← Back to Legal
Casper AI
Data Processing Agreement (DPA)
The terms governing how we process personal data on behalf of Casper AI users.
Section 1
Purpose & Scope
This Data Processing Agreement ("DPA") governs the processing of personal data by Super Technology Studios / Casper Global ("Processor") on behalf of business customers ("Controller") who use Casper AI in a business capacity, where such use involves processing personal data of the Controller's own customers or staff.
Section 2
Roles of the Parties
Where Casper AI is used in a business context involving third-party personal data, the customer acts as the Data Controller, and Super Technology Studios / Casper Global acts as the Data Processor, processing that data solely on the Controller's documented instructions.
Section 3
Processing Instructions
We will only process personal data as necessary to provide the Service, in accordance with the Controller's instructions, and as required by applicable law. If an instruction appears to breach data protection law, we will notify the Controller before proceeding.
Section 4
Confidentiality
Personnel authorized to process personal data are bound by confidentiality obligations, whether contractual or statutory.
Section 5
Security Measures
We implement appropriate technical and organizational measures to protect personal data, as outlined in our Security policy, including encryption, access controls, and monitoring.
Section 6
Sub-processors
We may engage sub-processors (e.g. payment processors, infrastructure providers) to support the Service. We remain responsible for their compliance with data protection obligations equivalent to those in this DPA.
Section 7
Data Subject Requests
Where we receive a request from a data subject relating to data we process on the Controller's behalf, we will notify the Controller promptly and provide reasonable assistance in responding, without responding directly unless instructed.
Section 8
Data Breach Notification
We will notify the Controller without undue delay upon becoming aware of a personal data breach affecting data processed under this DPA.
Section 9
Data Return & Deletion
Upon termination of the Service, we will delete or return all personal data processed on behalf of the Controller, unless retention is required by law.
Section 10
International Transfers
Where personal data is transferred outside the Controller's jurisdiction (including to our infrastructure in Australia), appropriate safeguards will be applied as outlined in our GDPR policy.