Data Processing Agreement

Insofar as AIBA processes personal data of the client, its employees or its clients in the context of a programme or service, AIBA acts as processor within the meaning of Article 4(8) GDPR and the client acts as controller within the meaning of Article 4(7) GDPR.

This Data Processing Agreement forms an integral part of the underlying agreement between AIBA and the client and applies for the duration of that agreement. Obligations which by their nature are intended to continue remain in force after termination.

• Nature of the processing: storage, organisation, analysis and presentation of personal data within working sessions, for the purpose of the training programme.
• Purpose: delivery of working sessions, case analysis, preparation of the implementation plan, and review of work results.
• Categories of data subjects: employees and business contacts of the client, and (only insofar as the client enters them) clients of the client.
• Categories of personal data: identification and contact data, functional data within documents, no special categories of data as referred to in Article 9 GDPR unless expressly agreed otherwise.

AIBA processes personal data exclusively on the basis of written instructions from the client, unless a legal obligation requires otherwise. If AIBA is of the opinion that an instruction infringes the GDPR, AIBA informs the client thereof without delay.

AIBA ensures that persons processing the data have committed themselves to confidentiality or are bound by an appropriate statutory obligation of confidentiality.

AIBA takes appropriate technical and organisational measures, including:

• encryption of data at rest (AES-256-GCM) and in transit (TLS 1.3);
• role-based access, where each user only sees the data of their own organisation;
• append-only audit log with cryptographic chain verification;
• logical separation of client environments;
• periodic vulnerability scans and dependency monitoring;
• daily backups, quarterly restore tests;
• zero-retention default for work material within working sessions.

AIBA may only engage sub-processors that meet the requirements of Article 28 GDPR. At present these are the following parties:

• Hetzner Online GmbH

  Established in

  Gunzenhausen, Germany

  Where processed

  Data centre in Helsinki (Finland)

  Purpose

  Hosting of the website, portal, database, log files and local backups.

  Data

  Name and business contact details; Form content and Practice Scan answers; Data in the EU AI Act portal; Email content; Email metadata, such as sender, recipient, time and delivery status; Business Register data, such as Chamber of Commerce number, name, legal form and address; Account data of staff and portal users; IP address, browser data, log files and security events; Database backups

  Transfer outside the EEA

  Not applicable, processing within the EEA

• Hostnet B.V.

  Established in

  Amsterdam, The Netherlands

  Where processed

  The Netherlands and Denmark

  Purpose

  Our business mailboxes, the sending of all our outgoing email, and registration and DNS of our domain name.

  Data

  Name and business contact details; Email content; Email metadata, such as sender, recipient, time and delivery status

  Transfer outside the EEA

  Not applicable, processing within the EEA

• X.AI LLC

  Established in

  Palo Alto, United States

  Where processed

  United States

  Purpose

  Primary AI service: drafting your Practice Scan report from your answers, preparing drafts in our back office, and the AI features of the EU AI Act portal.

  Data

  Text, images and audio submitted to the language model; Form content and Practice Scan answers; Data in the EU AI Act portal; Name and business contact details

  Transfer outside the EEA

  EU-US Data Privacy Framework where the provider is certified, otherwise the European Commission's standard contractual clauses

• Anthropic PBC

  Established in

  San Francisco, United States

  Where processed

  United States

  Purpose

  Fallback AI service and image recognition: drafting your Practice Scan report from your answers, preparing drafts in our back office, and the AI features of the EU AI Act portal, including images you upload to the portal.

  Data

  Text, images and audio submitted to the language model; Form content and Practice Scan answers; Data in the EU AI Act portal; Name and business contact details; Files you upload to the portal

  Transfer outside the EEA

  EU-US Data Privacy Framework where the provider is certified, otherwise the European Commission's standard contractual clauses

• OpenAI OpCo, LLC

  Established in

  San Francisco, United States

  Where processed

  United States

  Purpose

  Fallback AI service, image recognition and speech-to-text: drafting your Practice Scan report from your answers, preparing drafts in our back office, and the AI features of the EU AI Act portal, including images and voice memos you upload to the portal.

  Data

  Text, images and audio submitted to the language model; Form content and Practice Scan answers; Data in the EU AI Act portal; Name and business contact details; Files you upload to the portal

  Transfer outside the EEA

  EU-US Data Privacy Framework where the provider is certified, otherwise the European Commission's standard contractual clauses

• Cloudflare, Inc.

  Established in

  San Francisco, United States

  Where processed

  Global network; United States

  Purpose

  Checking forms for automated abuse (Turnstile) and, where enabled, storage of portal uploads and encrypted backups (R2).

  Data

  IP address, browser data, log files and security events; Files you upload to the portal; Database backups

  Transfer outside the EEA

  EU-US Data Privacy Framework where the provider is certified, otherwise the European Commission's standard contractual clauses

• GitHub, Inc.

  Established in

  San Francisco, United States

  Where processed

  United States

  Purpose

  Storage of our source code and automatic deployment of new versions to our server; the deployment service has technical access to the server while doing so.

  Data

  Account data of staff and portal users; IP address, browser data, log files and security events

  Transfer outside the EEA

  EU-US Data Privacy Framework where the provider is certified, otherwise the European Commission's standard contractual clauses

In the event of an intended change of sub-processors, the client is informed at least thirty days in advance. The client has the right to object in writing, stating reasons, within that period. If the parties fail to reach agreement, the client is entitled to terminate the agreement free of charge with respect to the processing concerned.

AIBA has personal data processed outside the European Economic Area by the sub-processors in section 06 that are established there, on the basis of the EU-US Data Privacy Framework where the sub-processor is certified under it, and otherwise on the basis of the European Commission's standard contractual clauses. The procedure of section 06 applies to any new sub-processor outside the EEA.

AIBA provides the client, insofar as reasonably possible and taking into account the nature of the processing, with the necessary assistance in responding to requests from data subjects exercising their rights under the GDPR.

AIBA notifies the client of a personal data breach without undue delay, and in any event within twenty-four hours of discovery. AIBA provides the information the client needs to comply with its notification obligations towards the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and data subjects.

The client is entitled to carry out an audit, or have one carried out by an independent third party, annually or as much more often as reasonably necessary in response to a concrete cause. Audits are announced at least four weeks in advance and carried out on business days, with due regard for business operations and the confidentiality of AIBA's other clients. AIBA may instead provide a valid SOC 2, ISO 27001 or comparable certification report.

After termination of the agreement, AIBA deletes the personal data or returns it to the client, at the client's choice, within thirty days, subject to statutory retention obligations.

AIBA's liability towards the client under or in connection with this Data Processing Agreement is governed by the liability provisions in the underlying agreement and the general terms and conditions, without prejudice to mandatory liability towards data subjects under Article 82 GDPR.