This Data Processing Agreement ("DPA") forms part of the Terms of Service between Spiral Hydrogen OÜ, registry code 16896381, Õismäe tee 44-44, 13512 Tallinn, Estonia ("Processor", "we") and the customer organisation accepting those terms ("Controller", "you"). It applies where we process personal data on your behalf, and it gives effect to Article 28 of Regulation (EU) 2016/679 (GDPR). Where this DPA conflicts with the Terms of Service, this DPA prevails for matters of personal-data processing.
You are the controller of the personal data contained in the content your users put into SpiralSim. We are your processor for that content. For account and authentication data that we need in order to run the Service at all, and for security and abuse prevention, we act as an independent controller; that processing is described in our Privacy Policy.
| Subject matter | Provision of the SpiralSim simulation platform |
|---|---|
| Duration | For as long as your organisation has an account, plus the deletion periods in section 8 |
| Nature and purpose | Hosting, storing, transmitting, compiling, simulating and displaying content; generating AI responses on your users' instruction; sending service emails |
| Types of personal data | Email addresses and display names of your users; any personal data your users choose to include in models, chat messages or attachments |
| Categories of data subject | Your personnel and any other individuals whose data your users include in content |
| Special categories | None. The Service is not intended for special-category data and you must not submit it. |
You warrant that you have a lawful basis for the personal data you put into the Service, that you have given any notices and obtained any consents required, and that your instructions to us comply with data protection law. You are responsible for what your users choose to submit — including into the AI features, where content is sent to the sub-processors listed in section 5.
You give general written authorisation for us to engage sub-processors. Those currently engaged are listed in section 5 of the Privacy Policy. We impose data-protection obligations on each sub-processor no less protective than those in this DPA, and we remain fully liable to you for their performance.
We will give at least 30 days' notice before adding or replacing a sub-processor. If you reasonably object on data-protection grounds within that period, you may terminate the Service for the affected processing without penalty; that is your exclusive remedy.
Taking account of the state of the art, costs, and the nature, scope, context and purposes of processing as well as the risks, we implement measures appropriate to that risk, including: encryption in transit; storage on encrypted volumes in the European Union; access control limited to personnel who need it; isolation of each customer's data; execution of submitted code in a hardened, network-isolated sandbox; logging and monitoring; and regular backups.
On reasonable written request, no more than once in any twelve-month period unless required by a supervisory authority, we will provide the information reasonably necessary to demonstrate compliance with this DPA. Where that is genuinely insufficient, you may audit us, or appoint an independent auditor who is not our competitor and who is bound by confidentiality, on at least 30 days' notice, during business hours, without unreasonably disrupting our operations, and at your cost.
You can delete content at any time in the Service. On termination, we delete your organisation's personal data within 30 days, except where EU or member-state law requires us to keep it. Backups are overwritten on a rolling cycle of up to 14 days. On written request before deletion, we will return your content in a commonly used machine-readable format.
We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your personal data, with the information reasonably available to us, and we assist you with your obligations under Articles 33 and 34.
Where personal data is transferred outside the European Economic Area — currently to the United States for the providers identified in the Privacy Policy — the transfer is made under an adequacy decision where one applies, or otherwise under the European Commission's Standard Contractual Clauses, together with any supplementary measures required. You mandate us to enter into those clauses with sub-processors on your behalf.
Liability under this DPA is subject to the limitations in the Terms of Service, to the extent permitted by law. This DPA takes effect when you accept the Terms of Service and continues while we process personal data on your behalf.
Spiral Hydrogen OÜ — [email protected]