Data Processing Agreement

• You determine the purposes and means of the processing and act as controller within the meaning of the GDPR.
• We process personal data exclusively on your behalf and in accordance with your documented instructions, including the settings you choose in the platform.
• This DPA applies for the duration of the main agreement and for as long as we process personal data for you.

The processing consists of storing, structuring, analysing and preparing data through AI agents so that you can review and approve work. Examples include email processing, drafting quotes, customer follow-up and administrative tasks.

• Data subjects: your customers, prospects, suppliers, employees and other contacts whose data you enter into or process through the platform.
• Data: name and contact details, company details, communication content (such as emails), quote and invoice data, and any other data you provide.
• The platform is not intended for special categories of personal data (such as health data) or data relating to criminal convictions. If you nevertheless wish to process such data, contact us first.

• We process personal data only to provide the service, never for our own purposes.
• We do not use your data to train third-party AI models. See our AI Policy and the subprocessor list for the arrangements with AI vendors.
• Staff and engaged persons are bound by confidentiality.
• We implement appropriate technical and organisational measures as described in our Security Policy, including encryption in transit and at rest and access controls.
• We assist you, insofar as reasonably possible, with data subject requests (such as access or erasure) and with your obligations regarding security, breach notification and data protection impact assessments.

You grant us general authorisation to engage subprocessors. The current list is published at skydust.io/legal/subprocessors. We impose obligations on subprocessors equivalent to those in this DPA.

• We announce changes to the subprocessor list at least 30 days in advance via the subprocessor page or by email.
• If you have a reasonable objection to a new subprocessor, we will work with you to find a solution. If none can be found, you may terminate the affected part of the service.

We process data within the European Economic Area wherever possible. Where a subprocessor processes data outside the EEA (for example an AI vendor in the United States), this is done under a valid transfer mechanism such as an adequacy decision (including the EU-US Data Privacy Framework) or the EU Standard Contractual Clauses. Details per subprocessor are listed on the subprocessor page.

• We notify you without undue delay, and at the latest within 48 hours of discovery, of a personal data breach affecting your data.
• We provide the information you need for any notification to the supervisory authority and to data subjects.
• Notifying the supervisory authority and data subjects remains your responsibility as controller.

On request, we make information available to demonstrate compliance with this DPA, such as descriptions of our security measures. If that is demonstrably insufficient, you may have an audit performed at most once per year, upon reasonable notice and at your own expense, by an independent expert bound by confidentiality.

• After termination of the agreement, you can export your data for 30 days.
• After that period, we delete your personal data from our active systems and backups within 90 days, unless a statutory retention obligation requires us to keep data longer.

In case of conflict between this DPA and the Terms of Service, this DPA prevails with regard to the processing of personal data.

Questions about this DPA or data protection? Email privacy@skydust.io.