kovacDRAFT — not legally reviewed.
This Data Processing Agreement (“DPA”) forms part of the agreement between Inteligenta AIX [[legal form, registered address, registration number]] (“Processor”) and the customer named in the order (“Controller”) for the provision of kovac (the “Service”) under our Terms of Service (the “Agreement”).
It sets out the terms required by Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the corresponding provisions of North Macedonia’s Law on Personal Data Protection (Official Gazette of the Republic of North Macedonia No. 42/2020) (together, “Data Protection Law”).
1. Definitions
Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in Data Protection Law. “Customer Personal Data” means personal data contained in Customer Content, as defined in the Agreement, that the Processor processes on the Controller’s behalf.
2. Subject matter, duration, nature and purpose
2.1 Subject matter: the processing of Customer Personal Data to provide the Service.
2.2 Duration: for the term of the Agreement and until deletion in accordance with section 11.
2.3 Nature and purpose: hosting, storing, parsing and indexing the Controller’s documents and connected sources; retrieving passages and generating answers with AI models configured for the Controller’s workspace; running agents and the Controller’s skills; recording conversations, memory, audit and usage records; providing support. Further details are in Annex 1.
3. Controller’s instructions
3.1 The Processor processes Customer Personal Data only on the Controller’s documented instructions, including with regard to transfers to third countries, unless required to do so by law, in which case it will inform the Controller before processing unless the law prohibits it.
3.2 The Agreement, this DPA and the Controller’s configuration and use of the Service (for example the sources it connects, the models it selects and the agents it publishes) are the Controller’s complete instructions. The Processor will inform the Controller if, in its opinion, an instruction infringes Data Protection Law.
3.3 The Controller is responsible for the lawfulness of the processing it instructs, including having a legal basis for submitting Customer Personal Data to the Service and providing any required information to data subjects.
4. Confidentiality
The Processor ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and access it only as needed to provide and support the Service.
5. Security
The Processor implements the technical and organisational measures described in Annex 2, which take into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing as well as the risks to data subjects (Article 32 GDPR). The Processor may update these measures provided the overall level of security is not reduced.
6. Sub-processors
6.1 The Controller gives general authorisation for the Processor to engage the sub-processors listed in Annex 3.
6.2 The Processor will notify the Controller at least [[number]] days before adding or replacing a sub-processor. The Controller may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the affected part of the Service and receive a refund of prepaid fees for it.
6.3 The Processor imposes on each sub-processor, by written contract, data-protection obligations no less protective than those in this DPA, and remains liable to the Controller for each sub-processor’s performance.
6.4 Where the Controller configures its own credentials for an AI model provider or a connected source, that provider is engaged by the Controller and is not a sub-processor of the Processor.
7. International transfers
The Processor will not transfer Customer Personal Data to a country outside North Macedonia and the European Economic Area that lacks an adequacy decision unless an appropriate safeguard under Data Protection Law is in place, such as the European Commission’s standard contractual clauses. [[Set out the transfer mechanism and the locations of processing.]]
8. Assistance with data subject requests
Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in responding to requests from data subjects. The Service lets the Controller find, edit, download and delete documents and their metadata, and remove stored agent memory. If the Processor receives a request directly, it will forward it to the Controller without undue delay and will not respond itself except on the Controller’s instruction.
9. Other assistance
The Processor assists the Controller, taking into account the nature of processing and the information available to it, in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation). [[Assistance beyond the information in this DPA may be charged at the rates stated in the Order.]]
10. Personal data breaches
10.1 The Processor notifies the Controller without undue delay, and in any event within [[hours]] hours, after becoming aware of a personal data breach affecting Customer Personal Data.
10.2 The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not available at first is provided as it becomes available.
10.3 The Processor takes reasonable steps to contain and remedy the breach and to prevent recurrence. Notification is not an admission of fault.
11. Deletion and return
11.1 On termination of the Agreement, the Processor makes Customer Content available for download for [[number]] days, as set out in the Terms, and then deletes Customer Personal Data, unless law requires its storage.
11.2 Deleted data is removed from backups as they expire in the ordinary backup cycle, within [[number]] days. The Processor confirms deletion in writing on request.
12. Audits
12.1 The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR, including the measures in Annex 2 and [[any certifications or audit reports]].
12.2 Where that information is not sufficient, the Controller may, at its own cost and no more than once a year (unless required by a supervisory authority or following a breach), conduct an audit or inspection, itself or through an independent auditor bound by confidentiality, on at least [[number]] days’ notice, during business hours, and without access to other customers’ data.
13. General
13.1 Liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Law does not allow them.
13.2 In case of conflict, this DPA prevails over the Agreement in matters of personal data protection.
13.3 This DPA is governed by the law that governs the Agreement.
Annex 1 — Details of processing
Categories of data subjects: the Controller’s Users (its employees and contractors with access to its workspace); individuals who use agents the Controller makes available, including visitors to the Controller’s website who use its chat widget; and any individuals named in documents and sources the Controller submits.
Categories of personal data: as determined by the Controller. Typically: names and contact details in documents; business correspondence; the content of questions and answers in conversations; information agents remember between conversations; User identifiers attached to audit and usage records; and, for widget visitors, an anonymous signed visitor handle and their conversation.
Special categories of data: none intended. The Controller decides whether its documents contain special categories of data and is responsible for any additional safeguards that requires.
Frequency: continuous for the term of the Agreement.
Processing operations: storage, parsing, text recognition, splitting into passages, indexing, embedding, search and reranking, answer generation, conversation and memory storage, audit and usage recording, backup, deletion.
Annex 2 — Technical and organisational measures
Separation of customers. Each customer’s data is stored under its own workspace identifier, and the database enforces row-level security on that identifier, so a query run for one customer cannot return another customer’s rows even if application code is wrong. The workspace a request acts for is taken only from the authenticated identity, never from request content or model output.
Access control within a customer. Users sign in through a dedicated identity service using OpenID Connect. Every request carries a short-lived token that is verified on each call. Role-based access separates administration, knowledge management, agent authoring and use; collections, agents, skills and models can be limited to departments; and document-level permissions, including those reported by connected sources, are enforced inside the database for every search.
Credentials. API keys are stored only as hashes. Credentials for AI model providers and connected sources are stored encrypted. Secrets are supplied through the environment and are kept out of code, prompts, logs and traces.
Audit and accountability. Changes to knowledge, permissions and configuration are recorded in an audit log per workspace, retained for a configurable period and exportable to the Controller’s own security monitoring. Agent runs are traced for troubleshooting and quality evaluation.
Isolated code execution. Scripts that are part of a skill run only in short-lived, isolated sandbox containers using a hardened container runtime, never inside the processes that serve the API or hold customer data.
Input handling. Uploaded files are checked against size limits, their content is checked against their declared type, and compressed archives are checked for decompression attacks. Web crawling refuses requests to private and internal network addresses.
Content safeguards. Checks for jailbreak attempts and unwanted content run on questions and answers.
Encryption in transit. Connections to the Service are encrypted with TLS.
Encryption at rest, backups and availability. [[Describe storage encryption, backup frequency, retention and restore testing, and hosting location.]]
Organisational measures. [[Describe staff confidentiality undertakings, access reviews, training, incident response procedure and vendor management.]]
Annex 3 — Sub-processors
The sub-processors the Controller authorises under section 6 are listed in the table below.