Data Processing Agreement

1. Parties and scope

The Customer identified in Annex A appoints Annota S.r.l., with registered office at Via Davide Lazzeretti 2/P, 58100 Grosseto, VAT number IT01783380536 (“Annota AI”), to process personal data contained in the materials entrusted to the Service. Privacy contact: team@annota.ai; certified email (PEC): annotasrl@pec.it. Contact form.

The Customer acts as controller and Annota AI as processor. If the Customer acts as processor for one or more controllers, it warrants that it is authorized to appoint Annota AI as a subprocessor and to convey instructions consistent with those of the controller. The provisions of this agreement apply accordingly.

This agreement concerns data processed on the Customer’s behalf, rather than processing for which Annota AI independently determines the purposes and means, such as its own billing, as described in the Privacy Notice. In the event of a conflict with the Terms, this agreement prevails for the processing governed here, without prejudice to mandatory law and any applicable transfer clauses.

This agreement, including its annexes, becomes binding through documented electronic acceptance by an authorized representative of the Customer or through a signed order or agreement that identifies its version. Merely viewing the public page does not constitute acceptance. The Customer may obtain a copy of the applicable version by writing to team@annota.ai.

2. Subject matter, duration, and instructions

The subject matter, purposes, operations, data, and data subjects are described in Annex A. Processing continues for the period during which the Service is provided and the time necessary for the return or deletion agreed in Annex D.

Annota AI processes data solely on the Customer’s documented instructions, including for international transfers. Instructions comprise this agreement, the order form, operations requested through the Service by authorized users, and further written instructions accepted by the parties. Any processing required by Union or national law is communicated to the Customer before processing, unless prohibited by law.

Annota AI immediately informs the Customer if it considers that an instruction infringes data protection law. The parties clarify or correct the instruction before continuing the processing concerned. If it cannot be made lawful, that processing is suspended and, where necessary, terminated.

3. Customer obligations and use of content

The Customer determines the legal basis, provides the required privacy information, checks that uploaded data is proportionate, and manages its users’ access. Special categories of data, criminal conviction and offense data, and other high-risk content are excluded until expressly authorized in the Plan and Annex A, with the relevant safeguards.

Personal data entrusted to Annota AI is not used to train or improve models for Annota AI’s or third parties’ own purposes. Any model training requested by the Customer is processing on its behalf, within the limits of the enabled features and instructions received. This agreement does not authorize additional uses.

4. Confidentiality and security

Annota AI restricts access to persons who need it for their authorized duties and are subject to contractual or statutory confidentiality obligations. Those obligations continue after access ends. Authorized persons receive instructions on permitted operations and incident reporting; permissions are adjusted or revoked when duties change or the relationship ends.

Annota AI applies technical and organizational measures appropriate to the risks pursuant to Article 32 GDPR. Annex B identifies the agreed measures, including protection of access, communications, retention, restoration, and periodic verification. The measures may evolve without reducing the overall agreed level of protection. This agreement does not attribute its providers’ certifications to Annota AI or introduce service levels beyond those expressly agreed.

5. Subprocessors and transfers

The Customer grants general authorization for the subprocessors listed in Annex C applicable to its environment. Annota AI notifies the Customer’s contact in writing of additions or replacements at least 30 days in advance, identifying the activities and locations of processing. The Customer may object within that period on documented data protection grounds. Before entrusting data to the new party, the parties seek an appropriate solution; if none is found, the Customer may terminate the affected service and obtain a refund of prepaid amounts for the unused portion. Annota AI does not entrust the disputed processing to the new party until the objection has been resolved or that processing has ended.

Annota AI imposes on subprocessors data protection obligations substantially equivalent to those applicable to the processing entrusted to them and remains responsible to the Customer for performance of their obligations. It makes available the information necessary for verification, protecting secrets and other customers’ data without preventing the required checks.

All AI models used by the cloud service run on infrastructure managed by Annota AI in the European Union, which also hosts the primary database and storage. External AI providers’ APIs are not used for this processing. This architecture does not guarantee that all processing by network or support providers takes place exclusively within the European Economic Area.

Authorized personnel may work remotely, including from outside the European Economic Area. Before permitting access from a country, Annota AI verifies and records the location, the person’s role, the need for access, and the relevant risks, applying the measures in Annex B. Remote work does not indiscriminately authorize access from any country.

The classification of freelancers depends on the actual relationship: a natural person subject to Annota AI’s direct authority and instructions is distinct from an external provider entrusted with processing. In the latter case, the rules on subprocessors also apply. Access from abroad by a person within the same organization does not automatically constitute a transfer to a different recipient, but remains subject to risk assessment and security measures.

Where an operation constitutes a transfer outside the European Economic Area, Annota AI verifies the documented instructions and the applicable basis under Chapter V GDPR before the transfer: an adequacy decision or appropriate safeguards, including, where applicable, Standard Contractual Clauses, together with a transfer assessment and any necessary supplementary measures. Reliance on the Data Privacy Framework requires the recipient and processing to fall within its actual scope. This agreement does not replace those safeguards or extend one provider’s safeguards to access by other parties.

Annota AI keeps information on recipients, countries, and safeguards up to date and makes it available to the Customer on request, subject to limitations strictly necessary to protect others’ data and confidential information. If it cannot ensure the lawfulness of access or a transfer, it does not enable it or suspends it.

6. Assistance and personal data breaches

Taking into account the nature of the processing and the information available, Annota AI assists the Customer in responding to data subjects and meeting security, impact assessment, and prior consultation obligations. It forwards requests it receives concerning the Customer’s data without undue delay and does not respond independently, except on instructions or where required by law.

Annota AI notifies the contact in Annex A of a personal data breach without undue delay after becoming aware of it. The initial notice includes the information available on the nature of the incident, the categories and approximate numbers of data subjects and records affected, likely consequences, measures taken or proposed, and a contact for updates. Missing information is provided in phases, without delaying the notice.

Annota AI contains the incident, preserves the necessary evidence, and cooperates with the Customer. Decisions on notifying the supervisory authority and data subjects rest with the controller, without prejudice to independent statutory obligations. Annota AI’s contact for incidents and requests relating to this agreement is team@annota.ai.

7. Information, verification, and audits

Annota AI makes available the information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or an appointed auditor. Checks are coordinated with reasonable notice, confidentiality, and protection of other customers’ data. Urgency, incidents, and requests from authorities may require different timeframes. Any agreed arrangements or costs must not prevent the exercise of statutory verification rights.

8. Return, deletion, and termination

At the end of the service, at the Customer’s choice, Annota AI returns or deletes personal data and deletes copies, unless Union or national law requires retention. Formats, channels, export windows, and deletion periods and criteria, including those for backups, are defined in Annex D. Data retained to comply with a legal obligation is isolated and processed solely for that purpose.

Backups awaiting expiry are not used for ordinary activities. If a backup is restored, deletion instructions are reapplied. Annota AI confirms completion of deletion on request. Disabling the Account alone does not constitute deletion.

If either party cannot comply with this agreement, it informs the other. The parties take the necessary measures, including suspension of the affected processing or termination where compliance cannot be restored, and apply the provisions on return or deletion.

Annex A - Description of processing

The Customer is the person or organization identified in the signed order or acceptance record, which must state the business name or name, registered office or address, tax identifier where applicable, relevant Service organization, and privacy role. If the Customer acts for other controllers, it communicates their identities and relevant instructions before processing.

The same record identifies the authorized representative and the email address of the contact for privacy, incidents, and subprocessor changes. The Customer keeps that address up to date. Organization owners and administrators may issue instructions within the Customer’s delegated authority; members act within their assigned permissions. Annota AI’s contact is team@annota.ai.

Private installations, in the cloud, at the Customer’s premises, or in isolated environments, require an annex to the order identifying infrastructure, locations, Annota AI’s access, providers actually involved, and responsibilities for security, updates, backups, incidents, and data deletion. Shared-cloud characteristics do not automatically apply to these installations. If Annota AI neither has access to the data nor processes it on the Customer’s behalf, any scope of this agreement is limited to the operations actually entrusted to it, such as support involving personal data.

Annex B - Technical and organizational measures

For the cloud service managed by Annota AI:

• Access and customer separation. Authentication managed by Annota AI, permissions associated with the organization and checked by the service for protected resources; owner, administrator, and member roles. Sessions and authorizations can be revoked. Isolation is logical and does not imply dedicated infrastructure for each Customer.
• Communications and storage. Public access over HTTPS, with at least TLS 1.2 for platform domains; protected connection to the origin. Primary compute, database, storage, and backups in France. File and backup buckets use AES-256 server-side encryption. This description does not promise end-to-end encryption of content.
• Credentials and privileges. Application secrets kept separate from code, dedicated service roles, and data access limited to operational needs. Administrative access is individually authorized and reviewed when duties change and relationships end.
• Remote work. Prior authorization based on country, role, and accessible data; protected and updated devices, encrypted connections, and no unnecessary local copies. Any authorized copies are protected and removed when the activity ends. External providers that process data also follow the procedure in section 5.
• Backups and restoration. Daily PostgreSQL database backups and continuous archiving of data required for restoration, on storage in France, with a configured 30-day recovery window. Database restoration has been tested. There is no separate file backup: storage resilience does not guarantee recovery of a deleted or altered file. No guaranteed restoration time or maximum data loss is agreed, except under a specific service agreement.
• Deletion. Removal of the Customer’s resources and queuing of object deletion, including existing versions; retries on failure. Generated exports expire. Backups are subject to expiry and deletions must be reapplied after any restoration.
• Operational management. System updates, assessment of relevant vulnerabilities, incident handling, and periodic verification of the effectiveness of measures and restoration capability. Annota AI retains evidence of checks performed and makes the necessary information available pursuant to section 7.
• Support and minimization. Support by email. Resource identifiers, descriptions, and examples without personal data are preferred; documents or other content are requested only where necessary for investigation. Attachments received are subject to the Customer’s instructions and the deletion rules in Annex D.

For private installations, measures are allocated as set out in the order; Annota AI remains responsible for the activities and access entrusted to it.

Annex C - Cloud service subprocessors

The table concerns processing entrusted on the Customer’s behalf. It does not extend the subprocessor role to providers’ independent activities, such as those necessary to meet their own legal obligations.

References: Scaleway DPA, Cloudflare DPA, Mailjet/Sinch DPA, Google Workspace DPA. Annota AI retains the applicable information on subprocessor chains, locations, and safeguards and makes it available pursuant to section 5; merely referring to providers’ websites does not replace the Customer information and objection procedure.

Contractors subject to Annota AI’s direct authority follow the rules for authorized personnel. Any freelancers or external companies classified as subprocessors are identified and authorized before data is entrusted to them, including their activities, country, and safeguards; they are not authorized as an undifferentiated category by this list.

Stripe, optional Google or GitHub sign-in, and the website’s public forms are described in the Privacy Notice for their respective processing. Google Workspace support is a separate activity from Google sign-in. Private installations use only the providers and flows identified in the order.

Annex D - Return and deletion

D.1 Instructions and return

The Customer issues instructions through the Service’s features or by writing to team@annota.ai from the authorized address. Annota AI verifies the requester’s authority. Exports are provided through the authenticated area or another agreed protected channel, using the formats available for the resource, including COCO for annotations and archives of documents and results. The agreed delivery includes the personal data covered by the request, including where assistance is needed for data not included in ordinary exports.

Upon termination without a request for immediate deletion, the Customer has a window of up to 30 days to obtain the return of data; Annota AI assists the Customer if ordinary export is unavailable. Content is subsequently removed from active systems within 90 days after termination, unless a shorter period is agreed or legal obligations apply. Any return is followed by deletion of copies in accordance with this annex.

Explicit deletion of a dataset or organization may make data immediately and irreversibly unavailable: a subsequent export window does not automatically apply. Suspension of an organization following closure of its sole owner’s Account results in deletion being scheduled after 30 days, as described in the Terms.

D.2 Copies and systems involved

Administrative correspondence, evidence of instructions, and security events processed by Annota AI for its own purposes are governed by the Privacy Notice. That distinction does not authorize retention of entire Customer documents or datasets solely because they were attached to an email. Copies retained to comply with a legal obligation are limited to what is necessary, isolated, and deleted when the obligation ends.

In the event of restoration, Annota AI reapplies deletions before making restored data available for ordinary use. On request, it confirms completed operations and identifies any residual copies, their expiry, and the reason for retention.