Data Processing Agreement (DPA)

Draft for legal review. This DPA forms part of the Terms of Service and applies whenever AACSearch processes personal data on a customer's behalf. It follows Art. 28(3) GDPR; for transfers outside the EEA the Standard Contractual Clauses (Decision (EU) 2021/914) are incorporated by reference.

1. Parties and roles

The customer is the controller; [не задано: legalName] is the processor.

2. Subject matter, duration, nature and purpose

  • Subject matter: hosting search indexes, answering search and assistant requests, computing recommendations and analytics for the customer's sites and apps.
  • Duration: for the term of the customer's subscription plus the deletion period in section 9.
  • Nature: storage, indexing, retrieval, aggregation, deletion.
  • Purpose: providing the AACSearch service to the customer.

3. Personal data and data subjects

  • Data subjects: visitors and users of the customer's websites and applications; the customer's staff.
  • Data: search queries, click and conversion events with pseudonymous visitor and visit identifiers, IP address (security logs), any personal data the customer chooses to include in indexed documents, assistant conversations.
  • Special categories: none intended; the customer must not index special-category data unless agreed in writing.

4. Processor obligations (Art. 28(3))

The processor will:

  1. process personal data only on the customer's documented instructions — this DPA, the Terms and the customer's configuration — including for transfers, and inform the customer if an instruction infringes data-protection law;
  2. ensure persons authorised to process the data are bound by confidentiality;
  3. implement the technical and organisational measures in Annex 1 (Art. 32);
  4. engage sub-processors only under section 5;
  5. assist the customer with data-subject requests (Arts. 12–22), including through the export and deletion tools in the console and API;
  6. assist with security, breach notification (Arts. 33–34) and data-protection impact assessments (Arts. 35–36);
  7. delete or return all personal data at the end of the service (section 9);
  8. make available the information needed to demonstrate compliance and allow audits, including inspections, conducted by the customer or an auditor it mandates, with reasonable notice.

5. Sub-processors

The customer gives general authorisation for the sub-processors listed at Sub-processors. We will announce any addition or replacement at least 30 days in advance on that page and by e-mail to subscribed customers. The customer may object on reasonable data-protection grounds; if we cannot resolve the objection, the customer may terminate the affected service and receive a pro-rata refund. Each sub-processor is bound by obligations equivalent to this DPA (Art. 28(4)); we remain liable for their performance.

6. Personal data breaches

We notify the customer without undue delay and in any case within 48 hours of becoming aware of a breach affecting the customer's data, with the information in Art. 33(3) available at the time, and update it as facts emerge.

7. International transfers

Transfers outside the EEA take place only under an adequacy decision or the Standard Contractual Clauses (Module 2 controller-to-processor, or Module 3 processor-to-processor for sub-processors), with a transfer impact assessment and supplementary measures where needed.

8. Customer obligations

The customer has a lawful basis for the processing, provides the notices to its own users (suggested text in Annex 2), obtains consent for device storage where required (see Cookie Policy), and configures retention and personalisation to match its notices.

9. Deletion and return

During the subscription the customer can export and delete data at any time. After termination we keep the data for a 30-day retrieval period (Data Act Art. 25), then delete it, including backups within a further 30 days, unless Union or Member State law requires storage.

10. Liability and order of precedence

Liability follows the Terms. In a conflict, the Standard Contractual Clauses prevail, then this DPA, then the Terms.

Annex 1 — Technical and organisational measures

  • Isolation: each index is a separate collection; every query carries a server-side tenant filter.
  • Access control: role-based access in the console; API keys stored as SHA-256 hashes, with expiry and rotation; browser access only through short-lived session tokens scoped to one index.
  • Document-level permissions: ACL filters applied before results, counts and facets are computed.
  • Encryption: TLS in transit; encrypted storage at the hosting provider.
  • Logging and audit: administrative changes recorded with actor and time; security logs kept 90 days.
  • Retention: query logs 90 days, click events 365 days by default, configurable per customer.
  • Network safety: crawlers fetch only public addresses and re-check every redirect.
  • Availability: backups, monitoring, status page.
  • Data subject requests: organisation-wide export and full deletion via console and API.

Annex 2 — Suggested wording for the customer's privacy notice

Site search and recommendations on this website are provided by AACSearch, which processes your search queries and clicks on our behalf to show results and, if you agreed, to personalise them. Questions about this processing: [your contact].

Annex 3 — AI assistant

If the customer enables the AI assistant, the assistant is labelled as an AI system to the end-user at the first interaction (Art. 50(1) AI Act); generated answers are marked as AI-generated in the API response. The customer must not remove the label.