("GDPR"). "Data Protection Law" means the GDPR, the UK GDPR, Israel's Protection of Privacy Law, 5741-1981 and its regulations, and any other privacy law that applies to the processing. "Customer Data" means the personal data we process on your behalf under this DPA.
2. Roles and instructions
2.1 You are the controller of Customer Data and we are your processor. Where you act as a processor for another party, we are your sub-processor.
2.2 We process Customer Data only on your documented instructions. The Terms, this DPA and your configuration and use of the Service are your instructions. We will tell you if we believe an instruction breaks Data Protection Law.
2.3 You are responsible for the lawfulness of the Customer Data you bring into the Service, including having a legal basis to process your employees' compensation data and informing them about it.
3. Details of the processing
| Subject matter | Providing the Delta Drive commission tracking service |
| Duration | The term of the Terms of Service, plus the deletion period in section 10 |
| Nature and purpose | Syncing deals from the Customer's CRM, calculating commissions, showing dashboards and leaderboards, preparing payroll reports, and sending service emails |
| Categories of data subjects | The Customer's employees and contractors (sales reps, managers, admins); people named in deal titles in the Customer's CRM |
| Types of personal data | Names, work email addresses, CRM user IDs, roles; deal titles, values, currencies, statuses, won dates and owners; base salaries, commission plans, targets, bonuses, deductions and calculated commissions |
| Special categories | None. The Service is not designed for special category data, and you agree not to put such data into it |
4. Confidentiality
Everyone we authorize to process Customer Data is bound by confidentiality obligations.
5. Security
We implement the technical and organizational measures in Annex 1, which take into account the nature of the data and the risks involved. We may update these measures as long as the overall level of protection does not decrease.
6. Sub-processors
6.1 You give us general authorization to use sub-processors. The current list is in section 5 of our Privacy Policy.
6.2 We will give you at least 30 days' notice, by email or on that page, before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we will try to find a solution. If we cannot, you may terminate the affected part of the Service and receive a refund of any prepaid fees for the remaining period.
6.3 We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.
7. International transfers
Where Customer Data is transferred outside the EEA, the UK or Israel to a country without an adequacy decision, the transfer is governed by the European Commission's Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor), which are incorporated into this DPA by reference, together with the UK Addendum where UK data is involved. Our sub-processors' transfers rely on the same clauses or on the EU-U.S. Data Privacy Framework.
8. Assistance
8.1 Data subject requests. If we receive a request from one of your data subjects, we will forward it to you and not respond ourselves, unless you ask us to. Taking into account the nature of the processing, we will help you respond, for example by exporting or deleting data.
8.2 Impact assessments. We will provide reasonable information you need for a data protection impact assessment or a prior consultation with a supervisory authority.
9. Personal data breaches
We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. We will update you as we learn more and take reasonable steps to contain the breach.
10. Return and deletion
When the Service ends, you can export your reports before closing the account. We will delete Customer Data within 30 days after the account is closed, and backup copies are overwritten in the normal backup cycle within a further 90 days, unless the law requires us to keep it.
11. Audits
We will make available the information reasonably needed to demonstrate compliance with this DPA, including written answers to security questionnaires, once a year or after a personal data breach. Where Data Protection Law requires an audit or inspection beyond that, it will be carried out by an independent auditor bound by confidentiality, on 30 days' notice, during business hours and at your cost.
12. Liability and precedence
Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not allow such limitation. If this DPA conflicts with the Terms, this DPA prevails for matters of data protection. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.
Annex 1: Technical and organizational measures
Encryption
- All connections to the website, the app and its API use TLS. HTTP Strict Transport Security is enabled.
- Data is stored with our hosting providers, encrypted at rest.
Access control and tenant isolation
- Every customer's data is isolated in the database with row-level security policies.
- Inside a customer account, access is role-based: reps see their own data; managers and admins see their team.
- Database functions that change payroll data cannot be called by anonymous or unauthorized users.
- CRM OAuth tokens and API keys are stored server-side, used only by server functions, and never sent to the browser.
- Access to production systems is limited to the people who need it to operate the Service.
Data minimization
- From the CRM, we sync only deals and the users who own them. We do not store contacts, organizations, notes, emails, activities or files.
Application security
- Security headers on the website, including a Content Security Policy, frame protection and a strict referrer policy.
- Code changes are reviewed and deployed through version control.
- A published vulnerability disclosure policy and security.txt file.
Availability and resilience
- The Service runs on managed cloud infrastructure with automated backups.
Incident response
- Security reports and incidents are triaged by the founder, with breach notification to customers as described in section 9.