Grace← Home

Data Processing Addendum — Grace

Why this page is not the DPA yet

A data processing addendum carries real legal weight: it is the document your own auditor will ask to see, and the one that decides what we may do with information you are responsible for. Ours is with our solicitor for review, ahead of an effective date of 14 September 2026.

A full draft exists and is substantially complete. What is not settled is the part that has to be negotiated rather than drafted — the scope, frequency and cost of your audit rights, the notice period before we change a sub-processor, and whether standard contractual clauses are needed where the GDPR applies. We are not going to publish placeholder answers to those, because a DPA you cannot rely on is of no use to the person who has to rely on it.

No customer data enters Grace under a paid agreement before an executed DPA is in place. That is a gate we set for ourselves, not an aspiration.

What is already true and already published

The commitments a DPA would restate are, in substance, already described and already being met:

  • Who processes what, and where — every sub-processor, the service it provides, the data it sees and the country it processes in: Sub-processors.
  • How information is handled, including overseas disclosure and breach notification — Privacy Policy.
  • How the platform is secured, including tenant isolation enforced at the database — Security.
  • Export. You can export a workspace's data from within the Service at any time, without asking us.
  • Deletion is reversible by default. Deleting a record marks it rather than destroying it, and a workspace sets its own policy for permanent erasure.

Getting the draft

If you are evaluating Grace and need to review the DPA before the reviewed version is published, ask at support.grace@strategicworlds.com.au and we will send you the current draft, marked as a draft, along with the list of terms still under review.