# Data Processing Agreement (DPA) — Template

**Between**

- **Controller (Customer):** `[Customer legal name]`, `[registered seat]`, `[commercial register number / court, if any]`, `[VAT ID, if any]`, represented by `[authorized signatory]` ("Customer")
- **Processor:** Paul Curcean, sole proprietorship (Einzelunternehmen), seat in Austria, contact: paulcurcean@protonmail.com (mailto:paulcurcean@protonmail.com) ("Processor")

This template implements Art. 28 GDPR for the use of Aletura (aletura.eu), the contract-intelligence platform operated by the Processor. It becomes binding only when completed, signed by both parties and attached to a main agreement. Downloading this file does not conclude a contract.

## 1. Subject matter and duration

Subject matter: hosting and operation of the Aletura platform, including contract upload, deterministic analysis, report generation, optional saving of results, account management and workspace features for the Customer's organization.

Duration: for the term of the main agreement between the parties, unless terminated earlier with the main agreement.

## 2. Nature and purpose of processing

Provision of the Aletura service: transient processing of uploaded contracts for analysis (extraction, masking, retrieval, model calls, evidence verification, report generation), account and quota administration, optional encrypted storage of results the Customer explicitly saves, audit logging, and support.

## 3. Types of personal data

- Account data: email address, password hash, account status, plan, workspace memberships and roles.
- Usage and quota metadata: per-UTC-day counters, hashed anonymous device tokens for guests, hashed-IP abuse-guard counters, audit events. Raw IP addresses are never logged or stored.
- Contract content and analysis results: only processed transiently and locally masked before any model call; persisted only when the Customer explicitly chooses Save. Unsaved content, indexes and masking mappings are ephemeral and deleted after the session or via TTL.
- BYOK / provider API keys: stored AES-256-GCM encrypted, never logged, sent only to the allowlisted endpoint of the respective provider.

## 4. Categories of data subjects

The Customer's authorized users and members, and persons mentioned in the contracts the Customer uploads.

## 5. Processor's obligations (Art. 28(3) GDPR)

1. Process personal data only on documented instructions of the Customer, including on transfers to third countries, unless required by Union or Member State law.
2. Ensure that persons authorized to process the data are bound by confidentiality.
3. Implement the technical and organizational measures in Annex 1.
4. Assist the Customer in responding to data-subject requests and in meeting Art. 32–36 GDPR obligations, taking into account the nature of processing.
5. Not engage another processor without prior specific or general written authorization of the Customer; where general authorization is given, inform the Customer of intended changes and give an opportunity to object. Sub-processors are listed in Annex 2 and remain fully liable for their performance.
6. At the Customer's choice, delete or return all personal data after the end of the provision of services, and delete existing copies unless storage is required by law.
7. Make available all information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

## 6. Customer's instructions

The Customer instructs the Processor to process personal data only to provide, secure and support the Aletura service as described in the main agreement, this DPA and the publicly available documentation (privacy policy, security page, methodology page), and only as necessary for those purposes.

## Annex 1 — Technical and organizational measures (summary of what is implemented)

- Encryption in transit (TLS/HTTPS only).
- Encryption at rest with AES-256-GCM for saved analyses (and co-saved originals where provided), BYOK/organization credentials and company knowledge; keys held in configuration/secrets outside the code repository; key rotation supported via a previous key.
- Passwords stored as hashes only.
- Authorization based on the authenticated principal and server-side organization/department memberships; client-sent plan/account headers are never trusted. Role-based access (admin/member) per workspace.
- Deterministic local masking of detected personal identifiers before indexing and before any model call; outbound prompt guard; response validation (schema, canary leaks, disallowed fields). Masking is pseudonymization with detection limits.
- Prompt-injection defense: uploads and follow-up questions are untrusted data; embedded instructions are never executed; no contract-triggered tools, URL retrieval, shell, email or persistence; JSON-isolating safe prompt builder.
- No contract content is persisted by default; unsaved uploads, indexes and masking mappings are ephemeral and TTL-scoped.
- Audit logging per organization with an HMAC-SHA256 integrity chain (key rotation supported); configurable retention of 30, 90 or 365 days (default 90 days); rate-limited CSV export.
- Email verification and password-reset links: single-use, stored as hashes, valid 24 h resp. 30 minutes.
- No certification (e.g. ISO/IEC 27001) is claimed; the current validation status of the analysis is published on the methodology page.

## Annex 2 — Sub-processors

| Sub-processor | Purpose | Notes |
| --- | --- | --- |
| Scaleway | Application and database hosting | EU |
| Mistral AI | AI inference for the analysis | Configured for Mistral EU regional inference (endpoint `https://api.eu.mistral.ai`); no GDPR-compliance or end-to-end residency beyond that configuration is inferred. With BYOK, the Customer's key is sent only to the allowlisted endpoint of the selected provider. |
| Simple Analytics | Website analytics | Cookie-less, respects Do Not Track, stores no IP addresses, builds no profiles |

The Customer may object to a new sub-processor on reasonable data-protection grounds; if the objection is not resolved, the Customer may terminate the affected services.

---

*Template version 1.0 (2026-11-03). This template is not legal advice; have it reviewed before signing.*