DPA · Art. 28 GDPR
Data Processing
Agreement (DPA)
Version 2.1 · Effective from 14 October 2026 · Pursuant to Art. 28 of Regulation (EU) 2016/679
Processor: CAI Technology SRL · Controller: the Platform User
1. The Contracting Parties
This Data Processing Agreement (DPA) governs the processing relationship under Art. 28 GDPR between:
- "the Controller" — the User of the CAI-Deceneu Platform, the natural or legal person who determines the purposes and means of the processing of the personal data they upload to the Platform
- "the Processor" — CAI Technology SRL (CUI RO50512457), which processes the data exclusively on behalf of and under the responsibility of the Controller
2. Subject Matter, Duration, Nature of the Processing
| Element | Description |
|---|
| Subject matter | Provision of automated pentest services (Audit) through the CAI-Deceneu Platform |
| Duration | For the term of the contract between the Controller and CAI Technology, plus the statutory retention periods |
| Nature of processing | Storage, automated analysis (LLM + Nuclei + Nmap), report generation, transmission to the Controller |
| Purpose | Detection of vulnerabilities in the Controller's systems |
| Data categories | Technical scan data (IP, headers, banners, findings); optional personal data (in audited source code — the Controller is responsible) |
| Categories of data subjects | Legal representatives of the Controller; possibly employees of the Controller (in source code) |
3. Obligations of the Processor (CAI Technology)
CAI Technology undertakes to:
- Process the data exclusively on the basis of the Controller's documented instructions (audit launch, signed scope). It does not transfer data to other partners without the Controller's written consent.
- Ensure that the persons authorized to process the data have committed themselves to confidentiality (internal NDAs for all admins).
- Implement appropriate technical and organizational measures under Art. 32 GDPR (see the Security Annex).
- Comply with the conditions for engaging subprocessors (Art. 28(2) and (4) GDPR — see Art. 4 of this DPA).
- Assist the Controller in responding to requests from data subjects (the rights under Art. 15-22 GDPR).
- Assist the Controller in complying with its obligations (DPIA, breach notification 72h).
- On termination of the contract, delete or return all personal data, except for statutory retention.
- Make available to the Controller all the information necessary to demonstrate compliance + allow audits (max 1/year, scheduled).
4. Authorized Subprocessors
The Controller authorizes CAI Technology to use the following subprocessors:
| Subprocessor | Processing purpose | Location | Transfer safeguards |
|---|
| Stripe Payments Europe Ltd. | Payment processing | Ireland + USA | SCC + DPF + PCI DSS L1 |
| Cloudflare Inc. | CDN + WAF (optional) | Global | SCC + ISO 27001 |
| Anthropic PBC | Cloud LLM (optional, Claude) | USA | SCC + DPF + zero-retention API |
| Mistral AI | Cloud LLM (optional) | France | EU + GDPR-compliant |
| Hetzner Online GmbH | Off-site backup hosting | Germany | EU |
CAI Technology will inform the Controller at least 30 days before any change to the list of subprocessors (addition/replacement). The Controller has the right to object, in which case the contract may be terminated by either party without damages.
5. International Transfers
The Controller's data is stored primarily in Romania (EU). Transfers outside the EEA may take place ONLY with:
- Standard Contractual Clauses (Decision (EU) 2021/914)
- An adequacy decision of the European Commission
- EU-US Data Privacy Framework (for the USA, certified subprocessors)
6. Rights of Data Subjects
CAI Technology will:
- Notify the Controller without delay of any request received directly from a data subject
- Assist the Controller in responding to requests (access, rectification, erasure, portability)
- NOT respond directly to data subjects without the Controller's instructions (except in situations where the law requires an urgent response)
7. Data Breach Notification (Art. 33-34 GDPR)
In the event of a personal data breach:
- CAI Technology notifies the Controller within 72h of becoming aware of it, at the latest
- The notification includes: the nature of the breach, the categories and number of data subjects concerned, the likely consequences, the measures taken
- The Controller remains responsible for notifying ANSPDCP (within 72h) and the data subjects (Art. 34)
- CAI Technology assists with technical information and support
8. Audit and Inspection
The Controller has the right to:
- A scheduled annual audit (with 30 days' notice)
- Access to independent audit reports (ISO 27001, SOC 2 if available)
- Access to the data processing logs specific to its contract
The costs of the audit are borne by the Controller. CAI Technology provides reasonable support free of charge.
9. Security (Art. 32 GDPR)
Technical and organizational measures implemented by CAI Technology:
- Encryption: TLS 1.3 in transit; AES-256 at rest for sensitive data
- Password hashing: scrypt (n=16384, r=8, p=1, dklen=32)
- Mandatory MFA for admins and clients
- Audit log: 5-year retention for all actions
- Backup: encrypted, replicated in 2 EU locations
- Access control: 4-level RBAC (viewer/billing/admin/superadmin)
- SOC 24/7: Wazuh SIEM + Suricata IDS + Falco runtime monitoring
- In-house pen-test: CAI-Deceneu uses its own product on itself + an annual external audit
- Incident response: documented plan, exercise every six months
- Network segmentation: separate VLANs, Cisco FPR-1120 firewall
- Staff: signed NDA, annual GDPR + NIS2 training
10. Liability and Compensation
CAI Technology's liability towards the Controller for GDPR breaches caused by its negligence is limited in accordance with Art. 8 of the T&C (up to the amount paid over the last 6 months, capped at 5,000 EUR), except for:
- Intentional breaches or breaches through gross negligence
- Specific cases where the law prohibits the limitation
11. Termination
On termination of the main contract:
- CAI Technology returns the data in portable JSON format within 30 days
- Deletes the active data after their return (at the Controller's written request)
- Keeps only the data that is subject to a statutory retention obligation (audit log 5y, invoices 10y)
- Written confirmation of the deletion on request
12. Final Provisions
12.1 In the event of a conflict between this DPA and the T&C, the provisions of the DPA prevail on data protection matters.
12.2 Unilateral amendments to this DPA are possible only with 30 days' notice and the Controller's right to terminate.
12.3 Language of the agreement — Romanian. The English version is for reference only.
12.4 Governing law: Romanian law. Jurisdiction: the courts of Bucharest.
Version 2.1 · 2026-10-14 · Accepting the Terms and Conditions implies accepting this DPA.
Legal questions: tehnic@caitech.ro