Data Processing Addendum

The customer is the Data Controller of the personal data of the engineers in their connected systems. Evaal is the Data Processor and processes that data only on the customer's documented instructions, as set out in the Pilot Agreement and this DPA.

Categories of personal data: name, work email, role, team, manager, activity metadata from connected systems (review participation, message activity patterns, calendar load), and the metrics and risk scores Evaal computes from that activity.

Categories of data subjects: employees and contractors of the customer who use the connected systems.

Evaal uses a small set of subprocessors for hosting, transactional email, error monitoring, and LLM inference. The current subprocessor list, the regions in which they operate, and the data they receive are available on request.

Evaal will notify customers of any new or replaced subprocessor at least 30 days before the change takes effect, giving the customer the opportunity to object.

Where Evaal transfers personal data outside the EEA or UK, the transfer is governed by the Standard Contractual Clauses (Module Two: Controller to Processor) of Commission Implementing Decision (EU) 2021/914, with the UK addendum where applicable. The clauses are incorporated by reference into this DPA.

Evaal implements the technical and organisational measures described in evaal.ai/security to protect personal data against unauthorised access, disclosure, alteration, and loss.

Evaal will assist the customer in responding to data subject requests (access, correction, deletion, portability) received about the personal data Evaal processes on the customer's behalf. Customers should email hello@evaal.ai with the request.

On termination of the Pilot Agreement or main service contract, Evaal will delete all customer personal data within 30 days, except where retention is required by law. A deletion certificate is available on request.