You decide, we process on your behalf.

What it contains

The agreement covers at least the subjects that Article 28(3) GDPR prescribes. Specifically:

• the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects;
• processing only on your documented instructions, including with regard to transfers;
• confidentiality for everyone who has access to the data;
• the security measures of Article 32 GDPR — which measures these are is set out on the security page;
• sub-processors only with your authorisation, with the same obligations passed on, and changes notified in advance so that you can object (Article 28(2) and (4) GDPR) — see the overview of sub-processors;
• assistance with requests from data subjects: access, rectification, erasure, restriction and objection;
• assistance with security, with notifying personal data breaches, with a DPIA (data protection impact assessment) and with a prior consultation (Articles 32 to 36 GDPR);
• notification of a personal data breach to you without undue delay, with the information you need to be able to notify the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, within 72 hours (Article 33 GDPR); the exact period is set out in the agreement;
• deletion or return of the data afterwards, at your choice;
• information and cooperation with audits to demonstrate compliance.

What we do not do

• we do not use your documents for our own purposes;
• we do not use them to train AI models;
• we do not sell or rent them and do not give them to third parties, except to the sub-processors named.

What falls outside the agreement

If you connect an AI assistant to PrivaSearch via the MCP connection, the provider of that assistant is not our sub-processor but a processor of your own organisation. Conclude a data processing agreement with that provider yourself, use a business account and assess whether that provider processes data outside the European Economic Area. The same applies to your SharePoint environment: it remains yours, with your own agreement with Microsoft. PrivaSearch only reads from it.