Data Processing Agreement (DPA)

Version 2026-09-19. Forms part of the Terms and Conditions and applies to personal data in Customer content, for which the Customer is controller and the Provider is processor (Art. 28 GDPR).

1. Parties

The provider's identification details are not yet configured for this environment (deployment decision).

The Customer: the organisation holding the workspace, identified in the account.

2. Subject matter, duration, nature and purpose

Processing of procurement documents, company evidence and staff data (name, position, experience, qualifications) for: fact extraction and verification, requirement matching, assisted drafting, CV and package generation, notifications to the Customer's users. Duration: the contract term plus the retention period.

3. Categories of data subjects

Employees and contractors of the Customer, representatives of partners, persons named in contracting authorities' documents.

4. Customer instructions

The Provider processes only on the Customer's documented instructions, expressed through use of the Service's functions and this Agreement. The Provider informs the Customer if an instruction infringes the law.

5. Confidentiality and personnel

Provider personnel access Customer content only through time- and scope-limited support sessions that are approved, audited and notified to the Customer's owners.

6. Security measures

Row-level isolation per Customer in the database, TLS and at-rest encryption, least-privilege access keys, immutable audit log, antivirus scanning of files, electronic signature validation, backups tested by restore drills, incident response plan.

7. Subprocessors

The Customer authorises the publicly listed subprocessors. The Provider notifies changes 30 days in advance; the Customer may object on reasonable grounds and terminate without penalty.

8. Assistance

The Provider assists the Customer with data subject rights through export, rectification and deletion functions, and with impact assessments within available information.

9. Incidents

The Provider notifies the Customer of a personal data breach without undue delay and within 72 hours of becoming aware, with the available information and subsequent updates.

10. Deletion and return

On termination the Customer exports data in open formats; the Provider deletes content per the retention policy, except for statutory retention obligations and legal holds, and confirms deletion on request.

11. Audit

The Provider makes available control documentation, subprocessor assessment reports and relevant logs; on-site audits are arranged with 30 days' notice, at most once a year except after incidents.

12. International transfers

Processing takes place in the European Union. Any transfer outside the EU/EEA occurs only under a valid mechanism (standard contractual clauses, adequacy decision) documented in the transfer register.

Version 2026-09-20 · Provider information (Romanian Law 365/2002): The provider's identification details are not yet configured for this environment (deployment decision).