Data Processing Addendum
Last updated:
Note: This is a plain-language summary for customers who need a DPA. For enterprise/EU contracts, use a full DPA reviewed by counsel; have your lawyer expand this with the SCC annexes.
Where GBPilot processes personal data on your behalf as a processor, the following applies:
Roles
You are the controller of personal data you submit (including data of your customers/reviewers); GBPilot is the processor.
Scope & purpose
We process personal data only to provide the Service and on your documented instructions.
Sub-processors
We use sub-processors to help provide the Service (hosting, payments, AI, email). They are bound by equivalent obligations. We will notify you of any changes to our sub-processors.
Security
We maintain appropriate technical and organizational measures (see Privacy Policy §6).
Confidentiality
Personnel with access are bound by confidentiality.
Data subject requests
We assist you in responding to access/deletion/correction requests.
Breach notice
We notify you without undue delay after becoming aware of a personal data breach affecting your data.
Deletion
On termination we delete or return personal data per the retention terms, subject to legal requirements.
International transfers
Where applicable, transfers rely on Standard Contractual Clauses or other lawful mechanisms.
Execute a signed DPA
To execute a signed DPA, contact support@gbpilot.io.