Data processing addendum

What this is

When SDEN builds or runs software for you and that work involves personal data about your people or your users, you are the controller and we are the processor. This addendum sets out the terms of that processing under Article 28 of the GDPR and its UK equivalent.

It is published here so your legal and security teams can read it before an engagement starts. It becomes binding when it is signed alongside the services agreement, or when we countersign your own data processing agreement instead. If you want a signed copy, write to info@sden.ai.

It does not apply to the personal data we hold as a controller in our own right, such as your contact details as an enquirer or a customer. Our privacy policy covers that.

Scope and instructions

We process personal data only on your documented instructions, including on transfers, unless the law requires otherwise, in which case we tell you before processing unless the law forbids us from doing so.

The categories of data subjects, the categories of personal data, the purposes and the duration are set out in the engagement's statement of work, which forms Annex A of this addendum. If you tell us an instruction infringes data protection law, we will say so.

We do not use your personal data for our own purposes, we do not sell it, and we do not use it to train models.

People and confidentiality

Everyone we authorise to process your personal data is bound by confidentiality obligations that survive the engagement, and accesses the data strictly on a need-to-know basis.

Security

We apply technical and organisational measures appropriate to the risk: encryption in transit, encryption at rest by the platforms holding the data, named accounts with least privilege, single sign-on that fails closed on internal systems, segregation of client environments, and no production personal data on developer machines beyond what the engagement strictly requires.

Our security page describes the controls we have in place and, deliberately, the ones we do not. Read it alongside this addendum rather than assuming a control exists.

Sub-processors

You give general authorisation for the sub-processors we publish on our sub-processor page, which is the current register referred to as Annex B of this addendum.

We tell you before adding or replacing a sub-processor that will process your data, and you have 15 days to object on reasonable data-protection grounds. If we cannot resolve an objection, you may terminate the affected part of the engagement without penalty for the unperformed portion.

We impose data-protection obligations on each sub-processor no less protective than this addendum, and we remain liable to you for what they do.

Artificial intelligence

Where an engagement uses AI models, model inputs and outputs containing your personal data are treated as your data under the services agreement.

We will agree in the statement of work which providers may be used and on what terms, including whether a zero-retention or no-training arrangement is required. Do not assume a provider default: ask, and we will write the answer into the engagement.

Where an engagement involves evaluation datasets containing personal data, they are minimised, pseudonymised where that is workable, and deleted at the end of the engagement.

Helping you meet your obligations

Taking into account the nature of the processing, we assist you in responding to requests from data subjects, and in meeting your own obligations on security, breach notification, impact assessments and prior consultation.

Where a data subject contacts us directly about data we process for you, we forward the request to you and do not respond on the substance unless you ask us to.

Personal data breaches

We notify you without undue delay after becoming aware of a breach affecting your personal data, and in any event within 48 hours, with the information reasonably available to us so you can meet your own notification deadlines. We follow up as we learn more rather than waiting for a complete picture.

International transfers

SDEN is in the United States. Where processing involves transferring personal data subject to the GDPR outside the EEA, the European Commission's Standard Contractual Clauses, module two, controller to processor, are incorporated into this addendum by reference, completed by Annex A for the details and by the security section above for the measures. The UK addendum and the Swiss amendments apply where relevant.

We do not currently offer region-locked storage on our own infrastructure. If your engagement requires data to stay in a jurisdiction, tell us before it starts, because it changes the architecture rather than a setting.

Return and deletion

At the end of the engagement, at your choice, we return or delete the personal data we processed for you, and confirm when it is done.

Copies held in routine backups are deleted on the normal backup cycle, in practice within 30 days, and stay covered by this addendum until then. We will tell you honestly what remains and for how long rather than claiming an instant erase we cannot perform.

Audits

We make available the information reasonably needed to show we comply with this addendum, and allow an audit once a year on 30 days' notice, conducted so as not to disrupt our operations and subject to confidentiality. You may also commission a penetration test of software we built for you: agree the scope with us and we will support it.

We do not hold a SOC 2 report or an ISO 27001 certificate, so we cannot answer an audit request by sending one.

How to put this in place

Write to info@sden.ai. We will send this addendum for signature alongside the engagement, or review and countersign yours.

SDEN AI LLC, 254 Chapman Rd, Ste 208 #28196, Newark, DE 19702, United States.