Data Processing Addendum - DPA
Last Updated: January 10, 2025
This Data Processing Addendum ("DPA") forms part of the Terms of Use and Privacy Policy between UDDA Translation AB ("Controller" or "UDDA") and its customers ("Customer" or "Data Controller"), collectively referred to as the "Parties."
This DPA governs UDDA’s processing of personal data on behalf of the Customer in compliance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws. It is designed to cover any data processing involving third-party providers, including APIs provided by OpenAI, Anthropics, Google Gemini, or similar providers, ensuring compliance with all legal and regulatory obligations.
1. Definitions
1.1 Personal Data: Any information relating to an identified or identifiable natural person as defined by applicable data protection laws.
1.2 Processing: Any operation performed on personal data, including collection, storage, modification, or destruction.
1.3 Sub-Processor: Any third party engaged by UDDA to process personal data on behalf of the Customer.
1.4 Applicable Laws: All laws, regulations, and binding obligations concerning data protection and privacy, including the GDPR, the UK Data Protection Act, and equivalent regulations in other jurisdictions.
1.5 Services: UDDA’s offerings, including but not limited to AI-powered analysis, integrations with third-party APIs, and communication tools.
2. Roles and Responsibilities
2.1 Data Controller: The Customer is the Data Controller, determining the purposes and means of processing personal data.
2.2 Data Processor: UDDA acts as the Data Processor, processing personal data on behalf of the Customer and strictly in accordance with documented instructions.
2.3 Sub-Processors: UDDA engages Sub-Processors, including third-party API providers, to deliver the Services. Sub-Processors must comply with obligations equivalent to those outlined in this DPA.
3. Scope of Processing
3.1 Purpose: Personal data is processed to deliver the Services, including:
Real-time communication analysis and enhancement.
Providing personalized insights and recommendations.
Ensuring the security, functionality, and optimization of the Services.
Marketing: We may use your contact information to send marketing communications, subject to your consent. You can opt out at any time.
3.2 Duration: Processing will continue for the duration of the Customer’s use of the Services unless otherwise required by applicable laws.
3.3 Data Categories: Processed data may include:
User-provided information such as names, email addresses, and messages.
Communication metadata such as timestamps, sender/recipient information, and contextual data.
Interaction data generated through API integrations.
4. Customer Obligations
The Customer ensures:
Personal data is collected lawfully and shared with UDDA in compliance with applicable laws.
Data subjects are informed of the processing activities carried out by UDDA on behalf of the Customer.
Appropriate permissions and consents are obtained where necessary.
5. UDDA Obligations
5.1 Compliance: UDDA processes personal data in accordance with applicable data protection laws and the terms of this DPA.
5.2 Confidentiality: UDDA ensures that all personnel authorized to process personal data are bound by confidentiality obligations.
5.3 Security: UDDA implements technical and organizational measures to protect personal data, including:
Encryption (AES-256 for data at rest, TLS 1.2+ for data in transit).
Role-based access controls.
Regular security audits and penetration testing.
5.4 Assistance: UDDA assists the Customer with data protection obligations, including:
Responding to data subject rights requests.
Conducting data protection impact assessments (DPIAs).
Managing security incidents and breaches.
5.5 Data Breach Notification: UDDA promptly notifies the Customer of any data breach involving personal data within 72 hours of discovery.
6. Use of Sub-Processors
6.1 Approval: By using UDDA’s Services, the Customer provides general authorization for UDDA to engage Sub-Processors. A list of Sub-Processors is available upon request.
6.2 Obligations: UDDA ensures Sub-Processors:
Are bound by written agreements imposing equivalent data protection obligations.
Process data only for purposes consistent with this DPA.
Implement security measures to protect personal data.
6.3 Notification: UDDA will notify the Customer of any changes to Sub-Processors and provide an opportunity to object within 10 business days.
7. International Data Transfers
7.1 Safeguards: Personal data transferred outside the EU/EEA is protected by:
Standard Contractual Clauses (SCCs).
Adequacy decisions by the European Commission.
Binding corporate rules or equivalent safeguards.
7.2 Customer Notification: Details of data transfers and safeguards are available upon request.
8. Data Subject Rights
UDDA assists the Customer in responding to data subject requests, including:
Access, rectification, and erasure of personal data.
Restriction of processing and data portability.
Objection to processing, including automated decision-making.
Requests should be submitted to hello@udda.ai.
9. Data Retention
Personal data is retained only as long as necessary to provide the Services or comply with legal obligations. Upon termination of Services, UDDA will:
Delete or anonymize personal data within six months.
Provide certifications of data deletion upon request.
10. Liability and Indemnification
10.1 Liability: Each party’s liability for violations of this DPA is subject to limitations outlined in the Terms of Use.
10.2 Indemnification: The Customer agrees to indemnify UDDA against claims arising from:
Non-compliance with data protection laws by the Customer.
Instructions from the Customer that violate applicable laws.
11. Termination
This DPA remains in effect for the duration of the data processing activities or until terminated by the Parties. Upon termination, all personal data will be securely deleted or returned to the Customer.
12. Governing Law
This DPA is governed by the laws of Sweden, and disputes shall be resolved in Swedish courts.
13. Contact Information
For questions or concerns about this DPA, contact:
Email: hello@udda.ai
Address: Johannes Plan 5, c/o Carlsson, 111 38 Stockholm, Sweden
