DPA Annex 1 — Processing Details
Annex 1 — Processing Details
Document ID: LOS-LEGAL-003A
Title: DPA Annex 1 — Processing Details
Version: 1.0
Last updated: 2026-10-24
Publisher: Algoshred Technologies Private Limited (Burdenoff Group)
Canonical location: https://burdenoff.com/contracts/labsofscience/LOS-LEGAL-003A
Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the LabsOfScience subgroup at https://burdenoff.com/contracts/labsofscience/. Every referenced contract is identified by its Document ID (LOS-LEGAL-### / LOS-PRICING-###) and incorporated by reference.
Status: Published v1.0 — effective 2026-10-24. Reviewed against the production platform and approved for publication by the founder (India jurisdiction); outside-counsel review checkpoints are tracked in LOS-LEGAL-REG.
A. Subject-matter and duration
- Subject-matter: provision of the LabsOfScience science & discovery platform (research projects, experiment design, reproducible experiment runs, the electronic lab notebook, versioned protocols, versioned datasets and analysis pipelines, lab inventory and instrument management, internal communications, and research analytics) to Customer.
- Duration: for the duration of the Subscription Term and any retention period under MSA §5.5 / DPA §4.7 (including statutory research-records / data-integrity / tax retention Customer instructs).
B. Nature and purpose of processing
Algoshred processes Personal Data to:
- authenticate users and manage tenants, roles and access;
- run the research lifecycle (projects, experiments, experiment runs, observations);
- operate the electronic lab notebook (notebook entries, witnessing and e-signatures, sign-off records);
- maintain versioned protocols and protocol steps (authoring, publication, version freezing);
- manage versioned datasets, dataset versions and analysis pipelines (pipeline definitions and pipeline runs);
- manage lab inventory and instruments (reagent/consumable stock, instrument records, instrument bookings);
- store and serve research files and documents (datasets, figures, safety data sheets, attachments);
- provide AI-assisted suggestions, summarisation and recommendations over research content (assistive only; no autonomous decisions);
- deliver internal communications, notifications and channel events configured by Customer;
- generate audit logs, usage telemetry and analytics;
- provide customer support and respond to data principal requests;
- detect and prevent fraud, abuse and security incidents;
- comply with legal obligations.
C. Categories of data subjects
- Customer's Authorized Users, administrators (lab managers, research-data officers), principal investigators, and managers.
- Researchers and lab members who design experiments, perform runs, and author notebook entries in Customer's tenant.
- Collaborators and external reviewers granted access to Customer's projects.
- Authors and signatories named in protocols, notebook entries and e-signature records.
- Custodians and bookers associated with inventory items and instrument bookings.
- Emergency contacts and references mentioned within Customer Data, to the extent Customer provides them.
D. Categories of Personal Data
| Category | Examples |
|---|---|
| Identification & contact | Name, work and personal email, username, profile photo, phone, organisation/affiliation |
| Account & authentication | Password hash (where local auth used), SSO subject ID, MFA factors |
| Authorisation | Roles, tenant/workspace memberships, RBAC assignments, project visibility, manager relationships |
| Research-activity data | Principal-investigator and lead-researcher identifiers, experiment authorship, run "performed-by" records, project membership |
| Electronic lab notebook | Notebook entry content, author identity, witness/signatory identity, e-signature metadata, sign-off timestamps |
| Protocols & methods | Protocol author identity, version history, step authorship, safety notes |
| Datasets & pipelines | Dataset author identity, version "created-by" records, change notes, pipeline-run initiator and parameters |
| Inventory & instruments | Custodian identity, booker identity, booking time windows and purpose, item lot/expiry metadata |
| Device & connection | IP address, user agent, OS, geolocation (city-level), device metadata |
| Usage data | Pages visited, features used, navigation, notification interactions, AI-assist metadata |
| Content & documents | Uploaded files, figures, safety data sheets, attachments, communications |
| Billing | Billing contact, billing address, GSTIN/PAN (Indian customers), VAT ID, tokenised card identifier (actual card data held by payment processor) |
| Support | Support ticket content, screen recordings (only if shared), call transcripts |
E. Sensitive personal data / Special categories
Algoshred does not require Customer to upload "sensitive personal data or information" under the SPDI Rules or special-category personal data under Article 9 GDPR. Customer shall not upload, and shall instruct Authorized Users not to upload, such categories (health data, biometric IDs, Aadhaar numbers, religion, caste, political opinions, sexual orientation, trade-union membership, or criminal-record data) unless expressly authorised under an Order Form with appropriate additional controls and a lawful basis. Research data that constitutes human-subjects / clinical / patient data (e.g. data governed by an ethics-committee / IRB approval) is permitted only where Customer has the requisite ethical approvals, consents and lawful basis, and instructs Algoshred to process it strictly as Customer directs; Customer remains the controller for all such data.
F. Retention periods
- Account profile data: while account is active + 90 days, unless legal hold.
- Research records (projects, experiments, runs, notebook entries, protocols, datasets, pipeline runs, inventory and instrument records): for the Subscription Term on Customer's instructions; then export within 30 days and delete, subject to statutory research-integrity / data-retention / tax retention Customer directs.
- Documents and dataset files in the file store: until deleted by Customer or account closure.
- Audit logs: per Plan (default 30 days; longer for Enterprise).
- Analytics events: per Plan; user-level up to 13 months.
- Backups: rolling 30 days hot, 90 days cold (default).
- Support tickets: 24 months after closure unless Customer requests earlier deletion.
- Billing records: 8 years (Indian tax/Companies Act retention).
G. Sub-processing
See Annex 3. Verification / external-research-service providers are added only when Customer enables them.
H. Transfer mechanisms
Default storage region(s) as specified on the Order Form (default: Amazon Web Services ap-south-1, Mumbai, India, for all backend, database, object-storage and frontend hosting). International transfers under DPA §7 use SCCs/UK Addendum, DPDP-permitted destinations, and SPDI-equivalent contractual safeguards as applicable. Research-data localisation as configured on the Order Form.
Reference and incorporation
All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (LOS-LEGAL-### or LOS-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.