Draft — pending legal review

Data Processing Agreement

Last updated: [ date — TBC ] · Signed DPA available to customers on request

How we process personal data for customers, per GDPR Art. 28. A full signed DPA (with SCCs where needed) is part of onboarding.

Roles

The customer is the controller of the data it uploads; Evda is the processor, acting only on the customer’s instructions.

Our commitments

• Process only for the agreed purpose; keep it confidential.
• Apply appropriate security measures.
• Never train models on customer data.
• Assist with data-subject requests, breaches and impact assessments.

Sub-processors & transfers

Only the providers on our Sub-processors page, with notice of changes. Any transfer outside the EEA uses appropriate safeguards. Target region: [ EU/EEA — TBC ].

Breaches, audit, deletion

We notify you without undue delay of any breach affecting your data, make compliance information available for audit, and return or delete your data at the end of the service.

Contact

Request the signed DPA: nik@evda.ai.