OpalSpan: data processing agreement clarification
Version and particulars/annex version: dpa-en-2026-10-15-v9. Instructions version: dpa-instructions-en-2026-10-15-v9.
Prepared successor; not selected for Checkout or existing customers. This document becomes applicable only through an attributable agreement that identifies its exact version, the customer's underlying processing agreement and the instruction/profile versions that remain applicable. Publication alone does not establish acceptance, add a supplier or widen a processing instruction.
Parties, underlying agreement and unchanged obligations
Processor: Ready IT ApS, CVR 38769383, Denmark; contact@readyit.dk. The accepted order identifies the customer, authorised representative, address, effective date and underlying agreement reference.
This clarification supplements, rather than silently replaces, the customer's identified OpalSpan DPA. Its "Parties and applicability", "Processing particulars and instructions" and Required processing terms 1-8 remain in force: documented instructions and transfers; confidentiality and Article 32 security; subprocessor authorisation, notice, objection and equivalent duties; rights/Articles 32-36 assistance; breach notification without undue delay; customer-chosen return or deletion including copies; information/audits; and notice of unlawful instructions. The underlying agreement must be identified before this clarification is used. This is not a standalone substitute for a missing Article 28 agreement.
There is no change to prices, liability allocation, service/data categories, telemetry tiers, user-consent controls, retention periods or commercial rights. The original exact profile instructions retain their meaning. A customer's attributable technical instruction is not another person's consent or proof of objective necessity or a lawful basis.
Clarified processing boundary
Ready IT is processor for instructed technical-work data, or subprocessor where the customer acts within an upstream controller's instructions. Ready IT's own account, billing, security and necessary incident-management purposes are separate controller processing. Classification depends on actual purposes, not the customer's purchasing label.
Relevant context can span cases and conversations within the authorised workspace. A separate chat is not a new confidentiality boundary. The customer's instructions and workspace separation must protect unrelated controllers' information where their requirements differ.
Selected screenshots, documents, terminal output and diagnostic evidence can contain personal information beyond the fault being investigated. The customer limits disclosure to the necessary authorised material. Credentials and unrelated sensitive information must not be copied into model context or reports. Additional special-category or criminal-offence data requires the necessary specific lawful instruction and safeguards; this clarification supplies none.
Hosted AI and customer-selected assistants
For hosted Mech, Ready IT uses OpenAI Ireland Ltd.'s Responses API and, when requested, selected-file Code Interpreter analysis and hosted search. Necessary context, tool evidence and selected attachments can be supplied. Global processing and Standard Retention apply to the observed service configuration; stored Responses output is disabled and organisation sharing opt-ins are disabled. Provider abuse monitoring, caching, image/file safety review and container state remain separate. Neither EU-only nor zero-retention processing is promised.
An external assistant selected and contracted by the customer to operate Agent CLI is a separate processing route. The customer authorises that provider's receipt of prompts, outputs and files and its account-specific processing, including retention, training settings and transfers. Ready IT's hosted-Mech provider contract does not automatically cover it. If Ready IT supplies an external assistant under a separate engagement, identify that actual supplier and processing arrangement instead. Ready IT remains responsible for its own OpalSpan processing.
Supplier and transfer particulars
| Recipient | Scope and applicable safeguards |
|---|---|
| AWS: Amazon Web Services EMEA SARL for the ordinary Danish account, with the parties identified in the AWS DPA | Stockholm Lightsail, PostgreSQL/self-hosted Typesense and private S3; CloudWatch operational logs and international CloudFront edge. AWS Service Terms 1.14 incorporate the DPA, supplementary addendum and applicable SCC/alternative transfer arrangements. AWS DPA 12.1-12.3 distinguishes regions, SCC modules and alternative mechanisms. A region does not promise EU-only support/access. |
| OpenAI Ireland Ltd. | Hosted Mech/selected-file analysis/search. Services Agreement 5.3 incorporates the DPA; DPA 4.1 addresses EEA onward transfers using SCC-containing agreements or applicable Article 45 adequacy. The actual downstream infrastructure, support, moderation and affiliate chain must be available for customer diligence. |
| Okta / Auth0 | EU-tenant authentication and identity. Exact contracting entity, applicable processing agreement and support/onward-transfer arrangements must be evidenced for the customer's instructed identity flow; an EU hostname or a link to a signature form is not that evidence. |
| Microsoft 365 / Graph | Existing contact and contract/rights correspondence to the extent it contains customer-controlled data processed on behalf. The applicable agreement and Products and Services DPA govern that processing and its international arrangements. No new Automation-email instruction is introduced. |
| GitHub | Direct private bug reports have a separate incident/support purpose. This document does not deem a personal/free repository covered by a corporate DPA. Before processing customer-controlled technical-work data there on behalf, Ready IT must establish the applicable agreement, recipient/transfer chain and customer authorisation. A private-repository flag and a supplier's public DPA are insufficient evidence by themselves. |
Stripe's independent payment/fraud/legal processing is not automatically a technical-work subprocessing. Supplier identity and applicable downstream lists must be available to the customer; intended additions/replacements remain subject to the underlying DPA's notice and objection requirement. A reference to supplier terms is not an instruction for an undisclosed additional purpose.
An in-scope adequacy mechanism differs from an SCC route. Ready IT verifies the applicable entity/scope and assesses relevant transfer documentation; it does not claim that every US recipient is DPF-certified or that SCCs alone settle effectiveness. Requests from foreign authorities require a case-specific assessment of Article 6, Article 48 and Chapter V, with appropriate redirection, lawful notification/challenge and minimum disclosure. No immunity from foreign demands is represented.
Security, retention and assistance particulars
Existing workspace/device authorisation, encrypted native transport, protected conversation payloads and scoped private files remain distinct controls. Artifact S3 public access is blocked and server-side AES-256 encryption applies. These controls do not promise customer-exclusive keys or that a provider cannot access intelligible data required for processing.
Application/system CloudWatch groups have 14-day retention, separate from workspace audit, case/conversation, financial and provider records. Original data-return/deletion obligations remain unchanged. Seven daily automatic snapshots do not govern separate manual/local recovery copies. Relevant recovery copies must be included in the instruction and completed deletion/ restriction reconciled before restored records return to use.
Bug-report attachment access has a fixed 90-day window from publication preparation for new reports, with at-most-five-minute storage download URLs. Anyone possessing the original bearer link can download without login. This access expiry is not erasure of the issue/report/recovery records. Confirmed expired original objects are removed by bounded application cleanup; uncertain delivery originals remain for reconciliation. Existing issued links retain their own expiry. No deletion or grant change is effected by this clarification.
Requests go to contact@readyit.dk. Ready IT verifies authority and scope, records system-specific actions and explains lawful retention exceptions and outstanding supplier actions. The original rights, breach-assistance, audit and return/deletion obligations are not replaced by automatic application timers.