1. Roles
The Customer is the data controller. Fideria is the data processor acting on the Customer's documented instructions. Where Fideria determines the purposes and means of processing (e.g. billing, security telemetry), Fideria is the controller for that limited purpose and the Privacy Policy applies.
2. Subject-matter and duration
Fideria processes Customer Personal Data to provide the AI Investment Overview platform for the duration of the subscription and any wind-down period agreed in the Terms of Service.
3. Nature and purpose of processing
- Hosting, storing, and displaying Customer content in the platform.
- Processing usage, spend, and governance data to compute portfolio insights.
- Providing support, security monitoring, and audit-log functionality.
4. Categories of data subjects and data
- Data subjects: Customer's employees, contractors, and authorized users.
- Personal data: name, business email, job title, department, role, IP address, product usage.
- No special categories of personal data are required by the Service.
5. Customer instructions
Fideria will process Customer Personal Data only on the Customer's documented instructions, including those given through the Service configuration and the Terms of Service, unless required otherwise by EU or Member-State law.
6. Confidentiality
Personnel authorized to process Customer Personal Data are bound by confidentiality obligations of at least equivalent scope to those in the Terms of Service.
7. Security measures (Art. 32)
- Encryption in transit (TLS 1.2+) and at rest for stored customer data.
- Row-Level Security enforcing organization-scoped access on every query.
- Role-based access controls, least-privilege administration, and audit logging of privileged actions.
- SSO (SAML) for enterprise identity federation; MFA available via the identity provider.
- Segregated development, preview, and production environments.
- Regular backups and a documented incident-response process.
8. Sub-processors
Fideria uses vetted sub-processors under written data-processing terms. A current list is available at /sub-processors. Customers may object to material changes within 14 days of notification, in which case the parties will discuss a reasonable resolution, including termination.
9. International transfers
Where personal data is transferred outside the EU/EEA, Fideria relies on the European Commission's Standard Contractual Clauses (SCCs) and applies supplementary measures as required. Primary hosting is located within the EU.
10. Data subject requests
Fideria will, taking into account the nature of the processing, assist the Customer by appropriate technical and organizational measures to respond to requests from data subjects to exercise their rights under Chapter III of the GDPR.
11. Personal data breach
Fideria will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide information reasonably needed for the Customer to meet its own notification obligations.
12. Deletion and return
On termination or at the Customer's request, Fideria will delete or return all Customer Personal Data, unless retention is required by applicable law. Backup copies are purged on the standard rotation cycle (max 35 days).
13. Audits
The Customer may request evidence of Fideria's compliance with this DPA once per 12-month period. Fideria will respond with reasonable documentation (security overview, sub-processor list, control descriptions). On-site audits are available on request under reasonable notice and confidentiality terms.
14. Contact
Data protection questions: privacy@fideria.ai. To execute this DPA as a counter-signed agreement, contact legal@fideria.ai.
Annex A — Fideria as data processor
Fideria AB · [ORG_NR] · [REGISTERED_ADDRESS] · Data protection contact: privacy@fideria.ai.
Note: bracketed fields will be filled in the counter-signed version.