Data Processing Addendum

1. Scope and roles

• • Under the EU and UK GDPR, the Customer is the Controller and Algoshred is the Processor of Customer Personal Data.
• • Under India's Digital Personal Data Protection Act, 2023, the Customer is the Data Fiduciary and Algoshred is the Data Processor.
• • Under the CCPA/CPRA, where applicable, the Customer is the Business and Algoshred is a Service Provider. Algoshred does not sell or share Customer Personal Data and does not combine it with data from other sources except as needed to provide the service.
• • Algoshred processes Customer Personal Data only on the Customer's documented instructions: the Terms, this DPA, any Order Form, and the Customer's own configuration of the Platform, including the sources it connects, the models it defines, and the queries its users run. Algoshred will tell the Customer if it believes an instruction breaks data protection law.
• • Algoshred is an independent controller only for the account, billing, and website information described in our Privacy Policy.

2. Definitions

• • Customer Personal Data — personal data within Customer Data, as defined in the Terms, that Algoshred processes on the Customer's behalf.
• • Semantic Model — has the meaning given in the Terms and includes ontologies, vocabularies, mappings, and knowledge-graph content.
• • Personal Data Breach — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• • Subprocessor — any third party, including an Algoshred affiliate, engaged by Algoshred to process Customer Personal Data.
• • SCCs — the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914.

3. Processing details (Annex 1)

4. Semantic and federated data

SemanticFed queries data where it lives instead of collecting it. These terms apply to the kinds of data that are specific to a semantic layer:

5. Algoshred obligations

• • Ensure that everyone authorised to process Customer Personal Data is bound by confidentiality obligations.
• • Maintain the security measures in Annex 2 (section 6 below).
• • Help the Customer answer data-subject and data-principal requests, including locating and deleting statements about an individual inside Semantic Models and query history.
• • Help the Customer with data protection impact assessments and consultations with regulators, taking into account the information available to Algoshred.
• • Notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of a Personal Data Breach affecting Customer Personal Data, with the information the Customer needs to meet its own notification duties.
• • Not use Customer Personal Data, Semantic Models, or query results to train, fine-tune, or evaluate machine-learning models, and not build profiles of individuals from them.
• • Make available the information reasonably needed to demonstrate compliance with this DPA.

6. Security measures (Annex 2)

• • Encryption in transit with TLS, including connections to databases, and encryption at rest for databases, backups, and object storage using AWS Key Management Service keys.
• • Source credentials held in a dedicated secrets store and referenced by the application, never stored in the application database.
• • Workspace isolation for all Customer Data, with role-based access control enforced at the API gateway on every request.
• • Customer-configurable row, column, and entity access policies applied at query time.
• • Audit records of query runs and administrative actions, available to the Customer.
• • Automated vulnerability scanning of code, dependencies, and container images before every release.
• • Least-privilege, logged access to production systems for Algoshred personnel, who are bound by confidentiality obligations.
• • Rolling encrypted backups that expire within 7 days, and infrastructure defined as code and reviewed before it is applied.

Our Security page states which third-party certifications we hold and which are still in progress.

7. Customer obligations

• • Have a lawful basis, and give any notices required, for the personal data it connects, queries, or places in Semantic Models.
• • Connect sources with least-privilege credentials and configure access policies and masking that match its obligations.
• • Avoid placing personal data in model names, descriptions, or vocabularies where it is not needed.
• • Not instruct Algoshred to process personal data in breach of the law.

8. Subprocessors (Annex 3)

• • The Customer gives general authorisation for the Subprocessors listed on our Subprocessors page, which forms Annex 3 of this DPA.
• • Algoshred imposes data protection terms on each Subprocessor that are no less protective than this DPA and remains responsible for its Subprocessors.
• • Algoshred gives at least 30 days' notice of a new or replacement Subprocessor by updating that page and emailing the Customer's billing or privacy contact. The Customer may object on reasonable data protection grounds within 14 days; if the parties cannot resolve the objection, the Customer may terminate the affected service and receive a pro-rata refund of prepaid, unused fees.
• • AI inference providers are engaged only when the Customer turns on an AI-assisted feature (such as natural-language querying or mapping suggestions). They are added to the Subprocessors page before use, receive only the query text, schema, and prompt data that feature needs, and are used on terms that prohibit training on Customer Data.

9. Data location and international transfers

• • The Platform, including Semantic Models, query history, and any cached results, is hosted on Amazon Web Services in the Mumbai, India region (ap-south-1).
• • Federated queries read source data wherever the Customer hosts it and return results to the requesting user. Algoshred does not relocate source data to another region for storage, so the Customer keeps control of where its source data resides.
• • For transfers of personal data from the EEA, the SCCs (Module 2, controller-to-processor, and Module 3, processor-to-processor where applicable) are incorporated by reference, with Option 2 of Clause 9 (general authorisation), Clause 17 governed by Irish law, and Clause 18 disputes before the courts of Ireland. For the UK, the International Data Transfer Addendum issued by the UK Information Commissioner is incorporated. For Switzerland, the SCCs apply with the Swiss FDPIC as competent authority.
• • Transfers out of India follow section 16 of the DPDP Act and any restrictions notified under it.

10. Retention, return, and deletion

• • During the subscription, Customer Personal Data is kept according to the retention schedule in our Privacy Policy, and the Customer can delete models, queries, and connections at any time.
• • After termination, the Customer has 30 days to retrieve its Semantic Models and other content. Algoshred then deletes Customer Personal Data from active systems within a further 30 days, and it leaves backups when they expire within 7 days after that, unless the law requires it to be kept.
• • Algoshred confirms deletion in writing on request.

11. Audits

• • On request, Algoshred provides its current security documentation, answers to a reasonable security questionnaire, and any third-party audit reports it holds.
• • If those materials are not enough to show compliance, the Customer may, once a year (or after a Personal Data Breach or at a regulator's request), have an independent auditor bound by confidentiality carry out an audit at the Customer's cost, with 30 days' written notice and during business hours.

12. Liability, term, and precedence

• • The limitations of liability in the Terms apply to this DPA, except where the law imposes liability that cannot be limited.
• • This DPA lasts for as long as Algoshred processes Customer Personal Data.
• • If this DPA conflicts with the SCCs or the UK Addendum, those clauses prevail for the transfers they cover.

Contact

For questions about this DPA, subprocessor notices, or international transfers, contact our privacy team: