Data Processing Addendum

01Scope and roles

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Anvilfy Ltd ("Processor", "we") and the business customer ("Controller", "you"). It applies to personal data that we process on your behalf in providing the Service ("Customer Personal Data"). Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the UK GDPR and, where applicable, the EU GDPR (together, "Data Protection Law").

You are the controller of Customer Personal Data and we are your processor. Where you are yourself a processor acting for your own client (for example as an agency), we are your sub-processor and you confirm you have your client's authority to engage us.

This DPA does not cover personal data we process as a controller, such as your account and billing data, which is described in our Privacy Policy.

02Details of the processing

03Our obligations

We will:

• process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and your use and configuration of the Service, unless the law requires otherwise, in which case we will tell you first unless the law prohibits it;
• tell you if we believe an instruction breaks Data Protection Law;
• ensure that people authorised to process Customer Personal Data are bound by confidentiality;
• implement the technical and organisational measures in section 4 and Annex II;
• not use Customer Personal Data to train third-party AI models or for our own purposes other than providing, securing and improving the Service with de-identified data.

You are responsible for having a lawful basis to submit Customer Personal Data to us and for giving any notices to data subjects that the law requires.

04Security

Taking into account the state of the art, costs and the risks to data subjects, we maintain measures appropriate to the risk, including:

• encryption of data in transit (TLS) and at rest by our hosting providers; encryption of stored third-party access tokens;
• logical separation of customer data and row-level access control in our database;
• access to production systems limited to authorised personnel, with strong authentication;
• optional two-factor authentication for user accounts, rate limiting and abuse controls;
• restrictions that prevent the capture service from reaching private networks;
• backups, logging and monitoring, and a documented process for handling incidents.

05Sub-processors

You give us general authorisation to engage the sub-processors listed on our Sub-processors page. We impose data protection obligations on each sub-processor that are no less protective than this DPA and remain responsible for their performance.

We will update that page at least 14 days before a new sub-processor starts processing Customer Personal Data. You may object on reasonable data protection grounds by writing to hello@eyecaptain.io within that period. We will then try to find a reasonable alternative; if we cannot, either of us may terminate the affected part of the Service, and we will refund prepaid fees for the unused period.

06International transfers

The Processor is established in the United Kingdom, which benefits from an EU adequacy decision, so transfers of Customer Personal Data from the EEA to us do not need further safeguards while that decision is in force.

Where we or our sub-processors transfer Customer Personal Data outside the UK or the EEA to a country without an adequacy decision or UK adequacy regulations, the transfer is made under an appropriate safeguard: the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 2 where you are a controller, Module 3 where you are a processor) and, for UK data, the International Data Transfer Addendum issued by the UK Information Commissioner, or a certification such as the EU-US Data Privacy Framework and its UK Extension.

Where the Standard Contractual Clauses apply between you and us, they are incorporated by reference with these choices: clause 7 (docking) applies; option 2 (general written authorisation) applies in clause 9, with the notice period in section 5; the optional wording in clause 11 does not apply; clauses 17 and 18 select the law and courts of Ireland; Annexes I to III are the annexes to this DPA. For the UK Addendum, Table 4 allows either party to end it as set out in its Section 19.

07Assistance and data subject requests

Taking into account the nature of the processing, we will assist you with appropriate measures to respond to requests from data subjects, and with security, breach notification, data protection impact assessments and prior consultation with supervisory authorities. If we receive a request directly from a data subject about Customer Personal Data, we will pass it to you and not respond ourselves unless you ask us to or the law requires it. You can delete projects and reports yourself in the Service.

08Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will give you the information you reasonably need to meet your own obligations, as it becomes available, and take reasonable steps to contain and remedy the breach.

09Deletion and return

You can export reports at any time while your account is active. When the Terms end, or earlier if you delete the relevant projects, we delete Customer Personal Data within 30 days from our live systems and within a further 90 days from backups, unless the law requires us to keep it.

10Information and audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including by answering reasonable security questionnaires. If that is not enough, you may carry out an audit, at your cost, no more than once a year, on at least 30 days' written notice, during business hours and subject to confidentiality, or appoint an independent auditor to do so. Audits must not compromise the security or confidentiality of other customers' data.

11Liability and precedence

Each party's liability under this DPA is subject to the exclusions and the single limit in the Terms, which cover this DPA and the Terms together, except where Data Protection Law does not allow them. Each party bears the fines that a regulator imposes on it. Nothing in this DPA limits a right that an individual has under Data Protection Law over their own personal data. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.

This DPA is governed by the law that governs the Terms. Questions: hello@eyecaptain.io.

12Annex I: Parties and description of the processing

13Annex II: Technical and organisational measures

The measures described in section 4 (Security), together with: role-based access to customer data inside a workspace; deletion tools for projects and reports; secrets held in a managed secret store and never in source code; dependency and database security reviews; restriction of AI providers to those that do not use inputs to train their models; and assistance to the controller as described in section 7.

14Annex III: Sub-processors

The sub-processors authorised at the date of this DPA are those listed on our Sub-processors page, with their purpose, the data they process and their location. Changes follow section 5.

15Execution

This DPA takes effect when the customer accepts the Terms of Service, without signature. Where a signed copy is requested, it is executed by the customer and countersigned by an authorised signatory of Anvilfy Ltd; the signed copy does not change the terms above.