Our GDPR Art. 28 DPA for customers who process personal data through Modilo.
You are the controller; Modilo is the processor acting on your documented instructions.
We process personal data only to provide the mapping, analysis and recommendation services described in the Terms.
Process content may be sent to our AI provider solely to generate output. The provider does not train on the data; abuse-monitoring retention is limited and then deleted. Enterprise customers may request Zero Data Retention. [Name provider + link to their DPA].
Current sub-processors: [list hosting + AI provider]. We'll give notice of changes and let you object.
EU hosting, encryption in transit and at rest, access controls and minimal retention. See Security.
Data is kept in the EU. Where any transfer occurs, we rely on appropriate safeguards (e.g. SCCs). [Specify].
We assist you with data-subject requests and notify you without undue delay of any personal-data breach.
On termination we delete or return personal data per your instruction, subject to legal retention.
Last updated: [date].