Data Processing Agreement

Last Updated: January 19, 2026

This Data Processing Agreement ("DPA") describes how BYV processes personal data on behalf of its clients in the course of delivering software development and AI engineering services. This DPA supplements our Privacy Policy and Terms of Service.

1. Definitions

  • Data Controller — the client who determines the purposes and means of processing personal data
  • Data Processor — BYV, acting on the instructions of the Data Controller
  • Personal Data — any information relating to an identified or identifiable natural person
  • Processing — any operation performed on personal data

2. Scope of Processing

BYV processes personal data only:

  • On documented instructions from the Data Controller
  • To the extent necessary to deliver the agreed services
  • In accordance with applicable data protection laws

3. Data Security Obligations

BYV implements appropriate technical and organizational measures including:

  • Encryption of personal data in transit and at rest
  • Access controls limiting data access to authorized personnel only
  • Regular security assessments and vulnerability testing
  • Incident response procedures with breach notification within 72 hours
  • Secure deletion of data upon project completion or client request

4. Sub-processors

BYV may engage sub-processors to assist in service delivery. All sub-processors are bound by data protection obligations no less stringent than those in this DPA. Current sub-processors include cloud infrastructure providers used for model training and deployment. Clients may request the current sub-processor list by contacting us.

5. Data Subject Rights

BYV will assist Data Controllers in fulfilling their obligations to respond to data subject requests (access, rectification, erasure, portability) within the timeframes required by applicable law.

6. Data Retention and Deletion

Upon termination of services, BYV will securely delete or return all personal data processed on behalf of the client, unless retention is required by law. Deletion will be completed within 30 days of written request.

7. Contact

For data processing inquiries or to request a signed DPA for enterprise engagements, contact us at [email protected].