Data Processing Agreement
Last updated October 22, 2026
1. Purpose and scope
This page summarizes the terms of the Data Processing Agreement ("DPA") SlashPeak, Inc. enters into with customers who need one to satisfy their own data-protection obligations under GDPR, UK GDPR, or similar law. It is a plain-language summary, not the executed agreement — use the request link below to get the signed document.
2. Roles: controller and processor
For personal data contained in your BigQuery metadata (such as the user email attached to a query job) and in your account and team data, you are the controller and SlashPeak is the processor. Email addresses, phone numbers and IP addresses inside query text, and matches of your Settings → Privacy patterns, are masked inside your BigQuery project before we receive them, so we do not process them. For account-level data we determine the purpose and means of processing (for example, your own login credentials), we act as controller.
3. Processing instructions
We process personal data only on your documented instructions — as embodied in these Terms, your account configuration, and the DPA itself — and to comply with applicable law.
4. Confidentiality
Personnel authorized to process personal data are bound by confidentiality obligations, whether contractual or statutory.
5. Subprocessors
We maintain a current list of subprocessors on our Subprocessors page and will notify customers who request notice before adding a new one, giving a reasonable window to object on legitimate grounds.
6. Security measures
We maintain technical and organizational measures appropriate to the risk, including encryption in transit and at rest, database-enforced tenant isolation, audit logging, least-privilege access, and session controls (each user can see and sign out their devices; on Enterprise, owners can set a device limit and an idle timeout) — described in full on our Security page.
7. Breach notification
We will notify affected customers of a confirmed personal data breach without undue delay, and in any case within 72 hours of becoming aware of it, with the information reasonably available at the time.
8. Audits
On reasonable notice and subject to confidentiality, we will make available the information necessary to demonstrate compliance with the DPA, and permit and contribute to audits, including inspections, conducted by the customer or an auditor it mandates.
9. Deletion and return of data
At the end of the provision of services, we will delete or, on request, return personal data, except where retention is required by law — consistent with the retention terms in our Privacy Policy.
10. International transfers
Where personal data is transferred outside the EEA, UK, or Switzerland, the transfer is governed by Standard Contractual Clauses (SCCs) or another lawful transfer mechanism, incorporated into the executed DPA.
11. Request a signed DPA
Need an executed copy for your own compliance records? Email [email protected] and we'll send the full agreement for signature.
Need a signed copy?
Email our legal team and we'll send the full agreement for signature.