Purpose
This summary describes how ActBI processes personal data on behalf of customers as a processor under Art. 28 GDPR. The full, signable DPA is provided during procurement or on request at privacy@actbi.ai.
Roles and instructions
For platform data, the customer is the controller and ActBI the processor. We process personal data only on documented instructions, including with regard to international transfers, unless required by law.
Sub-processors
We use vetted sub-processors for hosting, email delivery, and support tooling, each bound by equivalent contractual obligations. A current list is available on request, and customers are notified of intended changes with an objection right.
Security measures
Technical and organizational measures include encryption in transit and at rest, least-privilege access with SSO and audit logging, environment isolation, and documented incident response with notification without undue delay.
Transfers, audits and deletion
International transfers rely on adequacy decisions or Standard Contractual Clauses. Customers may audit compliance subject to reasonable notice. Upon termination, personal data is deleted or returned, except where retention is legally required.
Draft for review — this document is a template and not legal advice. Have it reviewed by counsel before production use.