DATA PROCESSING AGREEMENT

1. Parties and scope

This Data Processing Agreement (the "DPA") is concluded between the Customer identified in the order form or the cabinet (the "Controller") and Media Holding Development OÜ, registry code [REGISTRY CODE], [LEGAL ADDRESS], Tallinn, Estonia (the "Processor"). It forms part of the Terms of Service and applies whenever the Processor processes personal data on the Controller's behalf in the course of providing Sovereign AI Cloud (the "Services"). It is written to satisfy Article 28(3) of Regulation (EU) 2016/679 (the "GDPR"). In case of conflict between this DPA and the Terms of Service, this DPA prevails for the processing of personal data.

2. Definitions

"Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. "Customer Data" means personal data the Controller or its users submit to the Services, including the content of API requests. "Sub-processor" means a third party engaged by the Processor to process Customer Data.

3. Roles and instructions

3.1 The Controller determines the purposes and means of the processing of Customer Data and warrants that it has a lawful basis for the processing it instructs, that it has provided the information required by Articles 13 and 14 of the GDPR to the data subjects, and that it does not submit special categories of data (Article 9) unless it has a lawful basis and has informed the Processor in writing.

3.2 The Processor processes Customer Data only on the Controller's documented instructions, which are: the Terms of Service, this DPA, the configuration the Controller sets in the cabinet, and the API requests the Controller sends. The Processor informs the Controller if it believes an instruction infringes data protection law.

3.3 The Processor does not process Customer Data for its own purposes, does not sell it, does not use it to train or fine-tune models, and does not retain the content of requests or responses (Annex I).

4. Obligations of the Processor

4.1 Confidentiality. Persons authorised to process Customer Data are bound by confidentiality obligations.

4.2 Security. The Processor implements the technical and organisational measures of Annex II (Article 32 GDPR) and keeps them under review.

4.3 Sub-processors. Section 5.

4.4 Assistance with data-subject rights. The Processor assists the Controller, by appropriate technical and organisational measures and insofar as possible, in responding to requests of data subjects under Chapter III of the GDPR. Because request content is not retained, the Processor can in most cases confirm only that no content exists; it can export, correct or delete account and metadata records that relate to an identified data subject.

4.5 Assistance with Articles 32 to 36. The Processor assists the Controller in ensuring compliance with the obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to it.

4.6 Personal data breach. The Processor notifies the Controller without undue delay and in any case within 48 hours after confirming a personal data breach affecting Customer Data, by email to the Controller's administrators, with the information the Controller needs to meet its own 72-hour notification duty under Article 33 GDPR: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point. The Processor updates the notification as facts become known and assists the Controller with the investigation and any communication to data subjects.

4.7 Deletion and return. At the end of the Services the Processor deletes Customer Data within 30 days, or returns it on request before deletion, unless Union or member-state law requires storage. Backups are rotated within a further 35 days. Request content was never stored and cannot be returned.

4.8 Information and audit. The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by it, under Section 7.

4.9 Records. The Processor keeps the record of processing activities required by Article 30(2) GDPR.

5. Sub-processors

5.1 The Controller gives general written authorisation to the Processor to engage the sub-processors listed in Annex III.

5.2 The Processor informs the Controller of any intended addition or replacement of a sub-processor at least 30 days in advance by email to the Controller's administrators and by updating Annex III. The Controller may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Controller may terminate the affected Services with a pro-rata refund of prepaid fees.

5.3 The Processor imposes on every sub-processor, by written contract, data protection obligations equivalent to those in this DPA, and remains fully liable to the Controller for the sub-processor's performance.

6. International transfers

The Processor operates the control plane, its database and the inference plane in the European Union. Where a sub-processor processes Customer Data outside the European Economic Area, the transfer is based on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (module two or three, as applicable), supplemented by the measures in Annex II and by the EU-U.S. Data Privacy Framework where the sub-processor is certified. The Processor does not transfer the content of API requests outside the EEA.

7. Audit

7.1 The Controller may audit the Processor's compliance with this DPA once per calendar year, and additionally after a personal data breach affecting the Controller's data or on the instruction of a supervisory authority, with at least 30 days' written notice, during business hours, without unreasonable disruption, and at the Controller's own cost.

7.2 The Processor may satisfy an audit request by providing the results of a recent independent audit or certification covering the same scope, where one exists, together with written answers to the Controller's questions.

7.3 Auditors are bound by confidentiality and may not be competitors of the Processor.

8. Liability

The liability of each party under this DPA is subject to the limitations and exclusions in the Terms of Service, except where the GDPR or mandatory law provides otherwise. Each party is liable for the administrative fines imposed on it under Article 83 GDPR.

9. Term

This DPA applies for as long as the Processor processes Customer Data and ends when the deletion under Section 4.7 is complete.

10. Governing law

This DPA is governed by the laws of the Republic of Estonia. Disputes are resolved as set out in the Terms of Service.

Annex I — Description of the processing

• Subject matter: provision of AI inference services (chat completions and text generation on open-weight language models), the customer cabinet, metering and billing.
• Duration: the term of the Services and the deletion period of Section 4.7.
• Nature and purpose: receiving a request from the Controller's systems, generating a model response, returning it, and recording metadata for metering, billing, security and support. The purpose is the one the Controller defines by its use of the API.
• Types of personal data: any personal data the Controller or its users include in requests (names, contact details, free text, documents, identifiers); account data of the Controller's users (name, business email, role, login records); metadata of requests (request identifier, timestamps, model, token counts, status, project and key identifiers, source IP address).
• Categories of data subjects: the Controller's employees and contractors who use the cabinet or the API; the Controller's customers and end users whose data appears in requests; any other person whose data the Controller includes in requests.
• Retention of content: none. The content of requests and responses is processed in memory for the duration of the request and is not stored. A retention option activated by the Controller for debugging, if offered, is documented and limited to the Controller's own configuration.
• Retention of metadata: 13 months (metering ledger and audit), then deletion; see the Privacy Policy, Section 4.
• Frequency: continuous, as requests are sent.

Annex II — Technical and organisational measures (Article 32)

1. Encryption in transit. TLS 1.2 or higher on every public endpoint; internal traffic between the control plane and the inference plane on a private network only, never over the public internet.
2. Encryption at rest. Encrypted volumes for the control-plane database, backups and the inference plane.
3. Zero retention of content. Request and response content is not written to logs, databases or files; audit lines carry metadata only (request id, model, status, token counts, duration, tenant and project identifiers, key prefix).
4. Credential protection. API-key secrets are stored only as a keyed one-way hash (HMAC-SHA-256 with a server-side pepper); passwords as Argon2id hashes; secrets of the platform itself are read from files or masked prompts, never from command lines, source code or logs; error messages never contain tokens, URLs, paths or upstream exception text.
5. Tenant isolation. Every request carries the organisation, project and key-prefix identifiers set by the control plane and never accepted from a public caller; data access is scoped to those identifiers; the administrative surface is separate from the customer surface.
6. Access control. Role-based access in the cabinet; least-privilege administrative access; individual logins; multi-factor authentication for administrators of the Processor.
7. Rate limiting, budgets and abuse controls. Per-project limits and budgets enforced automatically; anomalous usage is detected and may be suspended.
8. Network controls. Protection against server-side request forgery; the inference plane is reachable only from the control plane; no external AI supplier is in the request path.
9. Logging and monitoring. Audit logs of administrative actions and key events; health monitoring of every component; a public status page.
10. Backup and restore. Regular encrypted backups of the control-plane database with restore tests; backups rotated within 35 days.
11. Vulnerability and patch management. Dependencies and runtimes kept current; a responsible-disclosure channel.
12. Incident response. A written procedure with the 48-hour customer notification of Section 4.6.
13. Personnel. Confidentiality obligations; need-to-know access; training.
14. Data minimisation. Only the metadata needed for metering, billing, security and support is recorded.
15. Deletion. Documented deletion of account data, metadata and backups on termination.

The status of each measure (MEASURED, BUILT, PLANNED) is published on the Security and Trust page.

Annex III — Authorised sub-processors

Changes to this Annex are notified under Section 5.2.