Legal
Data Processing Agreement
Last updated: July 2026
This DPA applies when Privacy Just processes personal data on your behalf as a processor under Art. 28 GDPR. Enterprise customers can request a signed copy.
Subject matter
Provision of the Privacy Just platform (AI chat, document tooling, employee training) to the Customer.
Duration
For the term of the subscription and any wind-down period agreed in the main agreement.
Nature and purpose
Hosting, processing and returning Customer prompts, documents and training inputs to generate outputs.
Categories of data
Whatever the Customer inputs — typically business contact data and the content of privacy documentation. Customers should not upload special-category data unless necessary.
Data subjects
Customer's employees, contractors and (indirectly) third parties referenced in uploaded documents.
Sub-processors
Model providers, cloud hosting, error monitoring, payment processing. Full list available on request; 30 days' notice of material changes.
Security
Encryption in transit and at rest, role-based access, least-privilege service accounts, audit logging, annual penetration testing.
International transfers
SCCs (EU 2021/914) and UK IDTA where applicable. Transfer Impact Assessments available on request.
Assistance
We assist Customer with DSARs, DPIAs and breach notification within the timeframes required by GDPR.