Data Processing Agreement

1. Scope & Applicability

This Data Processing Agreement ("DPA") applies to the processing of personal data by E-ARI ("Processor," "we," "us") on behalf of the user or organization ("Controller," "you") in connection with your use of the E-ARI platform. This DPA is incorporated into and forms part of the Terms of Service. By using the Service, you agree to the terms of this DPA.

E-ARI is operated by Aymen Boudebouz, an individual established in Porto, Portugal; E-ARI is a trading name, not an incorporated company. Write to support@e-ari.com; a postal address for legal notices will be published here.

This DPA is designed to comply with the requirements of the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws. Where these laws impose different or additional requirements, the stricter standard applies. For Enterprise customers with custom DPA requirements, the terms of the executed Enterprise Agreement shall prevail to the extent of any conflict.

2. Definitions

The following definitions apply throughout this DPA:

"Personal Data"

Any information relating to an identified or identifiable natural person that is processed by E-ARI in the course of providing the Service. This includes user account information and assessment responses that may contain personal identifiers.

"Processing"

Any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.

"Controller"

The user or organization that determines the purposes and means of the processing of Personal Data. When you create an account and submit assessment data, you act as the Controller.

"Processor"

E-ARI, which processes Personal Data on behalf of the Controller in the course of providing the Service.

"Sub-Processor"

Any third party engaged by E-ARI to process Personal Data on behalf of the Controller as part of the Service delivery.

"Data Subject"

An identified or identifiable natural person whose Personal Data is processed.

"Data Protection Laws"

The GDPR, CCPA, and any other applicable data protection or privacy laws in the jurisdiction(s) where the Controller operates.

3. Roles of the Parties

You (the user or organization) are the Controller of the Personal Data submitted to and generated by the Service. You determine the purposes for which Personal Data is processed, including why you are conducting AI readiness assessments and how you use the results.

E-ARI acts as the Processor, processing Personal Data only on your instructions and for the purposes described in the Terms of Service and this DPA. We do not process your Personal Data for our own purposes beyond what is necessary to provide the Service, maintain platform security, and comply with legal obligations. Specifically, we do not use your assessment data or AI-generated outputs for marketing, advertising, or product training purposes.

In certain limited circumstances, E-ARI may act as a Controller in its own right with respect to certain categories of data, such as operational metadata (server logs, performance metrics) and aggregate anonymized statistics used for benchmarking. In such cases, the processing is governed by our Privacy Policy rather than this DPA.

4. Categories of Data Processed

The following categories of Personal Data are processed by E-ARI in the course of providing the Service:

4.1 Data Provided by the Controller

Identity data

Full name, job title, and professional contact information of the account holder and designated team members.

Contact data

Email address, phone number (if provided), and mailing address (Enterprise customers only).

Organization data

Organization name, size, sector, geographic region, and information about current AI initiatives that may include references to identifiable individuals.

Team member roster data

Names, work email addresses, and optional role/department of the customer's personnel, provided by the customer's administrator for AI-literacy training assignment and completion tracking (EU AI Act Article 4). Processed on the customer's instruction; the customer remains controller. Data subjects: customer employees. Retention: until removed by the administrator or account deletion.

Vendor contact data

Name and work email of vendor representatives, provided by the customer to deliver AI risk questionnaires. Data subjects: third-party vendor personnel. Retention: until the vendor record is deleted by the customer or account deletion.

Assessment responses

Answers to the 8-pillar questionnaire, including selected options, free-text elaborations, and notes. These responses may contain personal opinions, organizational details, or references to identifiable colleagues.

4.2 Data Generated by Processing

Scoring outputs

Pillar scores (0-100), overall readiness scores, maturity band classifications, and weighted adjustments produced by the deterministic Scoring Agent (Methodology v5.6).

AI-generated narratives

Strategic insights, gap analyses, competitive positioning assessments, learning path recommendations, and Q&A responses produced by the Insight, Discovery, Literacy, and Assistant agents using large language models.

Reports

PDF documents compiled by the Report Agent containing executive summaries, benchmark comparisons, roadmaps, and strategic recommendations.

Benchmark comparisons

Sector-specific comparisons derived from our curated benchmark dataset covering eight industry sectors.

4.3 Sensitive Data

E-ARI is not designed to collect or process special categories of personal data as defined by the GDPR (racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation). If you inadvertently include such data in your assessment responses, please notify us immediately at dpo@e-ari.com so we can take appropriate measures. We recommend that you do not include personally identifiable information about specific individuals in your assessment responses.

5. Processor Obligations

E-ARI commits to the following obligations as Processor of your Personal Data:

Instruction-based processing

We process Personal Data only on your documented instructions, as set out in the Terms of Service, this DPA, and any subsequent written instructions you provide through the platform's administrative features or by email to dpo@e-ari.com. We will not process Personal Data for any purpose incompatible with the purposes set out in this DPA.

Confidentiality

All personnel authorized to process Personal Data have committed themselves to confidentiality obligations, either through employment contracts or specific NDAs. Access to Personal Data is restricted to personnel who need it to perform their duties.

Security measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Section 7 of this DPA.

Sub-processor engagement

We engage Sub-Processors only with prior authorization, as described in Section 6, and impose the same data protection obligations on them as are imposed on us under this DPA.

Data subject rights assistance

We assist you in responding to requests from Data Subjects exercising their rights, as described in Section 9.

Deletion and return

Upon termination of the Service, we will delete or return all Personal Data in accordance with Section 12, unless retention is required by applicable law.

Audit support

We make available to you all information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits and inspections as described in Section 10.

6. Sub-Processors

E-ARI engages the following categories of Sub-Processors to process Personal Data in the course of providing the Service. By accepting this DPA, you authorize the use of these Sub-Processors:

6.1 Current Sub-Processors

6.2 Sub-Processor Changes

We will notify you of any addition or replacement of Sub-Processors by updating this page and sending an email notification to the address associated with your account at least 30 days before the change takes effect. You may object to a new Sub-Processor by notifying us at dpo@e-ari.com within 30 days of receiving the notification. If you object and we cannot provide an alternative, you may terminate the affected portion of the Service without penalty.

6.3 LLM Processing Specifics

The platform’s default model provider is DeepSeek, which processes data in China. China is not covered by a European Commission adequacy decision. Transfer safeguards must be established and assessed; this page does not assert that an agreement alone resolves the transfer assessment. Model-assisted features include narrative generation, clause extraction from uploaded evidence, compliance drafting and organisation enrichment. Configurable endpoints can change routing; the operator must confirm the active providers and update disclosures before using an alternative. Readiness scoring and rule-based risk classification do not use a language model. Provider retention and model-training conditions depend on the applicable API terms; E-ARI does not assert negotiated zero-retention or no-training commitments.

7. Security Measures

E-ARI implements the following technical and organizational measures to protect Personal Data:

7.1 Technical Measures

Encryption in transit

Browser traffic and configured external provider API calls use HTTPS. Exact supported TLS versions are determined by the relevant endpoints.

Encryption at rest

Database and object-storage encryption depend on the configured providers. Backup placement and key management must be confirmed against the actual deployment.

Key management

Application secrets are supplied through deployment configuration. A dedicated application KMS and an enforced 90-day key rotation schedule are not established by this implementation.

Network security

Access is protected by application authentication and configured provider controls. Private network isolation, intrusion detection and database network restrictions require deployment-specific verification.

Application security

Every deploy is gated on the same build command: type checking, lint, and the full automated test suite, which includes regression tests written against specific security findings — authentication, authorisation, rate limiting, SSRF, upload handling and injection. We do not run a commercial SAST or DAST product, and no third-party penetration test report is published.

Password security

User passwords are stored using bcrypt hashing with adaptive work factors. We never store passwords in plaintext or using reversible encryption.

7.2 Organizational Measures

Access control

The application implements role-based authorisation and records specified administrative actions. Provider-account MFA enforcement and production-access reviews require operational confirmation.

Personnel training

Personnel training requirements and completion records must be established by the operator and supplied during the contractual review; an annual training programme is not evidenced by the application.

Data minimization

We apply data minimization principles throughout the platform. Assessment data is only processed by the agents necessary for the requested output. LLM prompts include only the data required for the specific agent function.

Separation of concerns

Environment separation and the data permitted in each environment must be confirmed from operational procedures. Tests alone do not establish that production data is excluded from every development workflow.

Vendor management

Provider agreements, transfer assessments and review records require operator confirmation. Listing a provider does not establish that an annual review or a particular contractual safeguard has been completed.

7.3 Enterprise Security

Enterprise SSO (OIDC) is configured by the E-ARI platform operator. Stored enforcement rejects password sign-in and invalidates non-SSO sessions even if provider registration or configuration loading fails. An identity-provider outage does not restore password access; operator recovery requires explicitly disabling enforcement. This is not per-workspace customer-managed SSO or SCIM provisioning. IP allowlisting, custom session policies and additional controls must be agreed and verified separately; they are not implied by the Enterprise plan.

8. Data Breach Notification

In the event of a Personal Data breach (as defined by the GDPR), E-ARI will:

• Notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of Data Subjects.
• Provide the following information: The nature of the breach, including the categories and approximate number of Data Subjects and Personal Data records concerned; the likely consequences of the breach; and the measures taken or proposed to address the breach and mitigate its effects.
• Cooperate with the Controller in investigating the breach and taking remedial action, including assisting with any required notifications to supervisory authorities or Data Subjects.
• Document all breaches, including the facts of the breach, its effects, and the remedial action taken, and make this documentation available to supervisory authorities upon request.

Notifications will be sent to the email address associated with your account and, for Enterprise customers, to the designated security contact specified in your Enterprise Agreement. We will also make reasonable efforts to notify affected Data Subjects directly if the breach is likely to result in a high risk to their rights and freedoms, unless prohibited by law.

9. Data Subject Rights Support

E-ARI assists you in fulfilling your obligations to respond to Data Subject requests to exercise their rights under Data Protection Laws. Specifically:

Access requests

We provide tools in the platform dashboard for users to access and export their personal data, including assessment responses, scores, and AI-generated content. For bulk or complex access requests, contact dpo@e-ari.com.

Rectification requests

Users can update their account information and retake assessments with corrected data directly from the platform. If rectification requires changes to previously generated AI outputs, the assessment can be reprocessed through the agent pipeline.

Erasure requests

Users can request account deletion by emailing dpo@e-ari.com. We will delete Personal Data within 30 days of receiving a valid erasure request, except where retention is required by law.

Portability requests

Users can export their data in machine-readable formats (JSON, PDF) from the platform dashboard. This includes assessment responses, scores, and generated reports.

Objection and restriction

Users can object to or request restriction of processing by contacting dpo@e-ari.com. We will cease the relevant processing unless we have compelling legitimate grounds that override the user's interests.

If you receive a request from a Data Subject that requires our assistance, please forward the request to dpo@e-ari.com and we will respond within 15 business days. We will not respond directly to Data Subjects without your authorization, except where required by law.

10. Audits & Compliance

E-ARI makes available to you all information reasonably necessary to demonstrate our compliance with this DPA.

Our own certifications

E-ARI holds no SOC 2, ISO 27001 or equivalent certification, and we do not claim compliance with those standards. Our security page states this in full, including what we have not yet done.

Sub-processor certifications

The infrastructure providers listed in section 6 — Vercel, Supabase and the others named there — hold their own SOC 2 Type II and ISO 27001 certifications. Those attestations cover their platforms, not the E-ARI application running on them.

GDPR

We act as Processor for the data you upload and as Controller for your account. Data protection enquiries reach a named person at dpo@e-ari.com.

Security testing

The platform is tested against the OWASP Top 10 and the findings are fixed and regression-tested in the codebase. We do not currently publish a third-party penetration test report, and no such report is available on request. If your procurement process requires one, tell us before you buy rather than after.

Enterprise customers may conduct or commission audits of our data processing practices, subject to reasonable advance notice (at least 30 days) and execution of a mutually acceptable NDA. Audits must be conducted during normal business hours and in a manner that does not disrupt the Service or compromise the security of other customers' data. We will cooperate with any such audit and provide reasonable access to relevant facilities, systems, and records.

11. International Data Transfers

Personal Data may be transferred to and processed in countries other than the country in which it was originally collected. We ensure that all international transfers are subject to appropriate safeguards:

Standard Contractual Clauses (SCCs)

For transfers from the EEA, UK, or Switzerland to countries that do not have an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (as approved and amended from time to time). These clauses are incorporated into our agreements with Sub-Processors by reference.

Adequacy decisions

Where the European Commission has issued an adequacy decision for a specific country, transfers may proceed without additional safeguards.

Transfer Impact Assessments

We conduct Transfer Impact Assessments for Sub-Processors located in countries without adequacy decisions, evaluating the legal framework of the destination country and the effectiveness of the safeguards in place.

LLM provider residency

The platform’s default model provider is DeepSeek, which processes data in China. China is not covered by a European Commission adequacy decision. Transfer safeguards must be established and assessed; this page does not assert that an agreement alone resolves the transfer assessment. Model-assisted features include narrative generation, clause extraction from uploaded evidence, compliance drafting and organisation enrichment. Configurable endpoints can change routing; the operator must confirm the active providers and update disclosures before using an alternative. Readiness scoring and rule-based risk classification do not use a language model. Provider retention and model-training conditions depend on the applicable API terms; E-ARI does not assert negotiated zero-retention or no-training commitments.

We will inform you of any changes to the transfer mechanisms we rely on and will obtain your consent before adopting alternative mechanisms where required by applicable law. For Enterprise customers with specific data residency requirements, we can discuss options for data processing within the EEA.

12. Data Retention & Deletion

E-ARI retains Personal Data for the duration of your account plus the periods specified below:

Active accounts

All Personal Data is retained for as long as your account is active and you are using the Service. Assessment data remains accessible through your dashboard throughout the account lifetime.

Post-termination

Account deletion is requested through support@e-ari.com. Once authorised, the erasure workflow removes account-linked records and stored files; specified audit records and legally required records may remain. A separate post-termination reactivation period is not implemented by that workflow. Backup deletion schedules and any contractual maximum retention period require operator confirmation; no unverified backup-erasure deadline is represented here as an implemented control.

Backup systems

The operator must confirm the applicable provider backup lifecycle and deletion schedule. A fixed 180-day deletion cycle is not established by the application code.

Legal holds

Where retention is required by applicable law (e.g., financial records), Personal Data is retained for the legally mandated period and deleted promptly upon expiration.

Anonymized data

Data that has been properly anonymized (such that re-identification is not reasonably possible) may be retained indefinitely for benchmarking and research purposes. Anonymized data is not subject to this DPA.

You may request early deletion of your Personal Data at any time by contacting support@e-ari.com or dpo@e-ari.com. Upon confirmation, we will initiate deletion within 30 days and confirm completion via email.

13. Liability & Indemnification

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service (Section 8). Nothing in this DPA limits either party's liability to the extent that such limitation would be unlawful under the GDPR or other applicable Data Protection Laws.

E-ARI shall indemnify the Controller against claims, actions, third-party claims, losses, damages, and expenses incurred by the Controller arising out of or in connection with E-ARI's breach of this DPA or any applicable Data Protection Laws, provided that the Controller promptly notifies E-ARI in writing of the claim, gives E-ARI sole control of the defense and settlement, and provides reasonable cooperation.

The Controller shall indemnify E-ARI against claims arising from: (a) the Controller's instructions to E-ARI that result in a violation of Data Protection Laws; (b) the Controller's failure to comply with its obligations as a Controller under Data Protection Laws; or (c) the content of the Personal Data provided by the Controller, including any unlawful or infringing content.

14. Contact & DPA Requests

For questions about this DPA, to exercise Data Subject rights, or to request a signed copy of this agreement, please contact us:

Data Protection Officer

dpo@e-ari.com

Privacy Team

privacy@e-ari.com

Legal Team

legal@e-ari.com

Security Team

security@e-ari.com

Enterprise customers who require a signed, customized DPA with specific data processing terms, data residency requirements, or additional security schedules should contact their account manager or email legal@e-ari.com. The scope and timing of a custom agreement must be agreed during that review.

For EU/EEA residents: If you believe that our processing of your Personal Data violates the GDPR, you have the right to lodge a complaint with your local supervisory authority. We are committed to resolving any concerns and encourage you to contact us before filing a formal complaint.