---
title: Data Processing Agreement
description: Thesmia.ai Data Processing Agreement (DPA)
---

[Skip to content](https://www.thesmia.ai/data-processing-agreement#main-content)

[![Thesmia.ai logo](https://www.thesmia.ai/hubfs/Thesmia%20logo%20(100%20x%20100%20px).svg)](https://www.thesmia.ai?hsLang=en)

- [Product](https://www.thesmia.ai/Product)
- Solutions
  
  Show submenu for Solutions 
  
    - [Senior Leadership Buy-In](https://www.thesmia.ai/senior-leadership-buy-in)
    - [Manager Engagement](https://www.thesmia.ai/manager-engagement)
    - [Employee adoption](https://www.thesmia.ai/employee-adoption)
- [About](https://www.thesmia.ai/About)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://www.thesmia.ai/blog)
    - [Courses](https://www.thesmia.ai/free-internal-comms-course-how-to-speak-to-c-suite)
    - [Guides](https://www.thesmia.ai/guides)
- [Login](https://app.thesmia.ai)

Open main navigation

Close main navigation

- [Product](https://www.thesmia.ai/Product)
- Solutions
  
  Show submenu for Solutions 
  
    - [Senior Leadership Buy-In](https://www.thesmia.ai/senior-leadership-buy-in)
    - [Manager Engagement](https://www.thesmia.ai/manager-engagement)
    - [Employee adoption](https://www.thesmia.ai/employee-adoption)
- [About](https://www.thesmia.ai/About)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://www.thesmia.ai/blog)
    - [Courses](https://www.thesmia.ai/free-internal-comms-course-how-to-speak-to-c-suite)
    - [Guides](https://www.thesmia.ai/guides)
- [Login](https://app.thesmia.ai)
- [Try for Free](https://app.thesmia.ai)

[Try for Free](https://app.thesmia.ai)

# **Data Processing Agreement (DPA)**

### 1. Purpose

Defines how Thesmia.ai (Processor) processes personal data on behalf of the Client (Controller).

### 2. Obligations

- Processor acts only on documented instructions.
- Confidentiality obligations for our team.
- Technical and organisational measures in Annex A.
- Incident notification obligations.

### 3. Sub‑processors

We may appoint sub‑processors (AWS, analytics). Contrary sub-processor additions will require written notice and objection right.

### 4. Data transfers

Any non‑EEA/UK transfers via standard contractual clauses or adequacy decisions.

### 5. Rights of data subjects

We’ll assist the Controller to fulfil data subject rights under UK GDPR.

### 6. Audit

Controller may audit compliance; Processor will support with adequate notice and at reasonable times.

### 7. Termination & deletion

Upon contract end, we will delete or return personal data per Controller instructions, unless legally required to retain it.

Updated: 4th July 2025

[![Thesmia.ai logo](https://www.thesmia.ai/hubfs/Thesmia%20logo%20(100%20x%20100%20px).svg "Thesmia.ai logo")](https://www.thesmia.ai?hsLang=en)

Stop writing comms. Start driving change.

[linkedin-in icon](https://www.linkedin.com/company/thesmia-ai)

**Pages**

 

[Home](https://thesmia.ai?hsLang=en)

[Product](https://www.thesmia.ai/product?hsLang=en)

[Pricing](https://www.thesmia.ai/pricing?hsLang=en)

[About](https://www.thesmia.ai/about?hsLang=en)

[Blog](https://www.thesmia.ai/blog?hsLang=en)

**Policies**

 

[Privacy Policy](https://www.thesmia.ai/privacy-policy?hsLang=en)

[Cookie Policy & Consent](https://www.thesmia.ai/cookie-policy?hsLang=en)

[Terms & Conditions (T&Cs)](https://www.thesmia.ai/terms-conditions?hsLang=en)

[Data Processing Agreement (DPA)](https://www.thesmia.ai/data-processing-agreement)

 

Thesmia.ai Ltd © company no: 16565759 | 2025