This Data Processing Addendum (DPA) forms part of the Platform Agreement between Bohuš Global ("Processor") and the customer ("Controller") and governs Processor's processing of Customer Data on Controller's documented instructions for the purpose of providing the Bohuš Global service.
Processor processes Customer Data only to provide the platform's contracted features (record ingestion, structuring, dossier generation, retention, export). Processing continues for the duration of the active subscription plus any export window agreed in writing.
Storage of Customer Data, AI-assisted structuring of legal/governance records, generation of derived outputs (chronologies, obligation maps, dossiers), and retrieval at Controller's request. Customer Data is never used to train any model.
Determined by Controller. Typically includes parties to a matter, their representatives, and third parties referenced in the documents Controller chooses to upload.
Processor maintains a public Subprocessor Register at /subprocessors. Controller is notified before any new subprocessor is added. Each subprocessor is bound by contractual obligations no less protective than this DPA.
Processor's technical and organisational measures are described at /security. Customer Data is encrypted in transit and at rest. Access to document content is gated by ownership plus an audited break-glass process for support-initiated review.
Processor will assist Controller in responding to data subject requests through the platform's export and deletion controls. Where requests cannot be served by the platform alone, Processor will provide reasonable cooperation.
Processor will notify Controller without undue delay (target: 72 hours) of any personal-data breach affecting Customer Data, including the nature of the breach, affected categories, and remediation taken.
On termination, Controller may export Customer Data through the platform's standard tools. Processor deletes Customer Data within 30 days of termination unless required to retain by law. Retention rules are at /retention.
Where personal data is transferred outside the UK or EEA, Processor uses the UK International Data Transfer Agreement or EU Standard Contractual Clauses, as applicable.
For organisations requiring a signed Order Form or amendments to this DPA, contact contracts@bohusglobal.com.
Structured Intelligence Systems. Not legal advice. Not professional representation.