Data Processing Addendum

Last updated: 8 November 2026

1. Parties, definitions and scope

1.1 Parties. This Data Processing Addendum (“DPA”) is entered into between the customer that has accepted the EUDAbridge Terms of Service (“Customer”) and Dimitrios Oikonomou, a sole proprietor trading as EUDAbridge, VAT (ΑΦΜ) 066583652, Lechovou 35, 56626 Thessaloniki, Greece, info@eudabridge.eu (“Processor”). It forms part of the Terms of Service (the “Agreement”).

1.2 Definitions. “GDPR” means Regulation (EU) 2016/679. “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing”, “Personal Data Breach” and “Supervisory Authority” have the meanings given in the GDPR. “Customer Personal Data” means Personal Data contained in data that Customer or its users upload to, enter into, or import through the Service, and in the files the Service generates from that data. “Sub-processor” means any third party engaged by Processor to process Customer Personal Data. “Service” has the meaning given in the Agreement.

1.3 Roles. For Customer Personal Data, Customer acts as Controller and Processor acts as processor on Customer’s behalf. Where Customer itself acts as processor for a third party (for example, a regulatory consultant acting for a manufacturer), Processor acts as Customer’s sub-processor and Customer warrants that the relevant controller has authorised this.

1.4 Out of scope. This DPA does not apply to Personal Data that Processor processes as an independent controller to run its own business, in particular user account details, billing and payment information, support correspondence, security logs and website analytics. That processing is described in the Privacy Policy.

1.5 Description. The subject matter, duration, nature and purpose of the processing, and the categories of Data Subjects and Personal Data, are set out in Annex I.

2. Instructions and Customer obligations

2.1 Documented instructions. Processor shall process Customer Personal Data only on Customer’s documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which Processor is subject. In that case Processor shall inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

2.2 What the instructions are. Customer’s instructions consist of (a) the Agreement and this DPA, (b) Customer’s configuration and use of the Service, including the data it uploads, edits, exports and deletes, and (c) any further written instructions that are consistent with the Agreement and that Processor can reasonably implement. Instructions that would change the scope or cost of the Service require a written agreement.

2.3 Unlawful instructions. Processor shall immediately inform Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law. Processor may suspend the affected processing until Customer confirms or modifies the instruction.

2.4 Customer obligations. Customer is responsible for:

• having a lawful basis for the Customer Personal Data it provides, and for providing any notices to Data Subjects;
• the accuracy and lawfulness of that data and of its instructions;
• not submitting special categories of data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR), which the Service is not designed to process;
• managing its own users, roles and credentials, and enabling two-factor authentication where appropriate to its risk.

3. Confidentiality and security

3.1 Confidentiality. Processor shall ensure that every person it authorises to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and has access only to the extent needed to provide the Service or support.

3.2 Security measures. Processor shall implement and maintain the technical and organisational measures described in Annex II, which are designed to ensure a level of security appropriate to the risk as required by Art. 32 GDPR. Processor may update those measures, provided the overall level of protection is not reduced.

3.3 Access by Processor. Processor accesses Customer Personal Data in the Service only to provide and support the Service, to investigate errors or security events, or where required by law. Every change Processor makes to a customer’s records through its administrative tools is recorded in an audit log.

3.4 Records. Processor maintains a record of processing activities carried out on behalf of Customer in accordance with Art. 30(2) GDPR.

4. Sub-processors

4.1 General authorisation. Customer gives Processor a general written authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA are listed in Annex III and are approved.

4.2 Notice of changes. Processor shall give Customer at least thirty (30) days’ prior notice of any intended addition or replacement of a Sub-processor, by email to Customer’s account administrators and by updating Annex III. The notice shall state the Sub-processor’s name, location and the processing it will perform.

4.3 Objection. Within the notice period, Customer may object to the change on reasonable grounds relating to data protection, by writing to info@eudabridge.eu. The parties shall discuss the objection in good faith. If they do not resolve it before the change takes effect, Customer may terminate the affected Service by written notice, effective on the date the change takes effect. In that case Processor shall refund any fees Customer has prepaid for the period after termination, pro rata. This is Customer’s sole remedy for the objection.

4.4 Flow-down and liability. Processor shall impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees of appropriate technical and organisational measures. Processor remains fully liable to Customer for the performance of each Sub-processor’s obligations (Art. 28(4) GDPR).

4.5 Emergency replacement. Where a Sub-processor must be replaced urgently for reasons outside Processor’s control (for example, a security incident or the Sub-processor ceasing service), Processor may make the change immediately and shall notify Customer as soon as practicable; Section 4.3 then applies from that notice.

5. International transfers

5.1 EU hosting. Customer Personal Data is stored in the European Union (Frankfurt, Germany). Processor shall not transfer Customer Personal Data to a country outside the European Economic Area except as set out in this Section and Annex III.

5.2 Authorised transfer. When Customer uploads its own workbook and the Service cannot match a column automatically, the column heading and up to three sample values from that column are sent to Anthropic Ireland, Limited and processed by its affiliate Anthropic, PBC in the United States to suggest a field mapping. No other Customer Personal Data is sent. This transfer relies on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Three, processor to processor), incorporated in Anthropic’s Data Processing Addendum. Customer can avoid this transfer entirely by using the EUDAbridge template, which is mapped without it.

5.3 Future transfers. Any further transfer requires a valid mechanism under Chapter V GDPR in place before it starts, and is a change of Sub-processor subject to Section 4.

5.4 Requests from public authorities. If Processor receives a legally binding request from a public authority for Customer Personal Data, Processor shall, unless legally prohibited, notify Customer promptly, disclose only what is legally required, and use reasonable legal means to challenge a request it considers unlawful.

6. Assistance and Personal Data Breaches

6.1 Data Subject requests. The Service lets Customer access, correct, export (as JSON or as a complete ZIP archive including generated files) and delete Customer Personal Data itself. Where Customer cannot fulfil a request with those functions, Processor shall assist by appropriate technical and organisational measures, insofar as possible. If Processor receives a request directly from a Data Subject relating to Customer Personal Data, it shall forward it to Customer without undue delay and shall not respond itself except to confirm the forwarding.

6.2 Other assistance. Taking into account the nature of the processing and the information available to it, Processor shall provide reasonable assistance to Customer with its obligations under Arts. 32 to 36 GDPR, including data protection impact assessments and prior consultation. Processor may charge reasonable fees for assistance that goes beyond the information in this DPA and its Annexes.

6.3 Breach notification. Processor shall notify Customer of a Personal Data Breach affecting Customer Personal Data without undue delay, and in any event within forty-eight (48) hours after Processor has confirmed the Personal Data Breach. Notice shall be sent by email to Customer’s account administrators.

6.4 Content of the notice. To the extent then known, the notice shall describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Processor shall provide further information in phases as it becomes available, and shall take reasonable steps to contain and remedy the breach.

6.5 No admission. Notification of a Personal Data Breach is not an acknowledgement of fault or liability.

7. Deletion, return and audits

7.1 Return before deletion. At any time, and in particular before closing its account, Customer can download all Customer Personal Data in the Service as a ZIP archive containing the structured records (JSON) and every generated file. This is the return of data under Art. 28(3)(g) GDPR.

7.2 Deletion. When Customer deletes its account, or the Agreement ends, the account is deactivated immediately and kept for thirty (30) days so that it can be restored if the deletion was a mistake. After that period Processor permanently deletes Customer Personal Data from the Service. Copies of Customer Personal Data remain in database backups until those backups expire: up to 3 days in the hosting provider’s point-in-time recovery and up to thirty (30) days in Processor’s encrypted off-site backups. Backups are used only for disaster recovery.

7.3 Exceptions. Section 7.2 does not apply to Personal Data that Union or Member State law requires Processor to retain. Payment and invoicing records are processed by Processor as controller (Section 1.4) and are retained under Greek tax law; they are not Customer Personal Data.

7.4 Information first. Processor shall make available to Customer, on request, the information necessary to demonstrate compliance with Art. 28 GDPR, including this DPA, Annex II and written answers to Customer’s reasonable security questionnaires. Customer agrees to rely on this information first.

7.5 Audits. Where the information under Section 7.4 is not sufficient, or where a Supervisory Authority requires it, Customer (or an independent auditor bound by confidentiality and not a competitor of Processor) may audit Processor’s compliance with this DPA, subject to:

• at least thirty (30) days’ written notice and a written audit plan agreed in advance;
• no more than one audit in any twelve (12) month period, except after a Personal Data Breach affecting Customer or at the request of a Supervisory Authority;
• the audit taking place during normal business hours, remotely where possible, and without access to other customers’ data or to Sub-processors’ premises (for which Processor shall provide the Sub-processor’s own certifications or reports);
• Customer bearing its own costs and reimbursing Processor’s reasonable time at its then-current rates.

8. Liability, term and general

8.1 Liability. Each party’s liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Agreement, which apply in aggregate to the Agreement and this DPA together. Nothing in this DPA limits either party’s liability to Data Subjects under Art. 82 GDPR, or any liability that cannot be limited under applicable law.

8.2 Term. This DPA applies for as long as Processor processes Customer Personal Data, and survives termination of the Agreement until deletion under Section 7.

8.3 Precedence. In the event of a conflict, this DPA prevails over the Agreement with respect to the processing of Customer Personal Data, and any Standard Contractual Clauses incorporated under Section 5 prevail over this DPA.

8.4 Changes. Processor may update this DPA to reflect changes in law, guidance of a Supervisory Authority, or the Service, provided the level of protection for Customer Personal Data is not reduced. Processor shall give at least thirty (30) days’ notice of material changes. Changes to Sub-processors follow Section 4.

8.5 Signature. This DPA is incorporated into the Agreement by reference and binds the parties without a separate signature. Customers that need a countersigned copy for their records may request one at info@eudabridge.eu.

8.6 Governing law. This DPA is governed by Greek law. The courts of Thessaloniki, Greece have exclusive jurisdiction, without prejudice to the rights of Data Subjects and the powers of Supervisory Authorities under the GDPR.

Annex I: Description of the processing

Annex II: Technical and organisational measures

These are the measures in place at the date of this DPA.

1. Access control and authentication

• Passwords are stored only as bcrypt hashes; a minimum length of 10 characters is enforced.
• Time-based two-factor authentication (TOTP) with single-use backup codes is available to every user. It is mandatory for Processor’s administrative (operator) accounts.
• TOTP secrets are encrypted at rest; backup codes are stored only as hashes.
• Sessions use signed cookies marked HttpOnly, Secure and SameSite=Lax, and expire after 12 hours. Changing a password, removing a user or deleting an account ends all of that user’s or company’s sessions immediately.
• Password reset links expire after one hour.
• Login, registration, two-factor verification, password reset and account deletion are rate-limited.

2. Tenant separation and authorisation

• Each customer company can access only its own records. Company settings, data export and account deletion are limited to the company’s administrators.
• A consultant can work in a client’s workspace only through a link the client controls; the client can require approval, and a consultant can never change the client’s settings or export its data.
• Administrative access across customers is limited to accounts named in the server configuration; it cannot be granted from within the application.

3. Encryption

• All traffic to the Service uses HTTPS (TLS).
• Email is sent to the email Sub-processor over STARTTLS with certificate verification.
• The database, its replicas and all its backups are encrypted at rest with AES-256 by the hosting Sub-processor. External connections to the database always use TLS.

4. Application security

• The Service sends a Content-Security-Policy, HTTP Strict Transport Security, X-Frame-Options DENY with frame-ancestors none, X-Content-Type-Options nosniff, a strict Referrer-Policy, Cross-Origin-Opener-Policy and a Permissions-Policy that disables camera, microphone and geolocation.
• Every change is covered by an automated test suite, run on each change before release.

5. Logging and accountability

• Every change made by Processor to a customer’s records through administrative tools, and every data export or account deletion by a customer, is written to an audit log that the application cannot edit or delete.
• Email sent by the Service is logged (recipient, subject, type, delivery status) and the log is deleted after 24 months.

6. Data minimisation

• Error monitoring receives no request bodies and no local variables; email addresses are removed from error reports before they are sent.
• Application logs do not record email recipients or subjects.
• Automated column mapping sends only a column heading and up to three sample values, and only for columns that cannot be matched without it (Section 5.2).

7. Hosting and availability

• The application and database run on the hosting Sub-processor in Frankfurt, Germany (EU).
• The hosting Sub-processor provides continuous point-in-time recovery for the past 3 days. In addition, a full logical backup is taken every day, encrypted with a public key before it leaves the hosting environment (the private key is held offline by Processor), stored with a second Sub-processor in Germany, verified after upload, and deleted after 30 days. Restoring from a backup is tested at least every three months.

8. Retention and deletion

• Customers can export all their data (JSON, or a ZIP archive with every generated file) at any time.
• Deleted accounts are kept for 30 days and then permanently deleted; payment records are kept separately for legal retention.
• Removing a user also removes that person’s email address from the audit log and the email log.

9. Organisational measures

• Access to production systems is limited to Processor, using accounts protected by two-factor authentication.
• Anyone given access to Customer Personal Data is bound by confidentiality.
• Processor maintains a procedure for handling Personal Data Breaches that meets Section 6.3.
• Sub-processors are selected for their security guarantees and reviewed when they change their terms.

10. Sub-processor measures

• Each Sub-processor is bound by a written data processing agreement (Section 4.4).

Annex III: Authorised Sub-processors

Stripe processes payment data as Processor’s payment provider. That is Processor’s own controller processing (Section 1.4), described in the Privacy Policy, so Stripe is not listed here.

See also the Terms of Service and the Privacy Policy.