Data processing agreement

1. Parties

• Controller: the client company that uses Adjudica (the "Client"), identified in the subscription.
• Processor: José Brandão, who provides the Adjudica service, [address and NIF to be stated on the invoice]. Email: suporte@adjudica.eu.

2. Subject matter

Adjudica processes personal data on behalf of the Client only to provide the contracted service: access accounts, email alerts, decisions on tenders and invoicing. This agreement applies for as long as the Client has an active account and supplements the Terms and the privacy policy.

3. What data, and whose

• Data subjects: the people in the Client's company who use Adjudica.
• Data: email, password (only in an encrypted form), the company's NIF (tax number), the decisions and actions in the app, the alert sending records and the IP address of sign-in attempts (24 hours).
• We do not process special categories of data (health, origin, opinions) or card data: payments are made through an external payment processor.

4. What Adjudica undertakes to do

• Process the data only in accordance with the Client's instructions, which are those that result from the normal use of the service.
• Ensure that anyone who accesses the data is bound by confidentiality.
• Maintain appropriate security measures (art. 32.º): account data is kept on servers in the European Union, access to it is restricted to those who need it to provide the service, we make backups every day, passwords are stored encrypted, so that no one can read them, and the documents the Client uploads to the company file are stored encrypted.
• Help the Client respond to requests from data subjects (access, rectification, erasure, portability, objection).
• Notify the Client without undue delay, and whenever possible within 48 hours, if it becomes aware of a data breach affecting the Client, with what is known at the time.
• Provide the Client with the information needed to demonstrate compliance with this agreement and answer its questions in writing.
• At the end of the contract, delete the Client's data: the "Delete account" button deletes it immediately; what remains in the backups disappears when they are replaced.

5. Sub-processors

The Client authorises Adjudica to use these sub-processors, each one only for its own part:

• Website and app hosting: Hosts the website and the app. European Union.
• Data storage: Stores the account data. European Union.
• Email delivery: Sends the app emails and receives the support emails. European Union.
• Payment processing: Handles the subscription payments. Card details are kept only by the payment processor. European Union and USA.
• AI models: Reads the public tender documents and answers the questions you ask about them. Only those documents and the text of the question are sent, never your email or data about your company. USA, under standard contractual clauses.
• Product analytics: Pages viewed and actions in the app linked to an internal account code (no email, NIF or name); session recordings only inside the app, with all text and all fields masked. No IP address. European Union.
• Scheduled tasks and backups: Daily load of contracts, sending of alerts and storage of the weekly backup, which leaves encrypted. USA.

Before adding or replacing a sub-processor, we will notify the Client by email 30 days in advance. If the Client does not agree, it may cancel the subscription at no cost before the change. Each sub-processor is bound to protect the data at least as much as this agreement requires.

6. Transfers outside the European Union

Account data is on servers in the European Union. When a sub-processor processes data outside the European Union, it does so under the standard contractual clauses approved by the European Commission. This is the case for the reading by artificial intelligence, which takes place in the United States; on the Enterprise plan we agree in writing that it takes place in the European Union. What we do to protect the data, in plain language, is set out in Security and data.

7. Duration and signature

This agreement lasts for as long as the Client uses Adjudica. If you need a signed version, write to suporte@adjudica.eu with the name, the NIF and the address of your company; we will send you back the completed agreement for signature.