Data processing agreement

The customer organization that operates a newsroom workspace is the controller. Entro314 Labs PC is the processor. This agreement takes effect when the customer accepts the Terms and lasts as long as the workspace exists. No separate signature is required for it to bind; a countersigned copy on paper is issued on request.

ErmisAI processes personal data in order to run the newsroom workspace the customer subscribes to: monitoring configured sources, clustering coverage, drafting stories, routing them through editorial review, and delivering approved output to the publishing surfaces the customer connects. Processing lasts for the term of the subscription plus the transition and erasure windows described on the data portability and exit page.

Data subjects are the customer's editors, administrators and invited members, plus any individual named in the source material a newsroom monitors or in the drafts its editors write. Categories are:

• identity and account data - name, email address, role, workspace membership,
• usage data - actions in the workspace, story and draft history, audit records,
• content data - source articles, clusters, drafts and approved stories, including any personal data they mention,
• technical data - IP address, device and browser metadata captured in security and error logs.

ErmisAI processes personal data only on documented instructions from the customer. The Terms, this agreement, the product settings a customer configures, and the actions its editors take in the workspace are those instructions. If ErmisAI is required by EU or member-state law to process beyond them, it informs the customer before doing so unless that law forbids the notice. ErmisAI tells the customer if an instruction appears to infringe data protection law.

Everyone authorised to process customer personal data is bound by confidentiality and has access only to what their work requires. Access to production data is limited to the operator of the service and is logged.

ErmisAI maintains technical and organisational measures appropriate to the risk, including encryption in transit, encrypted storage at the hosting providers, role-based access control, tenant isolation on every read and write path, signature verification on inbound webhooks, and rate limiting. The security page describes the measures and states plainly what is not claimed.

The customer gives general authorisation for the sub-processors listed on the sub-processor page, which names every vendor, its role and its processing region. ErmisAI imposes equivalent data protection obligations on each of them and remains fully liable for their performance. New or replaced sub-processors are announced on that page before they start processing, and a customer may object on reasonable data protection grounds; an unresolved objection entitles the customer to terminate the affected service without penalty.

Taking into account the nature of the processing, ErmisAI assists the customer with:

• responding to data subject requests, including access, correction, erasure and portability - most of which the customer can serve itself from the workspace,
• security of processing, breach notification and data protection impact assessments,
• prior consultation with a supervisory authority where one is required.

ErmisAI notifies the customer without undue delay after becoming aware of a personal data breach affecting that customer's data, with the information the customer needs for its own Article 33 notification, and follows up as the investigation develops.

ErmisAI makes available the information needed to demonstrate compliance with Article 28 and allows for audits, including inspections, conducted by the customer or an auditor it mandates. Audits are scheduled at reasonable notice, no more than once a year unless an incident or a supervisory authority requires otherwise, and must not compromise the security of other customers.

Processing is kept in the European Union or European Economic Area where the vendor offers it. Where a sub-processor transfers data outside the EEA, the transfer relies on an adequacy decision or on the European Commission's standard contractual clauses with supplementary measures. The sub-processor page states the region each vendor operates in.

On termination the customer chooses whether personal data is returned or deleted. Data stays readable for the transition period described on the data portability and exit page so exports can be finished, and is then erased, except where EU or member-state law requires retention - billing records being the usual case.

Where this agreement conflicts with the Terms on the processing of personal data, this agreement prevails. A negotiated agreement signed with a customer prevails over both. Material changes are published on this page with a new effective date and announced to customers with an active subscription.