Data Processing Agreement (DPA)

Last Updated: June 10, 2025

At Aptly, we take data protection and privacy seriously. We offer a comprehensive Data Processing Agreement (DPA) to support our customers’ compliance with regulations such as the General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

What is the DPA?

Our DPA defines how Aptly processes, protects, and handles personal data on behalf of our customers when delivering our cloud-based authority management platform.

It includes:

  • Roles and responsibilities of each party under applicable data protection laws
  • Descriptions of the personal data processed by Aptly
  • Subprocessor obligations and prior notice provisions
  • Technical and organizational security measures (TOMs)
  • Standard Contractual Clauses (SCCs) for international data transfers (including the UK Addendum)
  • Breach notification timelines and cooperation duties

When Does It Apply?

The DPA applies to Aptly’s customers when:

  • Aptly processes personal data as a data processor on behalf of the customer
  • The customer and Aptly have executed a signed subscription or Cloud Service Agreement
  • A customer requires assurances regarding GDPR, CCPA, or international data transfers

For visitors or prospective customers, our data practices are described in our Privacy Policy.

Subprocessors

Aptly uses a small number of carefully selected subprocessors to support our services. Our current list is maintained at:
👉 https://trust.aptlydone.com/subprocessors

Customers are notified in advance of any changes to this list, in accordance with our DPA.

Security Commitments

For details on our encryption, access controls, infrastructure, and more, please visit our:
🔐 Security Policy

Request or Execute a DPA

If you are a customer or prospective customer and would like to:

  • Review a sample copy of Aptly’s DPA
  • Request to execute the DPA as part of onboarding
  • Ask questions about how Aptly handles personal data

Please contact us at:
📧 [email protected]

We typically return a completed DPA within 1 business day.

Questions?

For any data protection or privacy inquiries, you can also reach our legal or compliance teams directly at:

Aptly, Inc.
600 N Robinson Ave
Oklahoma City, OK 73102
[email protected]