Data Processing Agreement
Last updated 2026-10-02
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller") and Vetro Attest ("Processor") and applies whenever the Processor processes personal data on the Controller's behalf, as required by Article 28 of Regulation (EU) 2016/679 (GDPR). It takes effect on purchase without further signature; to receive a countersigned copy for your records, write to attest@lumnika.com. Print this page to PDF to keep a copy.
1. Subject matter and duration
Processing of the ledgers the Controller uploads to obtain an EU AI Act transparency report and attestation, for as long as the ledger is stored (at most 7 days after upload) and, for subscriptions, for the subscription term.
2. Nature and purpose
Storage, integrity verification (hash chain and signatures), report generation, countersigning of the ledger digest and email delivery of the result. No other purpose; no training of models, profiling, sale or sharing of the data.
3. Data and data subjects
Whatever personal data the Controller's AI agent recorded in the uploaded ledger (for example end-user prompts, identifiers, outputs), relating to the Controller's end users, staff or other persons. The Controller decides what the ledger contains and may redact or hash fields before upload. No special categories should be uploaded unless the Controller has a legal basis for it.
4. Processor obligations
The Processor: (a) processes personal data only on the Controller's documented instructions, which are these Terms and the use of the service; (b) ensures that anyone authorised to process the data is bound by confidentiality; (c) implements the measures in §6; (d) assists the Controller, taking into account the nature of processing, in responding to data-subject requests and with Articles 32-36 GDPR; (e) deletes the personal data at the end of processing (§1) unless EU or Member State law requires storage; (f) makes available the information necessary to demonstrate compliance with Article 28 and allows for audits by answering written questionnaires, and on-site audits at the Controller's cost with 30 days' notice where a questionnaire is not sufficient; (g) informs the Controller immediately if an instruction infringes data protection law.
5. Personal data breach
The Processor notifies the Controller without undue delay, and within 48 hours of becoming aware of a personal data breach affecting the Controller's data, with the information available under Article 33(3) GDPR.
6. Technical and organisational measures
Encryption in transit (TLS) on all endpoints; hosting in an ISO/IEC 27001-certified data centre in Germany; automatic deletion of uploaded ledgers after 7 days; in-memory processing without storage for free verification; signing keys stored with owner-only permissions on the server; no third-party scripts, cookies or trackers; access to production limited to the operator.
7. Subprocessors
The Controller gives general authorisation to the subprocessors listed at /trust/ (Hetzner Online GmbH, hosting, Germany; Stripe Payments Europe, Ltd., payments, Ireland; Resend, Inc., email delivery, United States). The Processor imposes on them data protection obligations equivalent to this DPA, remains liable for them, and announces any new subprocessor on that page and by email to active subscribers at least 14 days in advance; the Controller may object and, if the objection cannot be resolved, cancel with a pro-rata refund.
8. International transfers
Personal data is transferred outside the EEA only to subprocessors covered by an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
9. Liability and precedence
Liability follows the Terms of Service, except where mandatory law provides otherwise. In case of conflict between this DPA and the Terms regarding personal data, this DPA prevails.