Data Processing Agreement

This agreement is between you, the customer, as controller, and Ricardo Pedro Slagter, trading as AIConscius, as processor. It forms part of the Terms of Service and applies from the moment you accept them, on the Free plan as well as on a paid plan. Where this agreement and the Terms differ on the processing of personal data, this agreement prevails.

It covers the personal data we process on your behalf. For the data we process for our own purposes, such as your account, payments and invoices, we are controller; the Privacy Policy describes that.

Subject and purpose. Providing the AIConscius workspace to you: storing and showing what you enter, scanning the websites and domains you choose, applying the rule sets, generating drafts and evidence packs, and keeping the audit trail of your decisions.

Personal data. Whatever personal data you put into the workspace, typically names, roles and work contact details of people in your organisation or your clients' organisations (for example system owners and reviewers), what is said about them in descriptions, answers and review decisions, and personal data in evidence you upload or on pages we scan for you.

Data subjects. Your staff, contractors and clients, and people whose data appears in the material you upload or on the websites you ask us to scan.

Special categories. AIConscius is not built for special categories of personal data (GDPR Art. 9) or data on criminal convictions (Art. 10). Do not upload them unless your assessment cannot be done without them; you decide whether that is lawful.

Duration. For as long as you use AIConscius, and afterwards until the data is deleted as described below.

We process the data only on your documented instructions: these Terms and this agreement, and what you do in the app. We do not use it for our own purposes, do not sell it and do not use it to train models. If you report that a scan was wrong, we keep that report without your name or account to improve the scanner; do not put personal data in such a report.

If the law requires us to process the data in another way, we tell you first, unless the law forbids that. If we think an instruction breaks the GDPR or other data protection law, we tell you at once.

We take the measures GDPR Art. 32 requires for the risk involved, including:

• all traffic to the service over TLS;
• separation between organisations in the database, so that one organisation cannot read another's data, with tests that try to cross that boundary and must fail;
• an audit trail of who changed an assessment, when, and what it was before;
• new code reaches the server only through an automated deployment of code first published to our repository, so it is known which code ran when;
• a nightly back-up of the database and uploaded files, encrypted before it leaves the server, kept for 30 days on separate storage, plus a copy of the server kept for 7 days.

The Security page describes what we operate and what we do not have, such as a certification.

You authorise us to use these sub-processors for the data we process for you:

• Hetzner Online GmbH, Germany: hosting of the application, the database and the back-ups, in data centres in Germany.
• OVH Hosting Limited (OVHcloud), Ireland: only for the optional deep check in the Compliance Scanner, and only the system description you type there; the model runs on servers in the EU and OVHcloud does not store or reuse the text. OVHcloud's group companies in Canada and the United Kingdom may access its systems remotely for maintenance and security; both countries have an adequacy decision of the European Commission.
• Hostinger International Ltd, Cyprus: our e-mail, as far as you send us personal data by e-mail.

We bind each sub-processor to data protection obligations that are at least as strict as those in this agreement, and we remain responsible to you for them. We announce a new or replaced sub-processor by e-mail at least 30 days before it starts. If you object on reasonable data protection grounds and we cannot meet the objection, you can end your paid plan before the change; we then refund the time you paid for after that date, as in the Terms.

We do not transfer the data we process for you outside the EU/EEA, other than the remote access by OVHcloud described above.

Rights of data subjects. You can view, correct, export and delete the data in the app. If you need more, or a data subject contacts us directly, we help you or pass the request on to you without undue delay; we do not answer it ourselves unless you ask us to.

Personal data breaches. If we become aware of a breach affecting your data, we tell you without undue delay and where possible within 48 hours, with what we know about what happened, the data and people affected, the likely consequences and what we are doing about it, and we add what we learn later.

Other obligations. We give you the information we have that you need for your security measures, a data protection impact assessment or prior consultation with a supervisory authority (GDPR Art. 32 to 36).