Data Processing Agreement

This DPA applies when Tagsight processes personal data on behalf of the Customer in connection with the Service. The Customer is the Controller; Tagsight is the Processor. Processing is limited to what is necessary to provide the instrument extraction Service described in our Terms of Service.

Tagsight shall:

• Process personal data only on documented instructions from the Controller, unless required by applicable law.
• Ensure that persons authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement appropriate technical and organizational security measures as described on our Security page.
• Engage sub-processors only with prior authorization and in accordance with Section 5 of this DPA.
• Assist the Controller with data subject access requests, taking into account the nature of processing.
• Assist the Controller with obligations related to data protection impact assessments and prior consultation with supervisory authorities, where applicable.
• At the Controller's choice, delete or return all personal data upon termination of the Service, and delete existing copies unless storage is required by applicable law.
• Make available all information necessary to demonstrate compliance with these obligations.

Tagsight uses the following categories of sub-processors to provide the Service:

• Cloud hosting provider — application hosting, database, and file storage.
• Payment processor — billing and subscription management. Processes payment card data directly; Tagsight never receives card numbers.
• Email delivery service — transactional and notification email delivery.
• AI processing service — document analysis for instrument extraction. Uploaded files are not used for model training by this provider.
• CDN and security provider — content delivery, DDoS protection, and DNS services.

Notification of changes: Tagsight will notify the Controller via email at least 30 days before engaging a new sub-processor. The Controller may object to a new sub-processor within 15 days of notification. If the objection cannot be resolved, either party may terminate the affected Service.

In the event of a personal data breach, Tagsight will notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach. The notification will include:

• The nature of the breach, including categories and approximate number of data subjects and records affected.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its effects.
• Contact details for further information.

The Controller may audit or appoint a qualified third-party auditor (subject to confidentiality obligations) to verify Tagsight's compliance with this DPA, subject to the following conditions:

• At least 30 days advance written notice.
• During normal business hours.
• No more than once per twelve-month period, unless a data breach has occurred or a supervisory authority requires an audit.
• The Controller bears the costs of the audit.

This DPA is effective for the duration of the service agreement between the Controller and Tagsight. Upon termination, Tagsight will, at the Controller's choice, delete or return all personal data within 30 days, except where retention is required by applicable law. Obligations regarding confidentiality and data security survive termination.