Data processing agreement (DPA)

Version 2, draft, not reviewed by counsel, based on legal-tpl-dpa v1

Last updated: 29 October 2026 · Version: 2 · Effective: 29 October 2026

Permanent link to version 2

This DPA forms part of the agreement between the business customer ("Controller") and Human Synthesis SRL, Sat Buciumeni, Comuna Buciumeni, nr. 279, Dâmbovița County, 137065, Romania, trade register J15/860/12.06.2024, VAT RO50224420 ("Processor") for aiactaudit.ai (the "Service"). The customer accepts it with the terms of service when signing up, and we record the version accepted.

If the customer is itself a processor. Experts such as external data protection officers and consultants often process their clients' data on their clients' behalf. In that case the customer acts as processor for its client, and this DPA is a sub-processing agreement between the customer and us on the same terms; "Controller" then means the customer, and the customer passes on its client's instructions.

1. Subject, duration, nature and purpose: the Processor processes personal data only to provide the Service as described in the agreement (client workspaces, AI inventory, classification, obligations register, timeline, reminders, change log, export and law-watch alerts), for its duration and until deletion under clause 10.
2. Types of data and data subjects: the contact people (referents) of the Controller's clients, invited as guests: names, email addresses, roles; staff of the Controller's clients whose personal data the Controller enters in AI inventory rows, evidence notes or classification answers: names, roles, work contact data and the information entered. No special category data: the Service is not designed for it, and the Controller should not enter it. No such data is ever sent to any AI provider.
3. Instructions: the Processor processes the data only on the Controller's documented instructions (the agreement, this DPA and the Controller's use of the Service settings), including for transfers, unless EU or member state law requires otherwise, in which case it informs the Controller first unless the law forbids it. It tells the Controller if an instruction seems to break data protection law.
4. Confidentiality: people authorised to process the data are bound by confidentiality.
5. Security (Art. 32): the Processor applies the measures in Annex 1.
6. Sub-processors: the Controller gives general authorisation to the sub-processors listed at https://aiactaudit.ai/subprocessors. The Processor gives at least 30 days' notice of new sub-processors (by email or on that page, with a subscription option); the Controller may object on reasonable data protection grounds, and if no solution is found may terminate the affected Service. The Processor imposes the same obligations on sub-processors and remains liable for them.
7. Assistance: the Processor helps the Controller, taking into account the nature of the processing, to answer data subject requests, and with security, breach notification, impact assessments and prior consultation.
8. Personal data breaches: the Processor notifies the Controller without undue delay, and within 48 hours of becoming aware, with the information available.
9. Transfers: data is stored by Cloudflare (Cloudflare D1 and R2); the Processor's configuration does not fix a storage region, so Cloudflare chooses the location, which may be outside the EEA. Transfers outside the EEA happen only under Art. 44 to 49 GDPR (adequacy, including the EU-US Data Privacy Framework, or the Standard Contractual Clauses, module 3 for sub-processors).
10. Deletion or return: at the end of the Service the Controller can export its data for 30 days; the Processor then deletes it, including copies, within 90 days (backups by rotation), unless law requires storage.
11. Audits: the Processor makes available the information needed to demonstrate compliance (this DPA, security documentation, certifications of its hosting providers) and allows audits by the Controller or its auditor, at most once a year, with 30 days' notice, at the Controller's cost, without access to other customers' data.
12. Liability and order of precedence: the liability limits of the agreement apply. If this DPA conflicts with the agreement, this DPA prevails on data protection.
13. Governing law and courts: this DPA is governed by Romanian law. The courts at the registered office of the Processor have jurisdiction.

Annex 1: security measures Encryption in transit (TLS) and at rest by the hosting provider; access limited by role with two-factor authentication for staff; logging of administrative access; daily backups with restore tests; separation of customers' data (a customer key on every record, cross-customer access refused and logged); secure development with code review, automated tests and security audits of every endpoint; dependency updates; incident response with a breach log; staff confidentiality.