Data processing
Template for review by a lawyer. Places marked [DOPLNIŤ] (to be completed) are filled in before real use. This is not binding legal wording.
Parties
Controller: the client [DOPLNIŤ]. Processor: [DOPLNIŤ: business name, registered office, company ID of the ExplAI provider].
Subject and duration
The processor processes personal data that appears in test outputs solely to carry out the test and issue the report, for the duration of the service contract.
Type of data and data subjects
Technical data about the tested website and any personal data of its users that the test comes across. Data subjects are the client's customers and employees. [DOPLNIŤ: details].
Subprocessors
The client gives general consent to the following subprocessors. The processor informs the client in advance of any change to the list.
- Cloudflare: hosting and data storage
- Stripe: payments
- Hostinger: sending email
- [DOPLNIŤ: AI model provider for the Strix tool and the place of processing]
- Client data is not sent to Chinese models.
Security
Encrypted transfer, separate administrator access, hashing of passwords and tokens, an audit log of actions. [DOPLNIŤ: technical and organisational measures].
Deletion
Test outputs are deleted 90 days after the report is issued, unless the client asks for earlier deletion.
Data subject rights and incidents
The processor helps the controller to handle data subject requests and reports a personal data breach without undue delay, at the latest within [DOPLNIŤ: period].
Audit
The processor provides the information needed to demonstrate compliance and allows an audit to an agreed extent. [DOPLNIŤ: audit terms].
Transfers outside the EU
[DOPLNIŤ: safeguards for transfers of data outside the EU, if a subprocessor makes them].