EndWiz Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") supplements the EndWiz Terms of Service ("Main Agreement") entered into by and between EndWiz ("Data Processor") and the Customer purchasing or utilizing connected cloud services ("Data Controller"). This DPA governs the processing of Personal Data in accordance with Article 28 of the General Data Protection Regulation (GDPR) (EU) 2016/679.

1. Scope and Applicability

This DPA applies exclusively to transient technical personal data transmitted to Data Processor’s connected cloud endpoints (such as AI processing requests, package mapping, and version checking) initiated from Customer’s self-hosted EndWiz deployment.

2. Roles and Instructions

• Roles: Customer is the Data Controller; EndWiz is the Data Processor.
• Instructions: Processor shall process personal data solely on documented instructions from Controller, including with respect to transfers of personal data to third countries or international organizations.

3. Technical & Organizational Security Measures

Processor implements state-of-the-art security measures to protect transient data:

• EU Data Residency: All infrastructure, database services, and endpoints are hosted strictly within Azure Denmark.
• Private AI Infrastructure: Connected AI workloads run on private, dedicated NVIDIA Blackwell-based server hardware isolated within the EU.
• Zero Data Retention (ZDR): Data submitted to AI processing APIs is processed transiently in-memory and is never written to persistent disk storage, logged, or retained following payload response completion.
• Encryption: Data in transit is encrypted using TLS 1.3 or modern standard encryption protocols.

4. Sub-processors

Controller grants general authorization to Processor to engage infrastructure sub-processors. Current sub-processors are limited to:

Processor shall inform Controller of any intended changes concerning the addition or replacement of sub-processors, giving Controller the opportunity to object.

5. Incident Notification

In the event of a confirmed personal data breach affecting Processor’s connected endpoints, Processor shall notify Controller without undue delay (and in any event within 48 hours of becoming aware) and provide information necessary for Controller to fulfill GDPR reporting obligations.

6. Data Subject Rights & Assistance

Taking into account the nature of the processing and the Zero Data Retention architecture, Processor shall assist Controller by appropriate technical measures, insofar as possible, to fulfill Controller's obligations to respond to data subjects' requests under GDPR Chapter III.

7. Deletion and Return of Data

Due to the self-hosted nature of EndWiz and the Zero Data Retention policy for connected services, no Customer operational data resides on Processor systems. Upon termination of the Main Agreement, transient processing automatically ceases.

8. Governing Law

This DPA shall be governed by and construed in accordance with the laws of Denmark, and any disputes shall be subject to the jurisdiction of the Danish courts.