euRedact Cloud: Data Processing Agreement /

Clause 1 – Parties

This Data Processing Agreement ("DPA") is concluded between:

• euRedact BV, a company under Belgian law with registered office at Hoge-Aardstraat 9, 2610 Antwerpen, Belgium, registered under number 1044.659.910, RPR Antwerp (Antwerp division), VAT BE 1044.659.910 ("euRedact" or the "Processor"); and
• the Customer that has accepted the General Terms by creating a Workspace in the Console (the "Customer" or the "Controller").

The Customer accepts this DPA at registration, together with the General Terms. Where the Customer itself acts as processor for a third-party controller, the Customer warrants that it is authorised to engage euRedact as sub-processor on these terms, and references to the Controller's instructions include the instructions of that third-party controller as passed on by the Customer.

Clause 2 – Definitions

2.1 "Customer Personal Data" means Personal Data contained in the text the Customer submits to the Cloud Service, and in the Output, which euRedact processes on behalf of the Customer under this DPA.

2.2 "Personal Data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in Article 4 GDPR.

2.3 "Sub-processor" means a third party engaged by euRedact to process Customer Personal Data.

2.4 "Applicable Data Protection Law" has the meaning given in the General Terms.

Clause 3 – Scope and roles

3.1 This DPA applies to all processing of Customer Personal Data by euRedact in performing the Agreement. It does not apply to Personal Data euRedact processes as controller, such as the account data of Users and billing data, which are covered by euRedact's privacy policy at euredact.dev/legal/privacy.

3.2 The Customer is the controller (or acts on behalf of a controller) and euRedact is the processor or, where the Customer itself acts as a processor, the sub-processor of Customer Personal Data.

3.3 The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects are described in Annex 1.

3.4 The Customer acknowledges that, although the SDK masks the structured identifiers it can recognise on the Customer's own systems before text is sent, the text submitted to the Cloud Service may contain Personal Data, including special categories of Personal Data within the meaning of Article 9 GDPR such as health data, and that text submitted through the Console or directly through the API is sent as the Customer submits it. The Customer is responsible for having a lawful basis, and where applicable an Article 9(2) GDPR condition, for the processing it instructs euRedact to perform.

3.5 The respective obligations of the Parties under Regulation (EU) 2024/1689 (the AI Act) are set out in Articles 8.12 and 9.12 of the General Terms.

3.6 Independent controllers. Each Party is an independent controller of the Personal Data of the other Party’s personnel and contacts that it processes to manage the Agreement, including User account data, sign-in records, usage metering, billing and support correspondence. Each Party processes such data in accordance with Applicable Data Protection Law and its own privacy notice. The Parties are not joint controllers.

Clause 4 – Instructions

4.1 euRedact processes Customer Personal Data only on the documented instructions of the Customer, unless required to do otherwise by Union or Member State law to which euRedact is subject; in that case euRedact informs the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

4.2 The Customer's documented instructions are: the General Terms, this DPA, the Plan settings the Customer selects in the Console (including the retention window) and the parameters of each request sent to the API, as described in the Documentation. Further instructions may be given in writing and, where they go beyond the functionality of the Cloud Service, are subject to euRedact's agreement and may be subject to a charge.

4.3 euRedact informs the Customer without delay if, in its opinion, an instruction infringes Applicable Data Protection Law. euRedact may then suspend performance of that instruction until the Customer has clarified its compliance with Applicable Data Protection Law or has amended it.

4.4 euRedact does not use Customer Personal Data for any purpose of its own. In particular, euRedact does not use the content of submitted documents or the Output to train, fine-tune or evaluate its models. The content-free usage statistics described in Article 9.3 of the General Terms contain no Customer Personal Data and fall outside this DPA.

Clause 5 – Confidentiality

5.1 euRedact ensures that every person it authorises to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and processes Customer Personal Data only to the extent needed for his or her task.

5.2 euRedact's operational staff have no function that displays submitted content or Output. Access to the production environment is restricted to named administrators, authenticated with multi-factor authentication, and logged.

Clause 6 – Security

6.1 euRedact implements and maintains the technical and organisational measures described in Annex 2, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks for data subjects, so as to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR.

6.2 euRedact may update Annex 2 from time to time, provided the updated measures do not reduce the overall level of security. Material changes are published in the security documentation at euredact.dev/trust.

6.3 The Customer is responsible for the security of its own systems, for the confidentiality of its API Keys, for the masking performed locally by the SDK, and for deciding whether the Cloud Service and the retention window it selects are appropriate for the Personal Data it submits.

Clause 7 – Sub-processors

7.1 The Customer gives euRedact general authorisation to engage the Sub-processors listed in Annex 3.

7.2 euRedact informs the Customer of any intended addition or replacement of a Sub-processor at least thirty (30) days before the change takes effect, by e-mail to the Workspace owner and by updating Annex 3 at euredact.dev/legal/subprocessors, thereby giving the Customer the opportunity to object as required by Article 28(2) GDPR. The Customer may object within that period on reasonable, documented grounds relating to data protection. If the Parties cannot resolve the objection in good faith before the change takes effect, the Customer may terminate the Agreement with effect from that date, without compensation and with a pro-rata refund of fees paid for the period after it. Where a change is required urgently to maintain the security or continuity of the Cloud Service, euRedact may implement it on shorter notice and the Customer’s right to object and to terminate applies from the date of the notice.

7.3 euRedact imposes on each Sub-processor, by written contract, data protection obligations that are substantially the same as those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. euRedact remains fully liable to the Customer for the performance of the Sub-processor's obligations.

7.4 On request, euRedact provides the Customer with a summary of the data protection terms agreed with a Sub-processor, redacted for commercial confidentiality.

Clause 8 – Location and transfers

8.1 Customer Personal Data is processed and stored only in the European Union, on infrastructure listed in Annex 3.

8.2 euRedact does not transfer Customer Personal Data to a third country or international organisation, and does not engage a Sub-processor that would do so, without the Customer's prior documented instruction. Any such transfer complies with Chapter V GDPR, including by means of standard contractual clauses or an adequacy decision, and is reflected in Annex 3.

8.3 If a public authority in a third country requests access to Customer Personal Data, euRedact will, to the extent legally permitted, notify the Customer, challenge the request where there are reasonable grounds to do so, and disclose only the minimum required.

Clause 9 – Assistance to the Customer

9.1 Data subject requests. Taking into account the nature of the processing, euRedact assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR. Because the Cloud Service deletes submitted content and Output on delivery or at the end of the retention window selected by the Customer (Clause 12), euRedact ordinarily holds no Customer Personal Data to which such a request could relate. If euRedact receives a request from a data subject directly, it forwards it to the Customer without undue delay and does not respond to the data subject other than to refer to the Customer.

9.2 Impact assessments and prior consultation. euRedact assists the Customer, taking into account the information available to it, with data protection impact assessments under Article 35 GDPR and prior consultation of a supervisory authority under Article 36 GDPR, by providing the information in this DPA, Annex 2 and the security documentation, and by answering reasonable written questions.

9.3 Costs. Assistance under this Clause 9 that consists of providing existing documentation, including this DPA, Annex 2 and the security documentation, or of forwarding a request, is included in the fees. Assistance that requires work specific to the Customer is charged at euRedact’s then-current rates, which are communicated on request, after the Customer has agreed to an estimate of the time involved.

Clause 10 – Personal data breaches

10.1 euRedact notifies the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Customer Personal Data.

10.2 The notification contains, as far as known at that time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact. Information that is not yet available is provided in phases without undue delay.

10.3 euRedact assists the Customer with its obligations under Articles 33 and 34 GDPR, including the investigation and documentation of the breach. This assistance is not charged where the breach originates in the Cloud Service or with a Sub-processor. Where the breach originates with the Customer or its Users, Clause 9.3 applies.

10.4 euRedact does not notify supervisory authorities or data subjects on the Customer's behalf unless instructed to do so.

Clause 11 – Audits

11.1 euRedact makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, in the first place through this DPA, Annex 2, the security documentation at euredact.dev/trust, and the certifications and audit reports of its hosting provider.

11.2 Where that documentation is insufficient to demonstrate compliance, or a supervisory authority so requires, the Customer or an independent auditor mandated by it and bound by confidentiality may audit euRedact's processing of Customer Personal Data. Such an audit takes place at most once per calendar year, on at least thirty (30) days' written notice, during business hours, without disrupting the Cloud Service or the processing of other customers' data, and at the Customer's cost. The scope and timing are agreed in advance; an audit does not give access to other customers' data or to euRedact's model weights or source code.

11.3 The Customer provides euRedact with a copy of the audit findings. euRedact remedies any non-conformity found within a reasonable period.

Clause 12 – Deletion and return

12.1 During the Agreement. Submitted content and Output are deleted as soon as the Output has been delivered to the Customer, unless the Customer has selected a retention window within the retention cap of its Plan, in which case the Output is deleted at the end of that window. Document content is not written to logs, backups or any other persistent storage. The deletion is performed by overwriting or expiry of the in-memory or short-term storage record and is irreversible.

12.2 At the end of the Agreement. On termination of the Agreement, euRedact deletes any Customer Personal Data still retained under Clause 12.1 and revokes the Customer's API Keys. As euRedact holds no other copy of Customer Personal Data, there is nothing further to return. euRedact confirms deletion in writing on request.

12.3 euRedact may retain Customer Personal Data to the extent Union or Member State law requires it to, in which case it continues to protect the data under this DPA and processes it for no other purpose. Metering records, invoices and account data are retained under euRedact's privacy policy and are not Customer Personal Data.

Clause 13 – Liability

13.1 Each Party is liable for damage caused by its processing in accordance with Article 82 GDPR.

13.2 Nothing in this DPA limits the liability of either Party towards data subjects under Article 82 GDPR. As between the Parties, the limitations and exclusions of liability in Article 13 of the General Terms apply to any claim under this DPA, including a claim for recourse under Article 82(5) GDPR for compensation paid to data subjects and, to the extent permitted by law, administrative fines.

13.3 The Customer indemnifies euRedact against claims and fines arising from the Customer's failure to have a lawful basis for the processing it instructs, or from instructions that infringe Applicable Data Protection Law, except to the extent caused by euRedact's own breach of this DPA.

Clause 14 – Term

14.1 This DPA takes effect when the Customer accepts the General Terms and remains in force for as long as euRedact processes Customer Personal Data under the Agreement. Clauses 5, 12 and 13 survive its termination.

14.2 euRedact may amend this DPA in the manner provided for the General Terms in Article 3.5 of those terms, provided the amendment does not reduce the protection of Customer Personal Data below what Applicable Data Protection Law requires. Changes to Annex 3 follow Clause 7.

Clause 15 – Precedence

15.1 In case of conflict between this DPA and the General Terms on a matter concerning the processing of Personal Data, this DPA prevails. In case of conflict between this DPA and Applicable Data Protection Law, the law prevails.

15.2 Where the Customer is required by a third-party controller or by a supervisory authority to conclude a DPA on different terms, euRedact will consider that request in good faith; any such terms apply only if agreed in writing.

Clause 16 – Governing law and jurisdiction

Article 18 of the General Terms applies to this DPA. This DPA is concluded in English; a translation is for convenience only.

Annex 1 – Description of the processing

Annex 2 – Technical and organisational measures

Data minimisation

• The SDK masks structured identifiers (identification numbers, account numbers, contact details and similar) on the Customer's own systems before text is sent to the Cloud Service. Planned: shipped in the SDK release that makes local-first the default for cloud mode.
• The Cloud Service runs a second rules pass on received text before the model.

Retention and deletion

• Submitted content and Output are held only for the time needed to process the request and deliver the Output, then deleted (erase on delivery).
• Optional retention of Output at the Customer's instruction, capped per Plan at 0, 24, 48 or 72 hours; an Output requested after its window returns an error and no content.
• No document content in application logs, error reports or metrics. Document content is never written to backups. Operational alerts and log records sent to an external triage service pass through an allow-list of permitted fields; free-text messages returned by libraries are disabled by default, so no submitted content can be included.
• Metering records contain token counts and request metadata only.

Infrastructure and location

• Hosting at Scaleway, Paris region (France). Gateway, managed database, object storage and GPU inference nodes.
• GPU nodes on a private network with no public IP address; reachable only from systems behind strictly controlled multi-factor authentication.
• No service operated from outside the European Union in the processing path of document content.

Access control

• Customer access through API Keys (up to five per Workspace), revocable in the Console; Console sign-in by one-time e-mail code; Workspace owner and member roles.
• No operator function displays submitted content or Output.
• Administrative access to production restricted to named individuals, multi-factor authenticated and logged.

Transmission and storage security

• All connections encrypted in transit (TLS). Data encrypted at rest on the hosting provider's managed database instances.

Isolation

• Each request is processed in the context of the Workspace that submitted it; concurrency and rate limits per Plan and per API Key prevent one Customer's load from affecting others.

Availability and resilience

• Availability target of 99 % per calendar year; nightly maintenance window at 03:00 UTC of at most one hour with a stand-in node. Planned: uptime measurement and a status page.

Development and supply chain

• Signed release provenance for published packages; dependency and vulnerability scanning on the SDK; separation of development, evaluation and production environments.
• Model evaluation uses synthetic and licensed benchmark data, never Customer content.

Organisation

• Single-founder company; confidentiality undertaking by every person with production access; security documentation maintained at euredact.dev/trust and reviewed at least annually.
• Incident process: detection through alerting on operational logs that contain no document content; notification to affected Customers under Clause 10.

Annex 3 – Sub-processors

Current list as at the effective date of this DPA; the live list is published at euredact.dev/legal/subprocessors.