Legal
Data Processing Addendum (DPA)
Purpose
Supplements the Terms of Service; governs processing of personal data on behalf of enterprise Controllers.
Scope
Enterprise and API customers where WEBSPACEAI acts as Processor or Sub-processor.
Definitions
Controller; Processor; Sub-processor (GDPR Article 4).
Policy Statements
Processing occurs only per documented instructions; technical/organizational measures include encryption, access controls, and logging. Sub-processors are engaged under equivalent-protection agreements. Breach notification to customers occurs within 72 hours of discovery. Data is deleted or returned upon termination unless legally required to retain.
Training Data Exclusion Guarantee Enterprise and API customer data is contractually guaranteed excluded from model training and fine-tuning datasets by default, consistent with the Privacy Policy's default no-training posture, unless a separate written training-data license is executed.
Responsibilities
Legal and Privacy jointly own DPA terms; Security maintains safeguards; Enterprise team manages customer-specific addenda.
Compliance Requirements
Aligns with GDPR Article 28, UK GDPR; current sub-processor list published at the Trust Center, updated within 5 business days of any change with 30-day customer objection window for material additions.
Enforcement
Breach of DPA terms triggers incident response per the Incident Disclosure Policy.
Reporting Process
Exceptions Process
Customer-specific amendments require Legal approval.
Review Process
Annual or upon regulatory change.
Contact Information
Related Policies
This policy references
None