Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Agreement between Thoth AZ Solutions S.R.L., Str. Piața Falezei nr. 6, demisol, camera 2, 800077 Galați, Romania, Trade Register J17/936/2022, CUI 46249620 ("SENA") and the customer identified in the Agreement ("Customer"). It is incorporated by reference into the Customer Terms of Service at sena.systems/terms (the "Terms"); a countersigned copy is available on request at legal@sena.systems and the signed version prevails over the online version of the same date. It reflects the parties' agreement on the processing of personal data under Regulation (EU) 2016/679 ("GDPR") and Romanian Law 190/2018.

1. Definitions

1.1 Terms defined in the GDPR have the same meaning here. "Service", "Organisation", "Users", "Customer Data", "Account Data", "AI Outputs", "Connected Systems", "Order Form" and "Agreement" have the meaning given in the Terms §1.

1.2 "Customer Personal Data" means personal data contained in Customer Data, including the names, email addresses, roles, invitations and activity of Customer's Users within the Organisation (the user directory), the Organisation's audit log, and error records that contain Customer Data.

1.3 "Sub-processor" means a third party engaged by SENA to process Customer Personal Data. "Security Incident" means a personal data breach as defined in GDPR art. 4(12) affecting Customer Personal Data.

2. Roles and scope

2.1 Customer is the controller and SENA is the processor of Customer Personal Data.

2.2 Customer as processor. Where Customer acts as processor for its own clients (for example an accounting firm, agency or managed-service provider), SENA is Customer's sub-processor, and: (a) Customer warrants that each client has authorised SENA as a sub-processor and that Customer's contract with the client contains terms no less protective than this DPA; (b) instructions, data-subject requests and breach notifications flow only between SENA and Customer, which is responsible for onward notification and has no direct relationship with SENA's other customers; (c) audit rights of Customer's clients are exercised through Customer under §11 and count towards its frequency limit; (d) Customer will give this DPA and the sub-processor list to its clients on request; and (e) Annex I is read as describing the processing Customer instructs on behalf of its clients, with "data subjects of Customer's clients" added to the categories of data subjects.

2.3 Account Data. SENA is an independent controller only for Account Data: authentication security data (login attempts, IP address at login and signup, device signals), abuse prevention, usage metering and billing, the identity and contact details of the contracting entity, Organisation admins and billing contacts, and SENA's own communications. Account Data is described in the Privacy Policy (sena.systems/privacy) and is outside this DPA. After deletion of Customer Personal Data, SENA retains the Organisation's audit log for the remainder of its 13-month retention as controller, for security and accountability, and then deletes it.

2.4 Details of the processing are in Annex I.

3. Customer's obligations

3.1 Lawfulness. Customer is responsible for the lawfulness of the processing it instructs, including having a valid legal basis, providing information to data subjects, and honouring data-subject rights.

3.2 Employee mailboxes, calendars and HR connectors. Before Customer or any of its Users connects a mailbox, calendar, attendance or HR system that reveals the activity of Customer's employees, Customer, as employer, will: (i) document that its legitimate interest is well founded and prevails over the employees' rights (a written balancing test); (ii) give employees complete, prior and explicit information; (iii) consult the trade union or, where there is none, the employee representatives, and obtain the agreement of a works council where national law requires it; (iv) record why less intrusive means were not effective; and (v) keep monitoring data visible outside the connecting User's private lane for no more than 30 days unless Customer has a documented justification or a legal provision allowing longer, as Law 190/2018 art. 5 requires. SENA sets a default of 30 days for mail and calendar metadata visible to the shared CRM and for individual attendance detail; a longer window chosen by Customer is Customer's documented instruction under §3.3, and Customer keeps its justification on file.

3.3 Instructions. Customer's instructions are: the Agreement, this DPA, the configuration Customer makes in the Service (modules enabled, Connected Systems linked, Users invited, retention windows chosen, actions approved), and any further documented instructions agreed in writing. SENA will immediately inform Customer if, in its opinion, an instruction infringes the GDPR or other EU or member-state data-protection law, and may suspend performance of that instruction until Customer confirms or amends it; SENA is not obliged to perform a legal review.

3.4 Special categories. Customer will not instruct SENA to process special categories of personal data (GDPR art. 9) or data relating to criminal convictions (art. 10) except where Customer is legally required to hold such data about its own employees and processes it in the Employees or Payroll modules, in which case Customer confirms it has the required legal basis under art. 9(2)(b) and Law 190/2018. The parties acknowledge that such data may appear incidentally in mail, calendar, chat and document content that Customer's Users connect or upload and that SENA cannot filter it out. SENA does not target, classify, extract, infer or index such data as a category, does not use it to characterise a person, and will delete it on Customer's instruction; the measures in Annex II apply to it equally. Customer remains responsible for the lawfulness of holding it, will configure retention windows and access roles accordingly, and will not connect sources whose primary content is special-category data (for example a patient or clinical mailbox). Research features are limited to professional-role information and do not report health, political, religious, trade-union, sexual-orientation or criminal-record information about individuals even where it appears in public sources.

3.5 National identification numbers. Where Customer processes national identification numbers (CNP, identity-card series and number, passport, driving-licence or health-insurance numbers) or documents containing them in the Service, Customer confirms that it does so under GDPR art. 6(1)(b) or (c) or, where it relies on legitimate interest, that it has put in place the safeguards of Law 190/2018 art. 4(2): minimisation and security measures, a data protection officer, defined deletion terms and periodic staff training. SENA does not search for, extract or display national identification numbers outside the record they belong to.

3.6 Research and correspondents. Where Customer uses research features or connects mailboxes, Customer is the controller of the personal data about third parties that SENA collects from public sources or receives in correspondence. Customer will either inform those persons under GDPR art. 14, at the latest at its first contact with them, or document why doing so is impossible or disproportionate (art. 14(5)(b)) and publish a notice describing the processing. SENA supports this by: (i) limiting research briefs to professional-role information and excluding special-category data; (ii) publishing a public description of the research feature at sena.systems/ai that Customer may reference; and (iii) providing a removal path: any person can write to privacy@sena.systems, SENA will forward the request to Customer the same business day and, on Customer's instruction, delete that person's entries.

4. SENA's obligations (GDPR art. 28(3))

SENA will:

(a) process Customer Personal Data only on documented instructions from Customer, including with regard to transfers to a third country, unless required to do so by EU or member-state law, in which case SENA will inform Customer before processing unless the law prohibits it;

(b) ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations (contractual or statutory) and have received data-protection training;

(c) implement the technical and organisational measures in Annex II and maintain them at a level that is no less protective during the term;

(d) respect the conditions in §6 for engaging Sub-processors;

(e) taking into account the nature of the processing, assist Customer by appropriate technical and organisational measures, insofar as possible, in responding to data-subject requests (see §7);

(f) assist Customer in ensuring compliance with GDPR art. 32 to 36 (security, breach notification, data protection impact assessments, prior consultation), taking into account the nature of the processing and the information available to SENA (see §8 and §9);

(g) at Customer's choice, delete or return all Customer Personal Data at the end of the provision of services, and delete existing copies, unless EU or member-state law requires storage (see §10);

(h) make available to Customer all information necessary to demonstrate compliance with art. 28 and allow for and contribute to audits (see §11);

(i) not sell Customer Personal Data, not use it for its own purposes, including to train, fine-tune, evaluate or improve machine-learning models or prompts for use outside Customer's Organisation, and not permit any Sub-processor to do so; access by SENA personnel is limited to the cases in §5.3;

(j) cooperate, on request, with the competent supervisory authority in the performance of its tasks (art. 31).

5. Security

5.1 SENA implements and maintains the measures in Annex II, appropriate to the risk, including pseudonymisation and encryption where appropriate, the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems, the ability to restore availability and access in a timely manner after an incident, and a process for regularly testing and evaluating the effectiveness of the measures.

5.2 SENA may update Annex II provided the overall level of security is not reduced.

5.3 Personnel access. SENA personnel do not access Customer Personal Data in the ordinary course. Access is limited to the cases in the Terms §6.3 (support requested by Customer, security or abuse investigation, failure affecting Customer's Organisation, legal obligation, written instruction), is granted to named engineers only for the duration needed, uses personal credentials, and is logged. Prompt and response traces of AI interactions are retained for up to 30 days in SENA's own infrastructure for debugging and are accessible only to those engineers. Contents of mirrored mailboxes and calendars are not accessed by SENA personnel except at the written request of the connecting User or of Customer for a security investigation.

6. Sub-processors

6.1 Customer gives general written authorisation for SENA to engage the Sub-processors listed in Annex III and published at sena.systems/subprocessors.

6.2 SENA will notify Customer of any intended addition or replacement of a Sub-processor at least 30 days before the Sub-processor starts processing Customer Personal Data, by email to Organisation admins and by updating the published list. Customer may object on reasonable data-protection grounds within 14 days of the notice. If the parties cannot resolve the objection in good faith within 30 days, Customer may terminate the affected part of the Service with a pro-rata refund of prepaid fees for the unused period, as its sole remedy.

6.3 Urgent replacement. Where a Sub-processor must be replaced urgently for security or continuity reasons, SENA may do so on shorter notice and will explain the reason; the objection right applies from the notice.

6.4 SENA will impose on each Sub-processor, by written contract, data-protection obligations that are no less protective than those in this DPA, and remains fully liable to Customer for the performance of each Sub-processor's obligations. SENA will ensure that Sub-processors delete Customer Personal Data within 30 days of SENA's deletion under §10.

6.5 Connected Systems that Customer or its Users link to the Service (for example Google, Microsoft, IMAP mail servers, ANAF, Linear, Snowflake, Personio, Meta) are engaged by Customer, not by SENA, and are not Sub-processors.

7. Data-subject requests

7.1 The Service provides self-service tools that allow Customer to search, correct, export and delete Customer Personal Data (module record editing, Documents search, Settings → Privacy → Data export, record and Organisation deletion).

7.2 If SENA receives a request from a data subject relating to Customer Personal Data, SENA will not respond except to direct the data subject to Customer, and will notify Customer within 5 business days, unless the law prohibits it.

7.3 Where Customer cannot fulfil a request with the self-service tools, SENA will assist on written request. Assistance that requires more than 4 hours per calendar month may be charged at SENA's professional-services rates.

8. Security Incidents

8.1 SENA will notify Customer of a Security Incident without undue delay and no later than 48 hours after becoming aware of it, by email to Organisation admins. Customer may register an additional security contact in Settings → Security.

8.2 The notification will describe, to the extent known at the time and supplemented in phases as information becomes available: the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and the name and contact details of SENA's privacy contact or another point of contact where more information can be obtained. SENA will cooperate reasonably with Customer's own notification obligations to supervisory authorities and data subjects.

8.3 A notification is not an admission of fault or liability.

9. DPIA and prior consultation

SENA will provide Customer, on request, with the information reasonably necessary for Customer's data protection impact assessments concerning the Service (system description, data flows, Annex II measures, Sub-processor safeguards) and with reasonable assistance for prior consultation with a supervisory authority. SENA makes its product-level DPIA and a customer DPIA template available on request at privacy@sena.systems.

10. Return and deletion

10.1 Export. During the term and for 30 days after termination or expiry, Customer can obtain its Customer Data in a structured, commonly used, machine-readable format: the self-service bundle in Settings → Privacy → Data export during the term, and a complete export of every Organisation-scoped table and uploaded file on written request to privacy@sena.systems, delivered to a verified Organisation admin within 10 business days.

10.2 Closure. On closure of an Organisation or termination of the Agreement, SENA blocks use of the Service immediately, retains the data for a 30-day grace period for restoration on Customer's written request, then permanently deletes it from production systems, or earlier on Customer's written instruction. Copies in encrypted backups are overwritten within 30 days of production deletion. SENA will confirm deletion in writing on request.

10.3 Statutory retention is Customer's obligation. Customer's e-invoices, accounting records and other documents subject to statutory retention are included in the export under §10.1 and deleted with the rest of Customer Personal Data under §10.2. If Customer wants SENA to keep an archive of its e-invoices after closure, Customer must instruct SENA in writing before the end of the grace period; the archive is then kept under this DPA for the period Customer specifies, as a paid service.

10.4 SENA's own records. SENA retains only what EU or Romanian law requires SENA to keep: its own invoices to Customer, the contract acceptance record, and the records needed to demonstrate SENA's own compliance, for the periods stated in the Privacy Policy, protected by Annex II.

11. Audits

11.1 SENA will make available on request: its current ISO/IEC 27001 statement of applicability and, once obtained, certificate; summaries of security reviews and any penetration tests; the product-level DPIA; and completed responses to Customer's reasonable security questionnaire (once per year, or after a Security Incident).

11.2 If that information does not reasonably satisfy Customer's audit obligations, Customer (or an independent auditor bound by confidentiality and not a competitor of SENA) may audit SENA's compliance with this DPA once per 12 months, on at least 30 days' written notice, during business hours, without disrupting SENA's operations or accessing other customers' data. Customer bears its own costs and reimburses SENA's reasonable time beyond one business day per audit. Audits required by a supervisory authority or following a Security Incident are not subject to the frequency limit. Regulated Customers have the additional rights in the Regulated Customer Addendum.

12. International transfers

12.1 Customer Data, including its processing by AI inference providers and its backups, is stored and processed in the European Union, except as stated in §12.2 and §12.3.

12.2 Instructed transfers. Customer instructs and authorises SENA to transfer: (a) User identity and authentication data (name, email address, authentication metadata, IP address at login) to the identity provider in Annex III; and (b) where Customer's Users install the Apps, device notification tokens and notification titles to Apple Inc. and Google LLC; in each case to the United States, under the EU-US Data Privacy Framework where the recipient is certified and otherwise under the Standard Contractual Clauses (Decision (EU) 2021/914), Module 3 (processor to processor), supported by SENA's transfer impact assessment, which SENA will provide on request. For each recipient SENA also maintains the Standard Contractual Clauses as a fallback mechanism that applies automatically if the adequacy decision relied on ceases to be valid or the certification lapses, together with the supplementary measures identified in the transfer impact assessment; SENA will inform Customer within 30 days of such an event. No other Customer Personal Data is transferred outside the EEA without Customer's prior written authorisation.

12.3 Search terms and page fetches. Research features send the search terms Customer's User enters, or the name of the entity being researched, to the public search engines named in the sub-processor list, and fetch public pages through the network-egress provider named there; no tenant, User or account identifier and no other Customer Data is sent.

12.4 Government requests. If SENA or a Sub-processor receives a legally binding request from a public authority for access to Customer Personal Data, SENA will (a) notify Customer promptly unless legally prohibited, and in that case use reasonable efforts to obtain a waiver of the prohibition, (b) review the legality of the request and challenge it where there are reasonable grounds, (c) disclose only the minimum required, and (d) record the request and report the number of requests received to Customer on request. SENA has not built and will not build any backdoor or deliberate weakness for government access.

13. Liability

Liability under this DPA is subject to the limitations and exclusions in the Terms §14, including the increased cap in §14.4 for personal data breaches. Nothing in this DPA limits either party's liability towards data subjects under GDPR art. 82.

14. Term and precedence

This DPA applies for as long as SENA processes Customer Personal Data. It prevails over the Terms in case of conflict regarding personal data, subject to the precedence rule in the Terms §1.3.

Annex I: Details of processing

Annex II: Technical and organisational measures

This Annex describes the measures SENA has implemented at the version date. SENA may replace individual measures with measures of equivalent or better effect (§5.2). Statements about third-party providers reflect their contractual commitments to SENA and are not warranties of those providers' internal operation.

1. Governance. Information Security Management System aligned with ISO/IEC 27001:2022, with certification by TÜV Austria Romania in progress and not yet obtained; a named information security lead; documented policies for access control, cryptography, backup, logging, vulnerability management, secure development, change management, incident response, business continuity, supplier management, retention and AI and model use; staff confidentiality undertakings and annual training.

2. Hosting and physical security. All production systems run on OVHcloud Managed Kubernetes, managed PostgreSQL and Object Storage in France (Gravelines), with encrypted backup copies in a second OVHcloud region in Germany; OVHcloud data centres hold ISO 27001, ISO 27017 and 27018, SOC 1 and 2, and HDS attestations. SENA staff have no physical access to data centres.

3. Tenant isolation. Every record is scoped to an Organisation. Tenant identity is derived by authenticated backend middleware from the session, never from user input or model output; database row-level security policies keyed on the current Organisation and fail-closed scoped query managers enforce the boundary on every read and write; per-User private lanes (mail, calendar, personal briefings) add a second boundary inside the tenant. Isolation is covered by automated test suites run on every release and by security reviews of the codebase (July and August 2026).

4. Access control and authentication. Authentication through a dedicated identity provider with email verification; role-based authorisation (admin, manager, member) within each Organisation; least-privilege service accounts between internal services with rotated bearer tokens; production access limited to named engineers via personal credentials, logged; secrets held in a self-hosted secrets manager, never in code or images.

5. Encryption. TLS 1.2+ for all external traffic, with traffic between cluster services kept inside the private OVHcloud network; encryption at rest for managed databases and object storage; OAuth tokens and connector credentials encrypted at field level (Fernet) with keys held in the secrets manager, with key rotation supported; backups encrypted with a separate key.

6. AI processing controls. Inference by an EU provider under a contract that prohibits storage of prompts and completions beyond transient processing and prohibits any use for training; embeddings computed by the same EU provider; model outputs that trigger actions pass through structural validation; actions that create or change business records or reach external systems require explicit human approval; prompt-injection and memory-poisoning defences (untrusted-content tainting, tool scoping per agent, schema-dump refusal, output sanitisation) maintained under the secure development policy; AI-generated content labelled in the interface and flagged in stored records; prompt and response traces retained for up to 30 days in SENA's own infrastructure for debugging.

7. Logging and monitoring. Immutable tenant audit log of User actions, approvals, connections and administrative events (database trigger prevents update or deletion), retained 13 months; application and infrastructure logs with self-hosted error tracking that scrubs request bodies and personal identifiers before storage, retained as set out in item 17; alerting on beat failures, provider errors and quota anomalies; per-IP and per-tenant rate limiting on signup, chat, upload and research endpoints.

8. Vulnerability and change management. Pinned dependencies with lockfile integrity checks and CVE sweeps; pinned CI/CD actions; mandatory code review; pre-commit secret scanning; security and bug reviews of the codebase at least twice a year with findings tracked to closure (2026-07-19, 2026-08-16, 2026-08-20 completed); staged rollout with rollback.

9. Backup and continuity. Encrypted database backups held in the European Union; Kubernetes pod disruption budgets and multiple replicas for core services.

10. Data lifecycle. Self-service export for admins and full export on request; account and Organisation soft-delete with 30-day grace then scheduled purge of database rows, object storage and search indexes; mail bodies deleted on disconnect; CRM-visible mail and calendar metadata retained 30 days by default; integration sync logs pruned by scheduled retention job; AI traces 30 days; audit log 13 months; customer e-invoices retained until deletion of the Organisation.

11. Incident response. Documented procedure with severity classification, containment, forensics, customer notification within 48 hours of awareness, ANSPDCP notification within 72 hours where required, breach register, and post-incident review.

12. Supplier management. Sub-processors assessed before engagement (certifications, DPA, transfer mechanism, data location), listed publicly, re-assessed annually; 30-day notice of changes.

13. Pseudonymisation and minimisation. Error reports use scrubbed request bodies and random identifiers; research queries carry no tenant or User identifier; mail bodies are stored only in the connecting User's lane; retention windows apply per data class (item 10).

14. Key management. Field-level encryption keys and backup keys are held in the secrets manager, rotated at least annually and on the departure of anyone with access; access to key material is limited to named engineers and logged.

15. Personnel. Confidentiality undertakings and data-protection training before access; production access revoked on the day of departure; quarterly access reviews.

16. Endpoint security. Staff devices with full-disk encryption, screen lock, managed updates and malware protection; no Customer Personal Data stored on endpoints.

17. Log retention. Application and infrastructure logs 30 days; authentication security logs 13 months; error reports 90 days; AI traces 30 days.

18. Testing. Tenant-isolation and prompt-injection test suites run in CI on every release; vulnerability scans at least monthly; critical vulnerabilities patched within 7 days.

Annex III: Sub-processors

The public list at sena.systems/subprocessors, version 1.1 dated 27 September 2026, is incorporated here as at the effective date. Summary: