Data Processing
Agreement (DPA).
As Aitamit customer, you are controller and we are processor per GDPR Art. 28. Here we explain the standard EDS DPA contract: roles, mutual obligations, customer rights, sub-processors and international transfers. Available upon request at legal@aitamit.com.
Why you have a DPA with us
When you use Aitamit, you share personal data with us: names, emails, IPs, employee identifiers, technical endpoint data and audit logs. GDPR Art. 28 requires a binding contract with controllers establishing: subject matter and duration of processing, nature and purpose, type of personal data and categories of data subjects, controller obligations and rights.
The standard EDS DPA is available upon request at legal@aitamit.com for all plans. For Enterprise and regulated sectors, specific needs (retention, sector clauses) are assessed case by case together with your legal team.
The service infrastructure (hosting, email and backups) operates in the EU: IONOS VPS in Germany plus EDS-owned infrastructure. The only transfers outside the EU are Stripe (payments) and Anthropic (optional AI assistant), both covered by Standard Contractual Clauses (SCC).
What the DPA covers
Roles and responsibilities
You = controller, you determine purposes and means. EDS = processor, treats data only per your documented instructions. EDS will not use your data for other purposes (no AI training, no cross-marketing, no sellable anonymous aggregates).
Data type and categories
Personal data processed: names, emails, IPs, unique employee identifiers, technical endpoint data (OS version, installed software), timestamped audit logs. Special categories (Art. 9): only if your organization introduces them in notes/comments — Aitamit doesn't request them.
Sub-processors
Public list at /sub-procesadores: IONOS (hosting, Germany), Stripe (payments, US, SCC) and Anthropic (optional AI assistant, US, SCC). 30-day notification before any addition/change/removal. EDS is responsible for its sub-processors' acts as if they were its own.
International transfers
Hosting, email and backups: in the EU (Germany, IONOS + EDS-owned infrastructure). Transfers outside the EU: Stripe and Anthropic, covered by SCC. No other international transfers.
Customer rights
Right to documented instructions and to information about the processing. Right to object to new sub-processors and to terminate the contract without penalty if you don't accept them. EDS assistance in handling data subject rights (access, rectification, erasure).
Terms and termination
DPA valid while you have an active tenant. After cancellation: deletion of your tenant's data and backups within a maximum of 90 days.
Sector annexes and specific needs
We do not maintain pre-existing sector annexes (BAA, DORA, ENS, CCN-STIC). If your regulated sector requires specific clauses, we assess them case by case together with your legal team before contracting. Write to legal@aitamit.com stating the applicable regulatory framework and we will tell you clearly what we can take on and what we cannot.
- Standard DPA available upon request at legal@aitamit.com
- Hosting, email and backups in the EU; Stripe and Anthropic outside the EU with SCC
- Public sub-processor list with 30-day notice
- Deletion of tenant data and backups within a maximum of 90 days after cancellation
- Sector annexes: assessed case by case
DPA questions
Do I have to sign the DPA?
Can I modify the standard DPA?
Is EDS controller or processor?
What happens to data on contract termination?
Request the standard DPA
Write to legal@aitamit.com and we will send you the Aitamit-EDS DPA.