Data Processing Addendum (DPA)

Last updated: September 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between you (“Customer”) and Governing Idea (“Processor,” “we,” “our,” or “us”). It describes how we process personal data on your behalf in accordance with Article 28 of the EU General Data Protection Regulation (GDPR).

1. Roles

Customer is the data controller. Governing Idea is the data processor that processes personal data solely to provide the Governing Idea service.

2. Processor Obligations

  • Process personal data only on documented instructions from Customer.
  • Maintain appropriate technical and organizational security measures.
  • Ensure confidentiality of personnel with access to personal data.
  • Assist Customer with data subject requests, including access, portability and erasure, where feasible.
  • Notify Customer without undue delay in the event of a data breach.
  • Delete or return personal data upon request or termination, as set out in section 5.

3. Subprocessors

We use subprocessors to support hosting, data storage, authentication, email delivery, and AI processing. A current list is available on our Subprocessors page.

4. International Transfers

When transferring personal data outside the EU or UK, we rely on the transfer mechanism in place with each subprocessor.

Vercel and Resend are certified under the Data Privacy Framework. Vercel is certified under the EU-U.S. and Swiss-U.S. frameworks and the UK Extension, covering HR and non-HR data. Resend is certified under the EU-U.S. framework and the UK Extension, for non-HR data only; its re-certification is under review.

Anthropic and Supabase are not on the Data Privacy Framework register. Transfers to them rely on Standard Contractual Clauses incorporated in each subprocessor's data processing addendum: for Anthropic, Modules 2 and 3, incorporated on acceptance of its commercial terms; for Supabase, the clauses approved by the European Commission together with the UK ICO addendum.

Data Privacy Framework certifications are renewed annually. The register maintained by the U.S. Department of Commerce is authoritative for each subprocessor's current status; this section reflects it as of September 2026.

5. Term and Termination

This DPA remains in effect as long as we process personal data on behalf of Customer. Upon termination, or on Customer's documented instruction, we will, at Customer's choice, return personal data in a structured, machine-readable form, delete it from our database, or both, unless legally required to retain it. Deletion from our database does not extend to copies held by our subprocessors under their own retention terms, which are governed by the agreements listed on our Subprocessors page. We will confirm each deletion to Customer against Customer's reference.