Data Processing Agreement

The Processor processes personal data on behalf of the Controller for the purpose of providing compliance assessment, document management, and AI-assisted compliance analysis services. Processing continues for the duration of the service agreement.

• Storage and analysis of compliance evidence documents uploaded by the Controller
• AI-powered evaluation of compliance controls against regulatory frameworks
• Generation of compliance reports, policies, and risk assessments
• User account management and authentication

• Contact information (names, email addresses)
• Employment information (contained in uploaded compliance evidence)
• IT security data (access logs, system configurations)
• Any personal data contained in documents uploaded by the Controller

• Controller's employees and contractors
• Controller's customers (where included in uploaded evidence)
• Controller's partners and vendors

The Processor shall:

1. (a)Process personal data only on documented instructions from the Controller
2. (b)Ensure persons authorised to process the data are bound by confidentiality
3. (c)Implement appropriate technical and organisational security measures (Art. 32 GDPR)
4. (d)Not engage another processor without prior written authorisation of the Controller
5. (e)Assist the Controller in responding to data subject requests (Art. 15–22 GDPR)
6. (f)Assist the Controller in ensuring compliance with Art. 32–36 GDPR
7. (g)Delete or return all personal data at the end of the service, at the Controller’s choice
8. (h)Make available all information necessary to demonstrate compliance and allow audits

The Processor uses the following sub-processors:

The Controller hereby grants general authorisation for the engagement of sub-processors listed above. The Processor shall inform the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object.

Where personal data is transferred to countries outside the EEA, the Processor ensures appropriate safeguards per Chapter V GDPR, including EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and Transfer Impact Assessments.

The Processor implements the following technical and organisational measures:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access control with principle of least privilege
• Regular security audits and vulnerability assessments
• Automated monitoring and incident detection
• Employee confidentiality obligations and training

The Processor shall notify the Controller without undue delay (and in any event within 48 hours) after becoming aware of a personal data breach, providing all information required under Art. 33(3) GDPR.

The Controller may audit the Processor's compliance with this DPA. Audits shall be conducted with reasonable notice and during normal business hours.

This DPA shall remain in effect for the duration of the service agreement. Upon termination, the Processor shall delete all personal data within 30 days unless retention is required by law.