Data Processing Agreement

Data Processing Agreement, entered into by incorporation as at the effective date of the Terms of Service, by and between:

1. Infere (“Processor” where applicable); and
2. The entity identified in the applicable Order Form/Account (“Controller” where applicable).

Effective date: 02-Sep-26.

This DPA forms part of the agreement between the parties and applies where Infere processes Personal Data on behalf of User as a Processor. The parties acknowledge GDPR and Malta Data Protection Act (Cap. 586).

1. Definitions

Terms used in this DPA have the meanings in GDPR, including “personal data”, “processing”, “controller”, “processor”, “subprocessor”, and “personal data breach”.

2. Scope and Roles

Controller/Processor. User is Controller for User Content and any personal data submitted to the Service. Infere is Processor for such processing to provide the Service. Infere is Controller for its own account administration, billing, and compliance obligations. User is responsible for establishing a lawful basis under Articles 6 and 9 GDPR for all personal data processed through the Service.

Instructions. User instructs Infere to process personal data only to provide the Service and as further documented in these Terms and the Service configuration.

3. Details of Processing

• Subject matter: provision of routing, metering, and intermediary Service for inference requests; technical support; security; billing/analytics and processing of usage information on User’s behalf to the extent necessary to provide the Service.
• Duration: for the term of the agreement plus retention periods in Annex D and as required by law.
• Nature and purpose: transmit, route, store usage events, maintain account and billing; optional Observability when enabled.
• Types of personal data: may include account identifiers, email, billing data, IP address, logs, and any personal data included in User Content.
• Categories of data subjects: User’s end users, employees, contractors, and others whose data may be included in User Content.
• Special categories: not intended; User shall avoid unless lawful and necessary; Observability should not be enabled for such data without safeguards.

4. Processor Obligations

Infere shall:

• process personal data only on documented instructions;
• ensure personnel confidentiality;
• implement appropriate technical and organisational measures (TOMs) (see Appendix 1);
• support User in responding to data subject requests, taking into account the nature of processing;
• notify User without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of User, and provide such information as is reasonably available to assist User in complying with its obligations under the GDPR;
• assist with DPIAs and prior consultation where applicable;
• delete or return personal data at end of services, subject to legal retention;
• make available information necessary to demonstrate compliance and allow audits as set out in Section 9.

5. Subprocessing

User grants general authorisation to appoint subprocessors. Current subprocessors are listed in Appendix 2. Infere will provide notice of new subprocessors by email to the Customer’s designated notice contact and/or by posting an updated subprocessor list at the Service, at least fifteen (15) days before the new subprocessor is authorised to process personal data, unless a shorter period is required for urgent security or continuity reasons. User may object to the appointment of a new subprocessor on reasonable grounds relating to the protection of Personal Data; Infere shall use reasonable efforts to address the objection, and if the parties cannot reasonably resolve it, Infere may cease providing the affected part of the Service and User may terminate the affected Service without penalty. Infere shall impose on each subprocessor, by written agreement, data protection obligations substantially equivalent to those applicable to Infere under this DPA, and Infere shall remain responsible to User for the performance of its subprocessors’ obligations.

6. International Transfers

Where processing involves transfers outside the EEA, Infere will ensure appropriate safeguards. Where a transfer of Personal Data requires safeguards prescribed under the GDPR, the applicable module of the Standard Contractual Clauses (SCCs) shall apply and is incorporated into this DPA by reference, completed using the information contained in this DPA, the applicable Order Form, and Infere’s subprocessor documentation. In the event of conflict between the SCCs and this DPA, the SCCs shall prevail in respect of the relevant transfer.

7. Security Measures (TOMs)

Infere will implement measures appropriate to risk, which may include: encryption in transit (TLS), access controls, token hashing, least privilege, logging, and segregation controls. Appendix 1 lists the current TOMs at a high level (non-exhaustive and subject to change as security evolves).

8. Data Subject Requests

Infere will provide reasonable assistance to User in responding to data subject requests. Where User controls the data, User remains responsible for responding.

9. Audits

Audits may be conducted no more than once in any twelve (12) month period, on at least thirty (30) days’ prior written notice, during normal business hours, in a manner that does not unreasonably interfere with Infere’s operations, and subject to appropriate confidentiality commitments. The foregoing frequency and notice limitations shall not apply where an additional audit is reasonably required following a material Personal Data breach, where User reasonably suspects a material breach of this DPA, or where required by a competent supervisory authority or Applicable Data Protection Law. Infere may satisfy audit requests via third-party certifications or reports.

10. Deletion / Return

Upon termination or expiry of the Services involving processing on behalf of User, Infere shall, at User’s choice, delete or return the relevant Personal Data and delete existing copies, unless Applicable Law requires continued storage. Personal Data contained in backups may remain until deleted in accordance with Infere’s ordinary backup retention cycle, provided such data remains protected under this DPA and is not further processed except as required by Applicable Law.

11. Liability

Liability under this DPA is subject to the limitation of liability in the Terms/Order Form, except where prohibited by law.

Appendix 1 — Technical and Organisational Measures (TOMs)

1. Encryption in transit: TLS
2. Token hashing and secure storage
3. Access control and RBAC
4. Logging and audit trails
5. Incident response process
6. Backup and disaster recovery
7. Vulnerability management
8. Data minimisation / Observability opt-in controls
9. Encryption at rest
10. Access logs
11. Incident response SLA 99.9%
12. Vulnerability management cycle

Appendix 2 — Subprocessors

1. Cloudflare (edge compute and caching)
2. AWS (hosting/storage/auth/notifications as configured)
3. Stripe (payments)
4. AI Providers (processing for inference) — AI Providers made available through the Service, to the extent they process Personal Data as subprocessors in connection with the relevant Provider Service.