Data Processing Addendum (DPA)
Version 1.0 · OnCloud Ltd.
The Griffin31 Data Processing Addendum (DPA) forms part of the Griffin31 Terms and Conditions. It sets out how OnCloud Ltd. processes Customer Personal Data as a processor while providing Griffin31, in line with the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and the Israeli Protection of Privacy Law.
Customers accept the DPA by accepting the Terms and Conditions. No separate signature is required.
Download the DPA (PDF, 6 pages)
What it covers
Section titled “What it covers”- Roles and instructions: the customer is the controller, OnCloud is the processor
- Read-only access to Microsoft 365, and no use of customer data to train AI
- Security measures (Annex II), independently audited under SOC 2 Type II
- Sub-processors (Annex III), with 30 days’ notice of changes and a right to object
- International transfers: hosting in Microsoft Azure North Europe (Ireland)
- Personal data breach notification within 24 hours of confirmation
- Return and deletion of data, audits, and assistance with data subject requests
Contact
Section titled “Contact”- Privacy questions and a countersigned copy: privacy@griffin31.ai
- Security incidents: support@griffin31.ai