Data Processing Agreement (template for business clients)
Version: 2026-10-31-draft · Date:
DRAFT — must be reviewed by a lawyer before it binds anyone (Law of the Republic of Uzbekistan “On Personal Data”). Text in [square brackets] is a placeholder.
Parties and roles
The business client is the controller of the personal data in its statements and files; [LEGAL ENTITY NAME], registration number [REGISTRATION NUMBER], TIN [TAX ID], [LEGAL ADDRESS], Republic of Uzbekistan (“we”). Contact: [CONTACT EMAIL]. acts as processor on the client’s behalf. This template becomes binding when both parties sign it or the client accepts it in the service.
Subject, duration and purpose
Processing of the client’s financial data to provide the Silkroute AI CFO (parsing, categorisation, dashboards, forecasts, AI answers, reports), for as long as the main agreement lasts.
Data and data subjects
Transaction data (dates, amounts, counterparties, descriptions), names of counterparties and employees appearing in statements (incl. payroll), and the contact and account data of the client’s users.
Processor duties
Process only on the client’s documented instructions (the service settings count as instructions); keep the data confidential and bind staff to confidentiality; apply the security measures below; help the client answer data-subject requests and meet its own legal duties.
Sub-processors
The client authorises the sub-processors on the Sub-processor list. We announce a new sub-processor [NOTICE DAYS] days in advance; the client may object and end the agreement if the objection cannot be resolved.
Security
Encryption in transit and of secrets at rest, row-level separation of each client’s data, pseudonymisation before any AI call, least-privilege access, two-factor sign-in for administrators, and an append-only audit log.
Personal data breaches
We notify the client without undue delay and no later than [BREACH NOTICE HOURS] hours after we become aware of a breach affecting its data, with what we know, the likely effects and the measures taken.
Location and transfers
Data is stored in [DB REGION]. Storage of Uzbek citizens’ personal data in the Republic of Uzbekistan, as required by law, is to be confirmed before commercial use; transfers abroad happen only with the safeguards the law requires.
Audits
We give the client the information needed to show compliance and allow audits on reasonable notice, at most once a year unless a breach occurred.
End of processing
When the agreement ends we delete the client’s data, or return it on request, within [RETURN DAYS] days, except records the law requires us to keep.
Law
This agreement follows the main agreement and the law of the Republic of Uzbekistan.