When a DPA matters
A DPA becomes relevant when SpeakUp processes personal data on behalf of a customer or partner under a business relationship.
Data Processing
Data Processing Addendum & International Transfers
Public overview of when a DPA may apply, what it generally covers, and how international transfer mechanisms fit into customer relationships with SpeakUp.
Last updated: March 30, 2026
What it usually covers
Roles of the parties, processing instructions, safeguards, subprocessors, assistance obligations, and deletion or return commitments.
Transfers
Cross-border data movement may require SCCs, UK addenda, adequacy-based approaches, or other lawful transfer mechanisms depending on the facts.
Public page vs contract
This page is an overview. The signed DPA and related contractual documents should govern the actual relationship.
SpeakUp Trust Portal
Privacy, security, vendors, and review materials in one place
Find the key public trust documents, follow-up review materials, and the right next step without bouncing between separate policy pages.
Core documents
A Data Processing Addendum, or DPA, is the contractual document that explains how one party processes personal data on behalf of another.
This page summarizes the topics customers most often review. It does not replace an executed DPA or any other signed contractual terms.
01
What this page is and is not
This page summarizes SpeakUp’s expected DPA topics and transfer approach. It is not a signed agreement and should not be read as a substitute for an executed DPA, order form, or customer contract.
02
Draft package for legal review
SpeakUp can use a structured draft DPA as the starting point for customer legal review. The downloadable draft below is provided as a practical template, not as an automatically accepted contract.
Download draft DPA (Markdown)
- Uses a schedule-driven structure so customer legal teams can review scope, security measures, and transfer terms quickly.
- Includes placeholders where customer-specific roles, processing details, and jurisdiction-specific clauses may need to be confirmed.
- Should be reviewed together with the current subprocessor list, service scope, and any applicable transfer annexes.
03
When a DPA typically applies
- When a customer uses SpeakUp and SpeakUp processes personal data on the customer’s behalf.
- When the relationship makes SpeakUp a processor or subprocessor rather than an independent controller for the relevant data set.
- When procurement, privacy, or legal review requires written controller-processor terms before production use.
Topics a DPA usually covers
- The roles of the parties, subject matter of processing, categories of data, and duration of processing.
- SpeakUp’s obligation to process data only on documented instructions and to keep personnel confidentiality controls in place.
- Technical and organizational measures, incident notification expectations, and assistance with data subject requests where applicable.
- Use of subprocessors, customer notice or approval mechanics where contractually required, and flow-down obligations to subprocessors.
- Return or deletion of customer data at the end of the relationship, subject to legal retention requirements.
04
International transfers and SCC context
- If personal data moves across borders, the relationship may require lawful transfer mechanisms tailored to the jurisdictions involved.
- Depending on the customer and region, that may include EU Standard Contractual Clauses, a UK addendum, adequacy-based transfers, or other region-specific transfer terms.
- Relevant provider commitments, transfer annexes, and supplementary safeguards should be evaluated based on the actual service scope and data flows, not by logo alone.
Subprocessors and onward processing
A DPA and the public subprocessor list serve different purposes. The DPA defines the contractual rules; the subprocessor page provides public vendor transparency.
05
How to request DPA materials
If your team is evaluating SpeakUp and needs DPA or transfer information, contact us with enough context to route the request efficiently.
- Identify your company and the relevant product or use case.
- State whether you are requesting a DPA, SCC support, transfer information, or a procurement package.
- Mention any timing constraints, region-specific requirements, or vendor-review questionnaires that matter to your review.
06
Request contact
Use the contact below for DPA, transfer, procurement, or privacy-contract questions relating to SpeakUp.
- Contact
- contact@speak-up.pro
- Related page
- Subprocessors
- Related topics
- DPA, SCCs, transfers, procurement
Trust Workflow
Need a structured package for legal, privacy, or security review?
Use the Trust Package path when your team needs the next layer beyond the public trust pages.