Data Processing Agreement – Article 28 GDPR

The Customer is controller and UESE is processor for personal data in Inputs, projects and Outputs processed to provide ISOPILOT. The Customer determines purposes, data subjects and lawfulness; UESE processes data only on documented instructions unless required by law.

In case of conflict between the DPA and Terms on data protection matters, the DPA prevails. UESE’s independent-controller processing is governed by the Privacy Notice.

Subject: application hosting, authentication, storage, extraction, indexing, AI analysis, generation, versioning, export, support and security. Duration: contractual relationship plus return/deletion and backup window. Purpose: provide requested features and maintain integrity, availability and support.

Categories may include employees, contractors, customers, suppliers, directors and other persons appearing in documents; data may include identifiers, contacts, roles, signatures, organisational information and any additional data provided by the Customer.

Instructions arise from the Terms, account settings, user actions and authorised support requests. UESE informs the Customer if it believes an instruction infringes GDPR or other law, unless prohibited, and may suspend execution pending clarification.

The Customer ensures notices, legal bases, minimisation, data quality, rights management and required assessments. It must not use ISOPILOT for processing incompatible with the documentation or high-risk categories without prior assessment.

UESE restricts access to personnel and contractors who need it for their role, support, security or maintenance. Such persons are bound by confidentiality, trained and subject to access control. Administrative and impersonation activities are logged.

• logical tenant segregation and authorisation controls;
• TLS for data in transit and application-secret protection;
• hashed passwords, 2FA, protected sessions and least privilege;
• private storage, file validation, format limits and anti-malware where configured;
• logging, audit trails, error monitoring and incident management;
• backup, restoration, patching and vulnerability management consistent with hosting and Plan;
• deletion, return and continuity procedures.

Measures are periodically reviewed based on risk, state of the art, cost and nature of data.

The Customer gives general authorisation for subprocessors providing hosting, email, backup, security, support, invoicing and AI. UESE maintains a current list available on request and imposes substantially equivalent obligations. For material changes, UESE provides reasonable notice where technically and contractually possible.

The Customer may object on documented data-protection grounds; the parties cooperate on a solution. If no reasonable alternative is available, the Customer may discontinue the affected feature or service under the Terms.

UESE ensures that international transfers use a Chapter V GDPR mechanism and, where required, a transfer impact assessment and supplementary measures. The Customer authorises transfers necessary for service delivery while retaining the right to information on safeguards.

Taking account of the processing nature, UESE assists the Customer with technical measures and information for data-subject rights, impact assessments and prior consultation. Extraordinary work may be separately charged where it requires significant effort not attributable to UESE.

UESE notifies the Customer of a breach affecting data processed on its behalf without undue delay after becoming aware. The notice includes, as available, nature, categories and volume, likely consequences, measures taken, contact and updates. Notification is not an admission of liability.

The Customer is responsible for notifications to authorities and individuals. The parties preserve evidence, cooperate and limit unauthorised communications.

UESE provides reasonable information to demonstrate Article 28 obligations. The Customer may request documentation, questionnaires or, no more than annually absent an incident or authority request, an audit with notice, agreed scope, confidentiality and no compromise of other customers or security.

Audit costs are borne by the Customer unless a material UESE breach is established. UESE may satisfy the request through independent reports or equivalent evidence.

On termination, at the Customer’s choice and subject to technical limits, UESE returns or makes data exportable and then deletes it unless retention is legally required. Backups are deleted through technical cycles and remain isolated. The Customer must export within the stated window and verify completeness.

Liability under the DPA follows the Terms’ limits without prejudice to non-excludable data-subject rights or authority powers. The DPA starts when processing begins and remains effective while UESE retains personal data on behalf of the Customer.