Pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR)
Preamble: The Controller uses the Privedge AI inference proxy to detect and anonymize PII in AI prompts before transmission to third-party LLM providers. This Addendum governs the Processor's handling of personal data on behalf of the Controller pursuant to GDPR Art. 28.
The Processor provides an AI inference proxy that: (a) receives prompts from the Controller's systems, (b) detects and replaces personally identifiable information with synthetic tokens, (c) forwards anonymized prompts to designated AI providers, (d) reverses tokenization on responses, and (e) returns de-anonymized responses to the Controller.
Personal data is processed exclusively in memory during the request lifecycle. No prompt content is written to persistent storage.
End users of the Controller's AI-enabled products and services whose prompts are routed through the Processor.
The Processor processes audit metadata on a persistent basis: timestamp, pii_types detected (not values), routed_to, latency_ms. This metadata does not identify individuals.
Processing is carried out solely for the purpose of providing the Privedge anonymization service as described in Clause 1. The Processor acts only on documented instructions from the Controller. No processing for the Processor's own purposes occurs.
The Processor engages the following sub-processors. The Controller hereby grants general authorization for these sub-processors:
The Processor shall notify the Controller of any intended addition or replacement of sub-processors with reasonable advance notice. The Controller may object within 14 days.
The Processor shall assist the Controller in responding to data subject requests (access, rectification, erasure, restriction, portability) insofar as technically feasible. Given that prompt content is not stored, most erasure requests are satisfied by architecture. The Processor shall forward any requests received directly from data subjects to the Controller within 5 business days.
The Processor shall notify the Controller without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach. Notification shall include: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.
The Controller may request reasonable information to verify compliance with this Addendum. The Processor shall make available all information necessary to demonstrate compliance and shall allow for and contribute to audits, including inspections, subject to reasonable advance notice and confidentiality obligations.
Upon termination of the main service agreement, the Processor shall delete all retained data within 30 days and provide written confirmation. Self-hosted deployments retain no data on the Processor's systems; this clause applies to cloud-mode customers only.