Data Processing Addendum
Last updated 26 August 2026
Optional for individual self-serve users; required the moment a business customer or any EU/UK data subject is involved. Contact legal@theconcaveai.com for a countersigned copy.
1. Roles
Customer is the Data Controller. Concave AI is the Data Processor. Where Customer is itself a processor, Concave AI is a sub-processor.
2. Scope
Concave AI processes personal data contained in Customer Data solely to provide the Services, in accordance with documented instructions.
3. Sub-processors
As listed in the Privacy Policy. 30 days' notice of changes; Customer may object and terminate without penalty.
4. Security measures
Encryption in transit (TLS) and at rest (AES-256). Credential encryption using envelope encryption with key management. Organisation-level logical isolation. Role-based access control. Access logging and audit trail. Automated backups. Vulnerability scanning.
5. Personnel
All personnel with data access are bound by confidentiality obligations.
6. Breach notification
Concave AI notifies Customer without undue delay and within 72 hours of becoming aware of a personal data breach, including nature, categories, likely consequences, and remedial measures.
7. Data subject rights
Concave AI assists Customer in responding to access, rectification, erasure, and portability requests.
8. Deletion
On termination, all Customer Data is deleted within 30 days. Certification of deletion available on request.
9. Audit
Customer may request evidence of compliance once per year. Concave AI provides documentation; on-site audit by prior arrangement.
10. International transfers
Where data is transferred outside the UK/EEA, EU Standard Contractual Clauses (2021/914) Module Two apply and are incorporated by reference. The UK International Data Transfer Addendum applies for UK transfers.
11. Liability
Subject to the limitations in the Terms of Service.
Annexes
Annex I — Categories of data subjects and personal data. Annex II — Technical and organisational security measures. Annex III — Sub-processor list. Attached to the countersigned copy on request.