Data Processing Agreement
1. Scope
This Data Processing Agreements is entered into by and between the following parties: - Umbrella4AI Limited , located at Kypranoros 13, EVI BUILDING, 2nd floor, Office 201, Nicosia 1061, Cyprus (hereinafter referred to as the "U4AI Processor", "U4AI", "Company", Provider"), - and the customer (references also as "Controller", "Client", "Subscriber") a business entity or organization as identified in the applicable order form or the entity associated with the platform account created during the registration process.
Umbrella4AI Limited, acts as a data processor for Controller's content (text inputs, business data, generated outputs) , processed through the U4AI platform. The DPA is an integral part of the Terms of Service.
1.1 Definitions and Interpretation
Agreement: This Data Processing Agreement, including its Annexes, which forms part of and supplements the Terms and Conditions (or other master services agreement) between the parties (the "Principal Agreement").
Applicable Data Protection Law: The EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), together with any implementing or successor legislation, and any other data protection law applicable to the Processing of Personal Data under this Agreement.
Agreement Effective Date: The effective date of the agreement is the date when the Controller has accepted the DPA on the U4AI platform; Acceptance is required prior to use of U4AI services. The logs of agreement acceptance are maintained in the U4AI database.
Controller, Processor, Data Subject, Personal Data, Processing, Personal Data Breach, Supervisory Authority: Have the meanings given in Article 4 GDPR. In this agreement Controller is also used to reference the "Customer". U4AI as a processor is referenced as "U4AI Processor".
Customer: the business entity, organization, or individual entering into the Terms of Service with the Provider. Where an individual registers for the Services on behalf of a company or other legal entity, "Customer" refers to that entity, and the individual warranting that they have the legal authority to bind that entity to this Agreement. In the absence of a formal corporate name at the time of electronic registration, the Customer is legally defined by the account credentials, billing profile, and administrative email address established during the signup process.
Principal Agreement: main agreement between U4AI and Customer, also referenced as "Terms of Service".
Sub-processor: Any third party engaged by the Processor (or by another Sub-processor) to Process Personal Data on behalf of the Controller in connection with the provision of the Services.
Standard Contractual Clauses (SCCs): The standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), as may be updated or replaced from time to time.
Services: The U4AI software-as-a-service platform and related services provided by the Processor to the Controller under the Principal Agreement.
U4AI: Umbrella4AI Limited.
In the event of any conflict between the terms of this Agreement and the Principal Agreement regarding the Processing of Personal Data, this Agreement shall prevail.
2. Roles of the Parties
The Parties acknowledge that the Services are designed and configured to process AI system's and business-related data, roles, and departmental identifiers, and that the U4AI Processor explicitly instructs users not to submit Personal Data into unstructured free-text fields via its Terms of Service and platform documentation.
Notwithstanding the foregoing, the Controller acknowledges that users may inadvertently or contrary to instructions input Personal Data into free-text fields. While the U4AI Processor employs technical safeguards (such as automated sanitization and regex filters) to mitigate the transfer of such data, the Parties agree that any accidental or unauthorized transmission of Personal Data via free-text inputs shall be governed by the terms of this DPA. The presence of such incidental Personal Data shall not constitute a breach of this Agreement by the U4AI Processor, provided the U4AI Processor handles such data in accordance with its security commitments and promptly assists the Controller in fulfilling any ensuing data subject or regulatory requests.
The parties acknowledge that, in relation to the Processing of Personal Data under the Principal Agreement, the Controller is the data controller and the U4AI Processor is the data processor, as further described in Annex 1 (Details of Processing).
Each party shall comply with the obligations applicable to it under Applicable Data Protection Law in respect of the Processing carried out under this Agreement.
Independent controller processing: Notwithstanding the foregoing, U4AI acts as an independent controller, and not as a processor, solely in respect of (a) account, billing and contact data of the Controller’s representatives processed for contract administration, and (b) engagement records and work papers retained by U4AI to comply with its own tax, regulatory, insurance, audit and legal obligations. U4AI shall process such data in accordance with Applicable Data Protection Law and its privacy notice, shall retain it only for as long as required for those purposes, and shall not use Personal Data obtained in the provision of the Services for any other purpose. Any re-use by U4AI of knowledge, methodologies or insights shall be limited to anonymized or non-personal information.
Independent controller processing for expert services: Notwithstanding the foregoing, this DPA does not apply to expert services provided under a separate agreement, and the parties act as independent controllers (controller to controller), and not as controller and processor, solely in respect of Personal Data processed in connection with those expert services. Each party shall process such data in accordance with Applicable Data Protection Law and its own privacy notice, shall retain it only for as long as required for those purposes, and shall not use Personal Data obtained in the provision of those expert services for any other purpose. Any re-use by U4AI of knowledge, methodologies or insights shall be limited to anonymized or non-personal information.
3. U4AI Processor Obligations
The U4AI Processor shall:
Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organization, unless required to do so by EU or Member State law to which the Processor is subject — in which case the Processor shall inform the Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest;
Ensure that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as set out in Annex 2 (Technical and Organizational Measures);
Respect the conditions for engaging Sub-processors set out in Section 5 of this Agreement;
Assist the Controller, taking into account the nature of the Processing, by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising Data Subject rights under Chapter III GDPR;
Assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of Processing and the information available to the Processor;
At the Controller's election, delete or return all Personal Data to the Controller after the end of the provision of Services, and delete existing copies unless EU or Member State law requires storage of the Personal Data, as further described in Section 9;
Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, as further described in Section 10.
4. Controller Obligations
The Controller shall: (a) ensure it has a valid legal basis for the Processing of Personal Data and for any instructions it issues to the U4AI Processor; (b) ensure the accuracy and quality of Personal Data provided to the U4AI Processor; (c) comply with its own obligations under Applicable Data Protection Law, including any applicable transparency obligations to Data Subjects; (d) not instruct the U4AI Processor to Process Personal Data in a manner that would infringe Applicable Data Protection Law; and (e) comply with Terms of Service and DPA.
4.1 Nature of Data and Customer Instructions
Instruction Limitations: The U4AI Processor provides the Services with explicit instruction that the Customer shall not submit Personal Data into unstructured free-text fields. The scope of processing agreed upon in this DPA does not contemplate or require the processing of PII within these specific fields.
Controller Compliance & Indemnification: The Controller warrants that it has implemented appropriate internal policies and technical controls to prevent its users from uploading PII contrary to the U4AI Processor's documentation and Terms of Service.
Accidental Uploads: If PII is inadvertently transmitted to the U4AI Processor via free-text inputs, the Controller shall decide on whether to promptly notify the U4AI Processor and submit a deletion request. The U4AI Processor will use commercially reasonable efforts to assist the Controller in removing or redacting such data, subject to technical feasibility, but the presence of such data shall not automatically place the U4AI Processor in material breach of its data protection obligations, provided the U4AI Processor handles the data in accordance with its security standards.
5. Sub-processors
The Controller provides a general authorization for the U4AI Processor to engage Sub-processors to Process Personal Data in connection with the Services, subject to the conditions in this Section 5. A current list of Sub-processors is set out in Annex 3 (List of Sub-processors).
The U4AI Processor shall: (a) impose data protection obligations on each Sub-processor that are no less protective than those set out in this Agreement; (b) remain fully liable to the Controller for the performance of each Sub-processor's obligations; and (c) give the Controller prior written notice of any intended addition or replacement of a Sub-processor, providing the Controller a reasonable opportunity (of not less than 30 days) to object on reasonable data-protection grounds before the new Sub-processor begins Processing Personal Data. If the Controller objects and the parties cannot resolve the objection, either party may terminate the affected Services in accordance with the Principal Agreement.
6. International Data Transfers
U4AI as the Processor confirms that its use of the Anthropic Claude API involves a client's Data input to the U4AI platform outside the European Economic Area. Specifically: (a) data submitted to the Claude API is stored at rest in the United States (workspace-level data storage location is fixed at workspace creation and, as of the Effective Date, "US" is the only available workspace storage location offered by Anthropic); and (b) model inference is processed either exclusively within the United States or via global routing across Anthropic's infrastructure, depending on the Processor's workspace configuration — no EU-only inference option is currently offered by Anthropic on this API. Accordingly, this transfer is subject to the Standard Contractual Clauses incorporated into the Anthropic Terms of Service.
U4AI as the Processor also uses the OpenAI API (OpenAI Ireland Limited; affiliate OpenAI OpCo, LLC, USA) for one function only: converting the text of the questionnaire answers a client submits, after the redaction measures described in Annex 2, into numerical vectors (embeddings) used to retrieve relevant regulatory passages from U4AI's knowledge base. OpenAI does not generate report content for U4AI. Text sent to OpenAI may be processed and stored in the United States. Under OpenAI's API data controls, data sent to the API is not used to train OpenAI's models, and API data is retained in abuse-monitoring logs for up to 30 days unless longer retention is required by law. This transfer is subject to the Standard Contractual Clauses. The data minimization measures described in Annex 2 apply to this transfer in the same way as described above for the Anthropic Claude API, and are not represented as guaranteed or complete removal of Personal Data.
The U4AI Processor applies data minimization measures, described in full in Annex 2, to reduce the likelihood of Personal Data reaching its AI model sub-processors before any such transfer occurs. These measures support the appropriateness of the Standard Contractual Clauses as the transfer safeguard by reducing transfer risk, consistent with the category of supplementary measures described in EDPB Recommendations 01/2020. They do not eliminate the transfer, do not remove Client Data from the scope of this Section, and are not represented as guaranteed or complete removal of Personal Data.
U4AI as Independent controller uses Resend for sending transactional and service-related emails to users (e.g. account verification, notifications). Data processed: Recipient email address, name, email content, delivery and engagement metadata.
7. Security
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the U4AI Processor shall implement appropriate technical and organizational measures as set out in Annex 2 (Technical and Organizational Measures), including, as appropriate: (a) sanitization and substitution of Personal Data before transit to an AI model sub-processor; (b) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of Processing systems and services; (c) the ability to restore availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and (d) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures; (e) AES-256 encryption of controller data for storage and retrieve, while in transit and at rest. Additionally U4AI relies on sub-processors transfer safeguards as available in Annex 3.
8. Personal Data Breach Notification
Notification of Incident: In the event of a confirmed security incident impacting on the U4AI Processor's systems that affect data stored on behalf of the Controller, the U4AI Processor shall notify the Controller without undue delay, within seventy-two (72) hours of becoming aware of the security incident. U4AI Processor shall provide information reasonably available to it at the time, including (to the extent known) the nature of the breach, the categories and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.
Unstructured Free-Text Limitation: The Parties acknowledge that the Services are designed to process business roles and AI system/operational data, and that free-text input fields are not actively monitored or indexed by the U4AI Processor for the presence of Personal Data. Consequently, the U4AI Processor may not be technically able to determine whether Personal Data was contained within such unstructured free-text fields at the time of an incident.
Cooperation and Assessment: In the event of an incident, the U4AI Processor will supply the Controller with all available system-level details and logs reasonably necessary to assist the Controller in assessing the impact of the breach. If the U4AI Processor cannot definitively ascertain whether Personal Data was present in the affected free-text fields, the U4AI Processor's notification shall state this limitation, and the Controller shall be solely responsible for evaluating the potential risk to data subjects and determining whether notification to supervisory authorities or affected individuals is required under Applicable Data Protection Law.
9. Deletion or Return of Data
End of Services: Upon termination or expiry of the Services, and at the Controller's written election, the U4AI processor will delete controller's stored data following 12 months from written notice by the Controller. Controller's data is maintained for a period of 12 months for auditability by relevant certification bodies and authorities.
Unindexed Free-Text Limitation: The Parties acknowledge and agree that unstructured free-text input fields are stored by the Provider as generic operational data and are not indexed, categorized, or tagged as Personal Data within the Provider's database. Consequently, the U4AI processor's obligation to delete personal data from free-text fields upon request or contract termination shall be fulfilled via the permanent deletion, purging, or overwriting of the underlying database tables, logs, and temporary caches in accordance with the U4AI processor's routine data retention and backup lifecycle policies.
Individual Deletion Requests (Right to Erasure): If the Controller receives a data subject erasure request (Article 17 GDPR) concerning personal data mistakenly entered into a free-text field, the Controller shall specify the relevant report, timeframe, or record identifier. Upon receiving such specific instruction, the U4AI processor will use commercially reasonable efforts to assist the Controller in locating and purging the specific text data from its active database, subject to technical feasibility.
10. Audit Rights
The U4AI Processor shall in his best efforts, make available to the Controller, on reasonable written request no more than once per twelve (12) month period, such information as is reasonably necessary to demonstrate compliance with this Agreement. Where such documentation is insufficient, the U4AI Processor shall facilitate an audit conducted by the Controller or an independent third-party auditor, subject to reasonable confidentiality protections and at the Controller's cost. It is the responsibility of the Controller to address potential non-compliances arising from the audit.
11. Liability
The liability of each party arising out of or in connection with this Agreement, whether in contract, tort (including negligence), or otherwise, shall be subject to the limitations and exclusions of liability set out in the Principal Agreement. Nothing in this Agreement limits either party's liability for infringements of Applicable Data Protection Law to the extent such liability cannot be limited or excluded under applicable law.
12. Term and Termination
This Agreement takes effect on the Effective Date and remains in force for as long as the U4AI Processor Processes Personal Data on behalf of the Controller under the Principal Agreement. Termination of the Principal Agreement automatically terminates this Agreement. Such termination shall be without prejudice to any rights or obligations accrued prior to termination, nor shall it affect provisions intended to survive termination, including without limitation the U4AI Processor's obligations regarding data deletion, retention limitations for unindexed free-text inputs, and the handling of incidental Personal Data as set forth herein.
13. General Provisions
This Agreement is governed by the same governing law and jurisdiction provisions set out in the Principal Agreement. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.
Annex 1 — Details of Processing
Subject matter: Provision of the U4AI SaaS platform for AI governance & compliance support, including AI system inventory management, risk classification, risk analysis, impact assessment, and related governance & compliance Services.
Duration of Processing: For the duration of the Principal Agreement, plus any post-termination retention period set out in Section 9.
Nature and purpose of Processing: Collection, storage, organization, structuring, retrieval, use, and AI-assisted analysis/generation of Controllers Data submitted by the Controller for the purpose of providing the Services.
Categories of Data Subjects: The Controller’s employees, contractors and representatives (including named AI system owners, users and other personnel referenced in AI system information or documentation submitted by the Controller).
Categories of Personal Data: The Services are designed and configured to process AI system details, business-related metadata, operational roles, and departmental identifiers. The Provider expressly instructs the Customer and its users not to submit Personal Data into unstructured free-text fields. However, to the extent that users inadvertently or erroneously insert Personal Data into such free-text fields contrary to instructions, the categories of data processed may include any incidental Personal Data typed by users (such as names, contact details, or identifying information). To mitigate risks associated with such unauthorized inputs, the Provider implements automated data sanitization and regex filtering processes prior to transferring data to Large Language Models (LLMs); nonetheless, the Parties acknowledge that incidental Personal Data may occasionally persist or pass through to storage or sub-processors, and such processing shall remain fully governed by the terms of this DPA.
Special categories of data: None anticipated in the ordinary operation of the Service. The Controller should not submit special category Personal Data (Article 9 GDPR) through the Platform unless expressly agreed with the U4AI in writing.
Annex 2 — Technical and Organizational Measures
The U4AI Processor implements, at minimum, the following technical and organizational measures. This list reflects safeguards provided by the U4AI Processor's infrastructure sub-processor (Annex 3) plus measures implemented at the application layer by the U4AI Processor.
Encryption at rest: all stored data (database and file storage) is encrypted using AES-256, provided by the underlying cloud infrastructure and always enabled.
Encryption in transit: all network communication, including API calls and direct database connections, is encrypted using TLS; HTTPS is enforced on all API endpoints.
Data residency: primary database, authentication, and storage data are hosted within the European Union (Frankfurt, Germany region), with backups remaining in the same region.
Access control: role-based access control and Row Level Security (RLS) policies restrict data access so that a given user or company can access only the data they are authorized to see, enforced at both the database and application layer.
Application-level encryption of sensitive credentials: access tokens and API keys are encrypted at the application level in addition to disk-level encryption.
Sub-processor policies: Anthropic API policies allow exemption of re-training of their models from user data. U4AI has opted out from using API data for retraining purposes.
Confidentiality commitments: personnel with access to Personal Data are subject to confidentiality obligations.
Vendor security posture: the U4AI Processor's primary infrastructure sub-processors (Annex 3) maintain ISO 27001 certification and/or SOC 2 Type 2 compliance.
Data minimization prior to third-party AI model calls: in addition to the general measures above, the U4AI Processor applies the following technical measures to reduce the personal data transmitted to third-party AI model sub-processors (Anthropic per Annex 3), applied consistently across every Service that submits user-supplied content to an LLM (AI Act Classification, AI Risk Analysis, Impact Assessment, Model Cards, Datasheets, Predetermined Change Control Plan, AI Readiness, Standards Applicability, AI Literacy relevance scoring, and Incident Management's risk-report flagging):
Pattern-based redaction¹: the submitting user's own name and organization name (drawn from their account profile), along with any email address or phone number detected in free-text fields, are replaced with fixed placeholder tokens before submission.
Sanitization¹: Controller's data are sanitized to substitute PII prior to LLMs use.
Prompt-injection redaction: text matching known instruction-override patterns is redacted and logged, as an integrity safeguard against the model being manipulated via user-supplied content.
Audit logging: every redaction is logged by field name and count for audit purposes; the original unredacted value is not retained in that log.
¹ This is deterministic pattern-matching against known values (the submitting account holder's own identity and contact details), plus regular-expression matching for emails, phone numbers, IPv4 addresses and date-of-birth-shaped dates, and best-effort heuristic matching for national ID numbers and postal addresses (which are not validated against any jurisdiction's actual format and may both miss genuine instances and occasionally flag non-personal data). It is not general-purpose named-entity recognition, and it does not detect or redact personal data relating to third parties referenced within free-text fields (for example, a named individual mentioned in a risk description or incident note) where no other identifying pattern is present. Accordingly, the U4AI Processor characterizes this measure to Controllers as reasonable technical measures to minimize personal data transmitted to sub-processors, and does not represent it as guaranteed or complete removal of personal data prior to transfer.
Annex 3 — List of Sub-processors
Supabase (Supabase Pte. Ltd., Singapore; affiliate Supabase, Inc., USA). — Cloud database, authentication, and file storage hosting. Location: European Union (Frankfurt, Germany). Germany (Frankfurt, EU) for database, storage and backups; limited processing in the United States and Singapore (account, billing, support). Transfer safeguard: N/A — in-region EU processing. Standard Contractual Clauses. Data processed: User account data (email, name, hashed passwords, login metadata), application data, uploaded files, IP addresses and logs. Links: - Supabase Docs (https://supabase.com/docs/guides/platform/regions), - Terms of Service (https://supabase.com/terms), - Supabase Security (https://supabase.com/docs/guides/security), - Data Processing Addendum (https://supabase.com/legal/customer-resources/data-processing-addendum).
Anthropic, , (Anthropic Ireland, Limited; affiliate Anthropic, PBC, USA) — AI-assisted generation of service reports and analyses (Claude API). Generating AI outputs (e.g. text analysis, summaries, responses) from content submitted through the application. Location: United States (data storage); United States or global routing (inference) — no EU option currently offered by Anthropic. Transfer safeguard: Standard Contractual Clauses under Anthropic's DPA (embedded into Commercial Terms of Service). Data processed: Prompts and inputs sent to the API (may include user-provided content and personal data), and generated outputs. Links: - Commercial Terms of Service (https://www.anthropic.com/legal/commercial-terms), - Data Processing Addendum (https://www.anthropic.com/legal/data-processing-addendum), - Privacy Policy (https://www.anthropic.com/legal/privacy), - Trust Center — Anthropic (https://trust.anthropic.com/).
Vercel Inc. — website and application hosting and content delivery. Application processing in Frankfurt, Germany (EU). Processes IP addresses, request logs and application data. Any transfers to the US are safeguarded by Standard Contractual. Location: European Union (Frankfurt, Germany). Transfer safeguard: N/A — in-region EU processing. . Standard Contractual Clauses (and UK Addendum) for any data transferred to the US. Links: - Regional Pricing (https://vercel.com/docs/pricing/regional-pricing), - Vercel Trust Center (https://security.vercel.com/), - Security & Compliance Measures (https://vercel.com/docs/security/compliance).
Stripe, (Stripe Payments Europe, Limited, Ireland; affiliate Stripe, LLC, USA). — Third-party payment processor to securely handle financial transactions, collect subscription fees, process credit card details, and manage billing history. Personal data related to payments and transaction history is processed by Stripe globally, primarily in Ireland and other regions where Stripe or its affiliates and sub-processors operate. Location: Stripe Payments Europe, Limited (Ireland) Transfer safeguard: N/A — in-region EU processing; EU-US Data Privacy Framework certification (Stripe, LLC); Standard Contractual Clauses through Stripe’s Data Transfers Addendum Data processed: Customer name, email, billing address, payment card or bank details, transaction data, IP address and device data (for fraud detection), VAT ID where provided. Links: - Data Processing Agreement (https://stripe.com/en-gr/legal/dpa), - Stripe Services Agreement — General Terms (https://stripe.com/en-gr/legal/ssa), - Stripe Data Privacy Framework Policy (https://stripe.com/en-gr/legal/data-privacy-framework), - Security at Stripe (https://docs.stripe.com/security).
Resend (Plus Five Five, Inc.) -- Email delivery provider used to send transactional and service emails. Location: United States Transfer safeguard: EU-US Data Privacy Framework certification; Standard Contractual Clauses Data processed: Recipient email address, name, email content, delivery and engagement metadata. Links: - GDPR (https://www.resend.com/security/gdpr) - DPA (https://resend.com/legal/dpa) - Privacy Policy (https://resend.com/legal/privacy-policy) - Data Privacy Framework Certification (https://www.resend.com/changelog/data-privacy-framework-certification) - SOC2 (https://www.resend.com/security/soc-2)
OpenAI (OpenAI Ireland Limited; affiliate OpenAI OpCo, LLC, USA) — Text embeddings (OpenAI API, embeddings endpoint), used to match the content of submitted questionnaire answers to relevant passages of U4AI's regulatory knowledge base. No report text is generated by OpenAI. Location: United States. Transfer safeguard: Standard Contractual Clauses under OpenAI's Data Processing Addendum. Data processed: Text of questionnaire answers after redaction (which may contain residual personal data), the numerical embeddings returned, and API abuse-monitoring logs retained for up to 30 days. Links: - Business Terms (https://openai.com/policies/business-terms) - Data Processing Addendum (https://openai.com/policies/data-processing-addendum/) - Sub-processor list (https://openai.com/policies/sub-processor-list/) - API data controls (https://developers.openai.com/api/docs/guides/your-data)