Draft: pending legal review
PrivacyDPASubprocessorsSecurity
Data processing agreement
A summary of the GDPR Article 28 terms, and a template you can download.
This page summarizes a GDPR Article 28 data processing agreement. The downloadable file is a template for counsel to complete. It is not a signed contract. Square brackets are open points.
Download the DPA template (PDF) ↗
Parties in the template: the customer is the controller, and the processor is Inference Global, Inc., a Delaware corporation, 44 East Ave, Suite 3205, Austin, TX 78701, USA. Contact for the processor: privacy@inferenceindex.com.
Processing scope
InferenceIndex processes personal data only on the customer’s documented instructions, to provide the API and related support. The draft covers account contacts, API request content the customer submits, and usage and log data. Categories of data and of data subjects are still open.
Sub-processor authorization
The draft gives InferenceIndex general written authorization to use the sub-processors on the public list, and to tell the customer before that list changes. The notice period and the objection window are open.
Security measures
The public summary of measures is encryption in transit, Google Cloud infrastructure, least-privilege access, and hashed API keys. The full list belongs in SCC Annex II and is still a placeholder.
Breach notice
InferenceIndex notifies the customer without undue delay after becoming aware of a personal data breach that affects customer data. The draft notice window is 72 hours. The contact path is open.
Deletion and return
When the service ends, InferenceIndex deletes or returns customer personal data, at the customer’s choice, unless the law requires storage. The timeline and the return format are open.
Audits
InferenceIndex makes available the information needed to show Article 28 compliance, and allows audits by the customer or an auditor the customer mandates. Notice, frequency, and whether a report can stand in for an on-site visit are open.
Other Article 28 terms
People authorized to process personal data are under confidentiality. InferenceIndex assists the customer with data subject requests, security, breach notices, data protection impact assessments, and prior consultation, taking into account the nature of the processing and the information available. [Confirm fees and time limits for that assistance.]
International transfers and SCC annexes
Where personal data moves outside the European Economic Area and GDPR Chapter V requires a transfer tool, the template incorporates the EU Standard Contractual Clauses. The annexes below are placeholders in the PDF.
- Module. [SCC module — confirm. The draft expects Module Two, controller to processor, and Module Three, processor to processor, where a sub-processor transfer needs it.]
- Annex I. Parties and a description of the transfer: exporter, importer, data subjects, categories of data, frequency, purpose, and retention. [Complete Annex I in the executed copy.]
- Annex II. Technical and organizational measures. [Attach the full measures. The public summary is encryption in transit, Google Cloud infrastructure, least-privilege access, and hashed API keys.]
- Annex III. Sub-processors. [Point the executed annex at the subprocessors page and paste the current list.]
Related: Privacy, Subprocessors, Security.