Data Processing Addendum

This Data Processing Addendum is between MAŃSKI AI s.r.o., company ID 17571987, registered office Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic (“Processor”), and the Customer identified in the account acceptance or Order (“Customer”). It forms part of the applicable Professional, Business and Institutional Terms through the incorporation clause in section 3 of the Terms of Service. It is accepted and binding when the Customer electronically accepts those Terms; no separate signature or individually completed DPA is required. The standard Schedules A–D apply automatically. Merely viewing this page is not acceptance.

For the instructed processing, the Customer is controller and the Provider is processor. If the Customer is a processor, it warrants that the ultimate controller authorised this engagement and records that relationship and relevant instructions through documented instructions within standard Schedule A; the Provider acts as its subprocessor. Defined GDPR terms have their GDPR meanings. “Personal Data” in this DPA means data processed on those instructions; the Provider’s independent administration, billing and service-security purposes are addressed separately in the Privacy Policy and may not be used to repurpose Customer Content.

This DPA governs GDPR processing. Processing subject to the law-enforcement regime, Regulation (EU) 2018/1725 or another distinct statutory processor regime requires an express supplemental agreement addressing that regime before it starts. The UK Addendum applies where UK data-protection law is applicable. No clause authorises processing prohibited by law.

An individually signed agreement is available as an optional enterprise arrangement. It replaces this standard only to the extent expressly stated. A legally distinct processing regime or a customer-specific security requirement may need a supplemental agreement; ordinary professional SaaS use does not.

The subject matter is provision of the ordered Veritas Ask functions. Processing may comprise collection, storage, extraction, indexing, retrieval, comparison, inference, generation, display, export and deletion of the selected data for the Customer’s research and analysis purposes. Specific scope, duration, people and data are recorded in Schedule A. Instructions comprise this DPA, the Order, agreed schedules, authorised settings and lawful documented task requests within that scope.

The Processor shall process Personal Data only on documented instructions, including as to transfers, unless EU or Member State law binding on it requires otherwise. In that case it shall inform the Customer before processing unless that law prohibits notice on important public-interest grounds. It shall immediately inform the Customer if, in its opinion, an instruction infringes applicable data-protection law, pause the disputed processing where necessary and seek clarification. It shall not unilaterally determine a new purpose.

The Processor shall not use Customer Content to train Veritas Ask, sell it, use it for advertising or permit a subprocessor to use it outside the agreed purpose. The Customer shall provide lawful instructions, appropriate notices and the relevant legal basis, and shall not submit data beyond the agreed categories. Neither allocation relieves the Processor of its own statutory duties.

The Processor shall ensure that persons authorised to process Personal Data are bound by confidentiality or an appropriate statutory duty, access only what is needed for their assigned task, and cease access when no longer authorised. It shall maintain measures appropriate to risk under Article 32 GDPR and the agreed Schedule B, taking account of the state of the art, costs, nature, scope, context, purposes and risks to people.

The baseline TOMs at https://www.veritasask.com/toms, in the version recorded with this DPA, form Schedule B automatically. They identify the documented controls; unverified certification, encryption or recovery claims are not added by implication. The Processor shall not materially reduce the agreed protection during the term. Material changes follow the notice and amendment process; urgent protective measures may be taken with prompt subsequent information. A Customer needing additional controls may agree them in an optional enterprise schedule before the use that requires them.

For this Addendum, a subprocessor is an external entity actually processing the instructed Personal Data on the Provider’s behalf in performing its processor obligations to the Customer. Merely supplying technology, acting for another entity’s own controller purposes, or processing solely for the Provider’s separate controller purposes does not automatically establish that role. Classification is functional; a contract label or missing processor agreement does not change the actual role.

The Customer gives general written authorisation for the named subprocessors in the versioned register at https://www.veritasask.com/subprocessors incorporated as Schedule C. A separate customer signature for each listed entity is not required. Additions or replacements require at least 30 days’ prior written notice identifying the entity, purpose, data categories, processing countries, access scope and intended start date. The Customer may object on reasonable data-protection grounds within that period. A shortened notice period requires express agreement or a binding legal requirement; an urgent supplier problem does not automatically authorise an unknown replacement. No unpublished or unidentified entity is deemed authorised by a blank or incomplete register.

The Processor shall assess the proposed provider and impose written obligations providing the same level of relevant data protection, including confidentiality, security, instructions, deletion and assistance. It remains responsible to the Customer for the subprocessor’s performance of those obligations. It shall provide the information reasonably necessary to verify the chain, protecting unrelated confidential terms.

On a substantiated objection the parties shall seek an alternative that avoids the disputed processing. If none is reasonably available, the affected processing must not start and the Customer may terminate the affected Service without penalty, with return or deletion and a refund for its unused prepaid period. Absence of a published supplier name does not mean there is no subprocessor or that an unlisted entity has been authorised.

Taking account of the nature of processing, the Processor shall assist through appropriate measures with access, correction, erasure, restriction, portability, objections and other applicable data-subject rights. It shall promptly pass a request concerning instructed processing to the Customer, and shall not answer substantively except on instructions or where law requires. It shall provide available information and exports in time to help the Customer meet its statutory deadline.

Taking account of the processing and information available, the Processor shall assist compliance with Articles 32–36 GDPR, including security assessments, breach response, DPIAs and prior consultation. It shall cooperate with the competent supervisory authority as required by law. Routine assistance and assistance caused by the Processor’s breach are included in the Service; exceptional customer-specific work may be separately priced in advance, without conditioning a mandatory or urgent statutory duty on prior payment.

The Processor shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting the instructed data. It shall not wait for a complete investigation or apply the controller’s 72-hour regulatory deadline as its own response period. A shorter numerical notification target applies only if expressly agreed in Schedule B.

The initial notification shall give available facts about the nature of the breach, affected categories and approximate numbers of people and records, likely consequences, contact for follow-up and measures taken or proposed to contain and mitigate it. Unknown details shall be identified and provided in successive updates without undue further delay. The Processor shall preserve relevant evidence, take reasonable containment and remediation steps, and provide information required for the Customer’s notification decisions.

The Customer directs notifications to affected people and authorities for its processing, without restricting the Processor’s independent legal obligations. The parties coordinate communications where lawful. Notification is not, by itself, an admission of liability. The default Customer incident contact is the verified contracting-account email or designated organisation contact; the Provider contact is contact@veritasask.com. Either party may update its contact by an authenticated setting or documented notice without signing a new DPA.

Personal Data shall be stored and processed within the European Union, including by authorised subprocessors and support personnel acting for the Processor. There is no ordinary authorisation for remote access or processing outside the EU. Detailed infrastructure sites are disclosed only through an appropriate confidential review where necessary; country and legal-entity information required by law or contract must still be provided.

No change to that boundary may occur without the Customer’s prior documented agreement, a lawful transfer mechanism where applicable, an assessment of necessary safeguards and any required statutory approval. Standard contractual clauses or an adequacy decision do not by themselves amend this EU-only commitment. The Processor shall assess compulsory disclosure demands, challenge unlawful demands where reasonably available, minimise any legally required disclosure and notify the Customer unless prohibited.

The Processor shall make available all information necessary to demonstrate compliance with Article 28 GDPR and allow and contribute to audits, including inspections, by the Customer or an independent auditor mandated by it. The parties may use relevant existing evidence first to avoid unnecessary disruption, but this does not remove inspection rights or substitute an unverified certification for evidence.

Ordinary audits require reasonable notice, a defined scope and proportionate confidentiality and security arrangements protecting other customers. Notice or frequency limits shall not prevent a justified audit following a breach, credible non-compliance or regulatory request. Audits may not be conditioned on a waiver of statutory rights. Each party bears its ordinary internal costs; reasonable exceptional audit costs may be agreed in advance, but the Processor bears remediation and reasonable verification costs caused by its material non-compliance.

This DPA lasts for the period of instructed processing, including the agreed return and deletion phase. On the Customer’s choice at the end of services, the Processor shall return or delete Personal Data and delete existing copies, unless EU or Member State law requires retention. Schedule D defines export, retrieval, backup expiry, supplier deletion and completion confirmation. Required retained records must be isolated from ordinary use, limited to the legal purpose and deleted when the duty ends.

The Processor shall confirm completion of its agreed deletion steps on request and disclose any continuing legally required retention. A claim of complete erasure must not be made before the relevant supplier and backup steps are complete. The Customer must communicate any lawful retention instruction before deletion; a legal hold must identify its basis and scope.

Material unresolved breach permits suspension of affected processing and termination under the Terms. The Agreement’s liability rules apply between the parties but cannot limit data-subject rights, supervisory powers or responsibility imposed by mandatory law. This DPA prevails on personal-data processing over inconsistent general terms. Its confidentiality, audit, assistance and deletion obligations survive as needed to complete that processing lawfully.

The Processor is MAŃSKI AI s.r.o. as identified in section 1. The Customer is the individual professional, business or institution named in the electronic acceptance or Order. The accepting user’s verified account, declared authority and customer identity form the party-identification record. No separate signature block is necessary. Contact details are the verified account or designated organisation contact and contact@veritasask.com for the Provider.

The subject matter is provision of the ordered professional AI research, analysis, comparison, extraction, drafting and decision-support functions. The purpose is delivery, maintenance and security of those requested functions on the Customer’s instructions. The nature includes receipt, storage, extraction, organisation, indexing, retrieval, inference, generation, display, export and deletion. Processing occurs on an ongoing or task-by-task basis according to use, for the Agreement’s term and the necessary return/deletion phase.

Data subjects are the people whose information the Customer lawfully submits or selects, which may include users, employees, clients, counterparties, witnesses, patients, suppliers and research participants. Data types are the corresponding identity and contact details, professional or case materials, correspondence, financial and research information and output data actually submitted or generated. The Customer determines the actual categories through its permitted tasks and configuration; the examples are not instructions to collect every category.

Special-category and criminal-offence data are included only where lawfully supplied for the permitted purpose with the required Article 9 condition or Article 10 authority, minimisation, access restriction and an appropriately assessed controlled configuration. The Customer documents those conditions and any required DPIA; it does not have to sign a new standard DPA for each matter. Classified information is excluded. A distinct statutory processing regime still requires the legally necessary supplemental arrangement.

The versioned Technical and Organisational Measures at https://www.veritasask.com/toms are incorporated into this Schedule B without further signature. The accepted document and content fingerprint are included in the acceptance bundle. The baseline includes server-verified identity, role and record permissions, separation of personal and organisational scopes, controlled private-document selection, selected audit metadata, export and active-data deletion functions and EU storage and processing, within the limitations described in the TOMs.

The Processor’s Article 32 obligation, personnel confidentiality, supplier obligations, breach assistance and audit duties apply in addition to that description. No customer acceptance is a waiver of these duties or an agreement that unspecified safeguards exist. Unverified encryption configurations, certifications, recovery objectives or round-the-clock SLAs are not promised. Additional controls may be agreed for an optional enterprise deployment; if a use needs an unavailable control, that use must not proceed until resolved.

The centrally maintained, versioned Subprocessors register at https://www.veritasask.com/subprocessors forms this Schedule C by reference. Its entries must identify each actual contracting legal entity, service, categories of Personal Data, EU processing countries, support-access scope, relevant onward processing, safeguards and appointment/change date. A product brand is not a substitute for the legal entity. No individual customer signature is required for the initial listed entities or properly notified changes under section 4.

The Provider maintains this shared register from evidenced actual flows and roles; Customers do not individually negotiate or sign it. Only confirmed legal entities are published. Unresolved roles are tracked internally for verification and must not be presented as confirmed subprocessors. An empty register is permissible where the relevant processing is established to have no subprocessors; absence of published entries alone does not establish that conclusion. Non-publication does not change an actual legal role or authorise unauthorised processing. The standard DPA becomes binding through the joint electronic acceptance of the Terms.

The standard retention instruction is to retain workspace content while the Customer keeps it in the account, until its authorised deletion instruction or the applicable administrator-run organisation cleanup. Configured retention is not represented as an automatic background job. Processing instructions continue only as necessary for the agreed return and deletion phase. Subscription cancellation alone is not an instruction to erase saved work.

At the end of instructed services, the Customer chooses return or deletion through the available controls or a documented request. Export formats and mandatory transition/retrieval rights are incorporated from https://www.veritasask.com/data-portability. After return or the applicable retrieval window, remaining Personal Data and copies must be deleted without undue delay unless EU or Member State law requires retention. Deletion of authentication identities, supplier copies and backups must be completed through their respective processes; no unsupported numerical backup-expiry period is asserted.

Any copy pending its deletion lifecycle remains protected and unavailable for new ordinary use; a restored copy must remain subject to the deletion instruction. The Processor must provide the applicable lifecycle information and completion status on request and must not claim complete erasure prematurely. A legally required hold identifies the basis, scope and ending condition and does not authorise general reuse. An optional enterprise retention schedule can specify additional periods and verification steps, but is not needed to make these default obligations binding.