Data Processing Agreement

1. Purpose & scope

This Data Processing Agreement ("DPA") forms part of the agreement between Sentiqra ("Sentiqra", "Processor") and the customer ("Controller") for the Sentiqra semantic-analysis API. It governs Sentiqra's processing of personal data on the Controller's behalf under GDPR Article 28.

This DPA applies to every customer relationship in which Sentiqra acts as a processor - on any plan, with no separate signature required. Acceptance of the applicable version is recorded at signup; a countersigned copy for procurement is available on request (§12).

2. Subject matter & duration

Sentiqra processes text submitted to the API solely to return structured semantic signals. Processing continues for the duration of the service agreement. Submitted content is processed in memory and is not persisted.

3. Nature & purpose of processing

• Semantic classification of submitted text against documented taxonomies
• Return of detection labels, signal-match scores, and configuration identifiers
• Transient in-memory processing only - no persistent storage of submitted content

4. Categories of data & data subjects

Data subjects and categories are determined by the Controller's use case. Sentiqra does not require submission of special-category data and does not build profiles of individuals.

5. Processor obligations

• Process personal data only on documented instructions from the Controller
• Ensure persons authorized to process data are bound by confidentiality
• Implement the technical and organizational measures described in Security Practices
• Assist the Controller with data-subject requests, breach notification, and DPIAs
• Not use submitted content to train detection models

6. Subprocessors

The Controller authorizes the subprocessors listed on the Subprocessors page. Sentiqra provides at least 30 days' notice before adding or replacing a subprocessor, via email to the primary account contact. The Controller may object on reasonable data-protection grounds within that window.

7. International transfers

Transfers of personal data outside the EU/EEA rely on Standard Contractual Clauses (2021/914) or an applicable adequacy decision. UK transfers are covered by the UK Addendum to the EU SCCs or the International Data Transfer Agreement (IDTA) as applicable - the EU SCCs alone are not relied on for UK transfers. A copy of the executed transfer documents is available on request.

8. Audit rights

The Controller may audit Sentiqra's compliance once per year (or following a confirmed personal-data breach) via questionnaire or, where required, an independent audit at the Controller's expense, on reasonable notice and subject to confidentiality.

9. Personal-data breach notification

Sentiqra will notify the Controller without undue delay after becoming aware of a personal-data breach affecting processing performed on the Controller's behalf, providing the information required by GDPR Article 33(3). Further information will be provided as it becomes available. Sentiqra's internal target is a preliminary notice within 24 hours of confirmed awareness - an operational commitment to support the Controller's own notification duties, not a permission to wait. See the Incident Communication Policy.

10. Return & deletion on termination

On termination, Sentiqra deletes or returns personal data within 30 days and deletes residual backups within 90 days, unless law requires retention. The legal-retention exception applies to billing and financial records kept under statutory accounting obligations and to data subject to a legal hold - those records are no longer processed for service purposes and are deleted when the obligation ends. A deletion certificate is available on request.

11. Liability & precedence

Liability under this DPA is subject to the limitation-of-liability terms of the master agreement. If this DPA conflicts with the master agreement, this DPA controls for data-protection matters.

12. Countersignature & questions

No signature is needed for this DPA to apply - acceptance is recorded at signup. Customers whose procurement process requires a countersigned copy can request one at legal@sentiqra.tech (DocuSign routing available).