Data processing agreement
If you use Prometheor for your business and your tasks contain personal data of other people (for example customers or staff), we process that data for you. This agreement under Article 28 GDPR applies once you accept it. To accept, write to info@prometheor.com from the email address of your account; we confirm by email.
1Subject and duration
We process personal data on your behalf to provide Prometheor under the Terms, for as long as your contract runs.
2Kind of data and people concerned
Personal data that you or your connected AIs put into tasks, result files and logbook entries. The people concerned are those whose data you choose to include, such as customers, staff or contacts. You do not include special categories of data unless you have a legal basis and have told us.
3Instructions
We process the data only on your documented instructions; the Terms, your settings and your tasks are those instructions. If we think an instruction breaks data protection law, we tell you.
4Confidentiality and security
Only people bound to confidentiality get access. We take the technical and organisational measures in the annex and keep them up to date.
5Subprocessors
You authorise the providers listed under Service providers. We tell you at least 30 days before adding or replacing one; you may object for good reason and, if we cannot resolve it, cancel. We bind every subprocessor to the same duties.
6Assistance
We help you answer requests from data subjects, with security, data protection impact assessments and consultations, as far as our part of the processing allows.
7Personal data breaches
We tell you without undue delay after we become aware of a breach affecting your data, with the information you need to meet your duties.
8Deletion
When the contract ends we delete the data as described under How long we keep data, unless law requires us to keep it. You can download it before.
9Audits
We give you the information needed to show compliance. On-site audits are possible with reasonable notice, at your cost, at most once a year unless there is a concrete reason.
10Annex: technical and organisational measures
- Encryption in transit (TLS) and at rest; task content, logbook entries and result files with keys managed in a key management service
- Strict separation of accounts in the database; every request checked against the account
- Administrative access limited to the operator and only when needed
- Content-free logs; secrets replaced in progress notes on the user's computer
- Encrypted backups in Frankfurt, expiring after 60 days
- Emergency stop of all tasks per account