Duscode
Download Sign in
Legal · draft

Data Processing Agreement

DRAFT – needs lawyer review. This agreement has not yet been reviewed by a lawyer and is not final. Items marked [to confirm] need legal advice. Version: draft-2026-10-18. To sign a copy for your organisation, email support@duscode.com.

1. Parties and scope

This agreement is between the business customer that accepts the Terms of Service ("Customer", the controller) and Yiontech Ltd (company number 16519666), registered office 3 Milford Court, Milford Street, Huddersfield, HD1 3DY, England ("Duscode", the processor). Yiontech Ltd is registered with the Information Commissioner’s Office [ICO registration number, to add]. It applies where Duscode processes personal data on the Customer’s behalf, under the UK GDPR and the Data Protection Act 2018, and forms part of the Terms.

2. What Duscode processes, and what it doesn’t

The Duscode app runs on the Customer’s computers. Code, files, chats and project data stay there and are not sent to Duscode, except as described below. Duscode processes:

  • Team accounts: the names and work email addresses of the people the Customer invites, their seats and sign-in records.
  • Requests on Duscode credits: the content of each model request (which may contain personal data that is in the Customer’s code or files) passes through Duscode Cloud in memory to the AI provider that answers it, and back. Duscode does not store the content; it keeps the model, provider, token counts, cost and time.
  • Problem reports the Customer’s users choose to send from the app, after the app masks secrets and personal paths.

Duscode does not host the Customer’s software or production data today. If it does in future (public hosting), an annex to this agreement will describe that processing before it starts. [Annex to draft with hosting.]

3. Details of processing (UK GDPR Article 28(3))

  • Subject matter and duration: providing Duscode under the Terms, for as long as the Customer’s account exists, plus the deletion period in section 9.
  • Nature and purpose: account administration, licensing, billing, forwarding model requests on credits, support.
  • Data subjects: the Customer’s staff and contractors who use Duscode; people whose personal data appears in content the Customer sends on credits.
  • Categories of data: names, email addresses, IP addresses, account and usage records; any personal data in request content (transient).
  • Special-category data: not intended. The Customer should not send it on credits without telling us. [To confirm.]

4. Duscode’s obligations

  • Process personal data only on the Customer’s documented instructions (the Terms, this agreement and the Customer’s use of the product), unless the law requires otherwise, in which case we tell the Customer first unless the law forbids it.
  • Make sure everyone authorised to process the data is bound by confidentiality.
  • Keep appropriate technical and organisational measures (section 6).
  • Help the Customer answer data-subject requests and meet its obligations on security, breach notification, impact assessments and consultation with the ICO, taking into account what we can see.
  • Make available the information needed to show compliance with Article 28, and allow reasonable audits (section 8).

5. Sub-processors

The Customer authorises the sub-processors listed in the Privacy Policy (payments, AI providers for requests on credits, hosting, email). We bind each to data-protection terms no less protective than these, stay responsible for them, and give at least 30 days’ notice by email before adding or replacing one, so the Customer can object on reasonable grounds; if we can’t resolve the objection, the Customer may end the affected service. [Notice period to confirm.]

6. Security

Measures include: encryption in transit (TLS) and at rest for the cloud database; sign-in by emailed link with sessions stored only as one-way hashes; CSRF protection and strict cookies; rate limits and lockouts; role-separated admin access limited to named addresses; an audit log of account events; tenant isolation tested by attack tests on every change; request content on credits held only in memory; secrets kept out of model requests by the app’s vault. We review these measures as the service changes. No measure makes a system immune to attack, and we don’t claim otherwise.

7. Personal data breaches

We notify the Customer without undue delay after becoming aware of a personal data breach affecting its data, and in any case within 48 hours [to confirm], with what we know: what happened, the data and people affected, likely consequences, and what we are doing. We update the Customer as we learn more.

8. Audits

Once a year, or after a breach, the Customer may ask for information or an audit, on 30 days’ notice, at its own cost, by an auditor bound by confidentiality, without access to other customers’ data. We may answer first with documentation and existing reports. [Scope to confirm.]

9. Deletion and return

When the Customer’s account closes, we delete its personal data within 30 days, except records the law requires us to keep (such as billing records, 6 years for HMRC), which we keep only for that purpose. The Customer can export its account data before closing. [Periods to confirm.]

10. International transfers

Some sub-processors process data outside the UK. We transfer data only to countries with UK adequacy regulations or under the UK International Data Transfer Agreement or Addendum, with a transfer risk assessment where required. [To confirm per sub-processor.]

11. Liability and order of precedence

Liability under this agreement is subject to the limits in the Terms, except where the law doesn’t allow them. If this agreement and the Terms conflict on data protection, this agreement wins.

12. Law

This agreement is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.