Data processing agreement
This English text is a translation for convenience. The Danish version prevails.
This agreement is part of the terms and applies when the customer uses wikiaio. It meets the requirements of Article 28(3) of the General Data Protection Regulation (GDPR). Enterprise customers may negotiate their own agreement; a signed agreement prevails in case of conflict.
1. Parties and roles
The customer is the controller. Sjøbeck Digital, CVR 34358702, is the processor.
2. The processing
- Purpose: providing wikiaio: storing, displaying, searching and answering questions from the customer's knowledge bases.
- Nature: storage, structuring, search, indexing (including computing text vectors), display, AI-based answering, export and deletion.
- Categories of data subjects: the customer's staff and other invited users; people mentioned in the customer's pages.
- Types of data: name, e-mail, role, sign-in data, pages and files (which may contain personal data, including sensitive data if the customer adds it), questions and answers, technical logs without content.
- Duration: while the customer uses the service, plus the export period after cancellation.
3. Instructions
The processor processes the data only on documented instructions from the controller. The terms, this agreement and the customer's use of the service's features constitute the instructions. If the processor believes an instruction infringes data protection law, it informs the controller immediately.
4. Confidentiality
Only people who need access to provide the service get it, and they are bound by confidentiality. We have no standing access to customer content; access happens only for troubleshooting or support at the customer's request and is logged.
5. Security
The processor implements appropriate technical and organisational measures under Article 32. They are described in Annex B.
6. Sub-processors
The controller gives general authorisation to the sub-processors listed in Annex A. The processor announces changes at least [LEGAL: 30 days] in advance by e-mail and on the list of sub-processors. The controller may object; if the parties can't agree, the controller may terminate without cost. The processor imposes the same obligations on sub-processors and remains liable for them.
7. Transfers to third countries
Data is processed only in the EU/EEA. If the controller enables Microsoft sign-in or Microsoft Teams/Outlook, identity data (name, e-mail, tenant id) is processed by Microsoft as described in Annex A — never content.
8. Assistance
The processor assists the controller in responding to data subject requests (access, rectification, erasure, export), with impact assessments and prior consultations, to a reasonable extent. Most of this the controller can do in the service: edit and delete pages, remove users and export everything.
9. Personal data breaches
The processor notifies the controller without undue delay and at the latest [LEGAL: e.g. 24 hours] after becoming aware of a breach, with the information the controller needs to notify the authority within 72 hours.
10. Deletion and return
On termination, the controller can export everything for [OPEN: 30 days or 12 months]. Then the workspace's database is deleted and its encryption key destroyed (cryptographic erasure), so the data can't be restored from backups either. The processor confirms deletion in writing on request.
11. Audits and documentation
The processor makes available the information needed to demonstrate compliance and allows audits with reasonable notice. An independent ISAE 3000 report is planned but not issued.
12. Liability and term
Liability is governed by the terms. This agreement applies as long as the processor processes data for the controller.
Annex A — Sub-processors
| Company | Country | Purpose | Data | Location of processing |
|---|---|---|---|---|
| Scaleway SAS | France | Servers, databases, key management (Key Manager), AI models (Generative APIs), sending e-mail | All content, user accounts, questions and answers, logs | EU (Paris, fr-par) |
| Mollie B.V. | Netherlands | Payments and subscriptions | Billing contact, payment details | EU |
| BunnyWay d.o.o. | Slovenia | DNS and CDN for static files (planned, not yet in use) | IP addresses, requests | EU |
| Microsoft Ireland Operations Ltd (US parent) | Ireland | Only if the customer enables Microsoft sign-in or Teams/Outlook: confirms the user's identity | Name, e-mail, Microsoft tenant id — never content | [LEGAL: Microsoft location and transfer mechanism] |
Annex B — Technical and organisational measures
Customer separation
- Every customer has its own database. No tables are shared between customers.
- Every database has its own password. It is stored encrypted with keys in Scaleway Key Manager (envelope encryption) and cryptographically bound to the individual customer.
- Every customer has its own key in Scaleway Key Manager, protecting the customer's sign-in keys and files (images and attachments). If the key is destroyed, that data can't be read again.
- The customer a request belongs to is determined only from the address (name.wikiaio.eu), and sign-in tokens are cryptographically bound to the individual customer: a token from one customer doesn't work at another.
Access control
- Roles (owner, admin, editor, reader) and access per knowledge base. Search and AI answers filter on the user's access before the language model sees anything.
- Sign-in by one-time e-mail link or Microsoft (identity only). We store no passwords.
- Every request is checked for permissions on the server; automated tests try access across customers and roles.
Encryption and network
- HTTPS (TLS) on all traffic, HSTS and a strict Content Security Policy.
- Customer-specific keys in Scaleway Key Manager. Key material never leaves Key Manager.
AI
- Language models run at Scaleway in the EU. Only excerpts from pages the user may see are sent with the question.
- Page content is treated as data, not instructions, and answers without valid sources are rejected.
Logging
- Security and audit logs contain metadata (who, what, when), not page content or question text. Personal data in logs is masked automatically.
Operations and continuity
- Hosting at Scaleway in Paris. Encrypted backups and rehearsed restores are [BEING SET UP — updated once backup and restore tests are live].
- The customer can always export all content.
Development
- Automated security checks on every change (static analysis, secret scanning, dependency checks, a check that no US vendor is in the data path) and a security review before release.