Data Processing Agreement
Effective 22 October 2026 · PYRICATO PRODUCTIONS LLC
Parties. The customer ("Controller") and PYRICATO PRODUCTIONS LLC, operating as Spectre Workflows ("Processor").
- Subject matter. The Processor processes personal data in the customer's workspaces only to provide Spectre as described in the proposal or plan.
- Instructions. The Processor acts only on the Controller's documented instructions (the product settings and this agreement), unless the law requires otherwise.
- Types of data and people. Employees, candidates, learners, customers, suppliers and other contacts the Controller uploads: names, contact details, job and training records, transaction records, notes.
- Confidentiality. Everyone at Spectre with access is bound by confidentiality.
- Security. The measures on the Security page apply as a minimum.
- Sub-processors. Listed on the Sub-processors page. The Processor gives 30 days' notice of new sub-processors; the Controller may object on reasonable grounds.
- Assistance. The Processor helps the Controller answer data-subject requests and meet its obligations under UAE PDPL, DIFC/ADGM data protection law and GDPR where applicable.
- Breach notification. The Processor notifies the Controller without undue delay and within 48 hours of becoming aware of a personal-data breach affecting the Controller's data, with what's known and what's being done.
- International transfers. Covered by appropriate safeguards (e.g. standard contractual clauses) where required.
- Return and deletion. At the end of service, the Controller can export everything; the Processor deletes the data within 30 days unless the law requires keeping it.
- Audits. The Processor provides information needed to show compliance, and allows reasonable audits on 30 days' notice, at most once a year.
- Liability. As in the main agreement.