AI4Business Data Processing Agreement
This Data Processing Agreement (DPA) forms part of the agreement between HUB4AI S.R.L., with registered office at 4-8 Nicolae Titulescu Ave., America House, West Wing, Bucharest, Romania (Hub4AI, Processor, we, us) and the Customer named in the applicable Order (Customer, Controller, you). It applies where Hub4AI processes Personal Data in Customer Materials on the Customer’s documented instructions when providing AI4Business.
1. Scope and hierarchy
This DPA applies to processing subject to Article 28 GDPR and, where applicable, the UK GDPR or other data-protection law identified in the Order. The Terms, Privacy Notice, Order, AI Product Schedule and applicable Standard Contractual Clauses (SCCs) remain part of the contract stack.
For Customer Materials, this DPA prevails over inconsistent processor terms in the Terms. Mandatory law and applicable SCCs prevail to the extent required. This DPA does not override the Privacy Notice for Hub4AI’s independent controller processing; the Privacy Notice remains the statutory transparency notice for that processing.
2. Definitions
Customer Materials means Customer Inputs, saved chats, files, prompts, projects, workflows, connected-source content and Outputs processed for the Customer.
Data Protection Law means the GDPR, the UK GDPR where applicable, and binding national laws implementing or supplementing them.
Personal Data, processing, Controller, Processor, Personal Data Breach, data subject and Supervisory Authorityhave the meanings in Data Protection Law.
Subprocessor means a third party engaged by Hub4AI to process Customer Personal Data on behalf of the Customer.
3. Customer instructions and responsibilities
The Customer instructs Hub4AI to process Customer Personal Data only as necessary to provide, secure, support and maintain AI4Business in accordance with the Contract, the configured Service features, the Customer’s documented use of the Service, and this DPA. Processing details are set out in Appendix 1.
The Customer is responsible for: (a) determining that its instructions and use are lawful; (b) providing required notices and obtaining a valid legal basis and, where required, Article 9 condition; (c) ensuring the accuracy, relevance and proportionality of Customer Materials; (d) controlling Authorised User permissions, approved engines and Connectors; and (e) obtaining any necessary rights, licences and permissions for Customer Materials and Connector data.
The Customer must not use the Service for a prohibited AI practice or an unapproved High-Risk Use. Special-category data, criminal-offence data, children’s data, regulated secrets, production credentials and localisation-restricted data may be processed only where the Order, AI Product Schedule and applicable safeguards expressly permit the use.
4. Hub4AI’s processing obligations
Hub4AI will:
- process Customer Personal Data only on documented Customer instructions, unless Data Protection Law requires otherwise; where law requires processing, Hub4AI will notify the Customer before processing unless law prohibits notice;
- promptly inform the Customer if an instruction infringes Data Protection Law or, in Hub4AI’s reasonable view, creates a material security or fundamental-rights risk, unless law prevents that notice;
- ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty of confidentiality;
- implement the technical and organisational measures in Appendix 2 and Article 32 GDPR;
- assist the Customer as required by Articles 28(3)(e) and (f) GDPR, taking into account the nature of processing and the information available to Hub4AI; and
- make available the information reasonably necessary to demonstrate compliance with this DPA, subject to security, confidentiality and trade-secret safeguards.
Hub4AI will not use Customer Materials or Outputs to train or fine-tune a shared or general-purpose AI model. Hub4AI contracts with each offered AI provider to prohibit training on, or resale of, Customer Materials and Outputs. This does not prevent processing required to provide the selected Service, manage security or abuse, comply with law, or use information that has been rendered effectively anonymous.
5. Confidentiality and restricted human access
Hub4AI restricts human access to Customer Materials to persons with a documented need and applies least-privilege, logging and confidentiality controls. Access to retained AI Gateway prompt and Output content is limited to Hub4AI’s Chief Executive Officer and Chief Technology Officer. Each such access is logged and is permitted only for: (a) Customer-requested troubleshooting of the Customer’s session; (b) investigation of a substantiated security, abuse or AI-provider policy alert; (c) compliance with a valid binding legal demand; or (d) a verified Customer Administrator request concerning that Customer’s dedicated cluster for a legitimate Customer purpose, including an internal investigation, protection of Customer intellectual property, compliance or e-discovery.
Hub4AI will verify administrator authority and the scope of an administrator request. It may refuse or limit a request where needed to protect rights, confidentiality, security or law. A private-chat interface does not prevent this Customer-directed disclosure process.
6. Security measures
Hub4AI will implement the measures in Appendix 2. Hub4AI maintains ISO 27001 and ISO 9001 certification within the scope shown in its current certificates. No security measure eliminates all risk; the Customer remains responsible for its endpoints, user provisioning, Microsoft Entra ID configuration, multi-factor authentication, credentials, permitted engine catalogue and exports.
The standard AI4Business environment provides each Customer a dedicated single-tenant Microsoft Azure cluster in the European Union. The AI Gateway and self-hosted service analytics operate in that EU environment. In Auto mode, AI processing remains entirely in the EU. An Administrator may restrict the permitted engine catalogue. Personal Data leaves the EU only where an Authorised User deliberately selects an engine labelled USA or Global, subject to the transfer controls below.
7. Personal Data Breaches
Hub4AI will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will include available information reasonably needed for the Customer to comply with Articles 33 and 34 GDPR, including the nature of the breach, categories and approximate number of affected data subjects and records where available, likely consequences, measures taken or proposed, and a contact point.
Hub4AI will investigate, mitigate and document the breach and provide reasonable further information as it becomes available. The Customer is responsible for deciding whether to notify a Supervisory Authority or data subjects, unless applicable law requires Hub4AI to do so.
8. Assistance with data-subject requests, DPIAs and regulators
Taking account of the nature of processing, Hub4AI will provide reasonable assistance through the Service or support process to enable the Customer to respond to data-subject requests. If Hub4AI receives a request relating to Customer Materials, it will promptly forward it to the Customer unless legally prohibited or unless responding is necessary to meet a legal duty. Hub4AI will not respond substantively except on the Customer’s documented instruction or where law requires it.
Hub4AI will provide reasonable information and assistance for data-protection impact assessments, prior consultations and regulator enquiries related to the Service, considering the information available to Hub4AI. Bespoke assessments, audits, workshops or documentation beyond standard assistance may be chargeable under the applicable Order.
9. Subprocessors
The Customer gives Hub4AI general written authorisation to engage Subprocessors listed in the current subprocessor and AI engine register at https://hub4ai.com/Hub4AI_Subprocessor_and_Engine_Register/. Hub4AI will impose written data-protection obligations on each Subprocessor that are no less protective than the applicable obligations in this DPA, and remains responsible for that Subprocessor’s performance to the extent required by Data Protection Law.
Hub4AI will give the Customer at least 30 days’ prior written notice of a proposed new or replacement Subprocessor, except where an urgent replacement is reasonably necessary for security, legal compliance or service continuity. The Customer may object on reasonable data-protection grounds during that period by written notice. The parties will discuss a good-faith solution. If no reasonable solution is available, Hub4AI may discontinue the affected feature or the Customer may terminate the affected portion of the Service and receive a pro-rata refund of prepaid unused fees for that portion. Objections must be specific, proportionate and supported by the Customer’s data-protection requirements.
10. International transfers
Hub4AI will not transfer Customer Personal Data outside the EEA or permit a Subprocessor to do so except on the Customer’s documented instruction, including deliberate selection of a USA or Global engine, and subject to Chapter V GDPR. Hub4AI will use an adequacy decision where available or appropriate safeguards, normally the applicable 2021 SCCs with a transfer assessment and supplementary measures where required.
The Service labels available engines as Auto, EU, USA or Global. Auto and EU routes process and store Customer Personal Data in the EU. USA routes process and store Customer Personal Data in the United States. Global routes may process in provider global data centres and store data at rest in the United States. Current production routes may involve Microsoft Azure, Google Cloud Platform, AWS, OpenAI or Anthropic as shown in the register. The Customer remains responsible for selecting a route suitable for its use case and for any additional transfer or localisation requirements.
11. Audit and compliance evidence
On reasonable written notice and no more than once in any 12-month period, the Customer may audit Hub4AI’s compliance with this DPA, or appoint an independent auditor bound by confidentiality. Audits must be during normal business hours, avoid unreasonable disruption, follow Hub4AI’s security rules and not reveal other customers’ information, personal data, vulnerabilities or trade secrets.
Hub4AI may satisfy an audit request by providing current ISO certificates, independent audit reports, third-party assurance reports, penetration-test summaries, completed security questionnaires or other relevant documentary evidence, where this reasonably demonstrates compliance. An on-site audit is permitted only where such evidence is insufficient, the Customer reasonably requires it for a material compliance reason, and the parties agree the scope and safeguards in advance. The Customer bears its audit costs and reimburses reasonable Hub4AI costs for a Customer-requested audit unless a material non-compliance is identified.
12. Return, deletion and retention
During the Contract, the Customer may access, export and delete Customer Materials using the Service, subject to the configured permissions and the Contract. On termination or a switching transition, Hub4AI will make Exportable Data and Digital Assets available under the Terms and EU Data Act switching provisions.
AI Gateway prompt and Output content is retained for exactly 30 days and then automatically deleted. Gateway usage, cost, reliability and security metadata is retained for the Contract term plus four years. Provider runtime retention is typically no more than 30 days, subject to documented safety, legal or stateful-feature exceptions in the engine register.
After the applicable retrieval, legal-hold and mandatory retention period, Hub4AI permanently deletes the Customer’s dedicated cluster within 30 days and will provide a deletion certificate on written request. Backups and legal-hold copies are isolated from ordinary use and deleted on their verified cycle. Hub4AI may retain information where law requires it or where it has been rendered effectively anonymous.
13. Term and termination
This DPA takes effect when Hub4AI begins processing Customer Personal Data and continues for as long as Hub4AI processes it. Termination of the Contract terminates this DPA except to the extent processing continues under the return, deletion, legal-hold, transfer or survival provisions.
14. Liability and general terms
The liability, exclusions, indemnities, governing law, jurisdiction, notices and general terms in the Terms apply to this DPA. Nothing in this DPA limits a data subject’s rights under GDPR Article 82 or liability that cannot lawfully be excluded or limited. The parties will cooperate in good faith to execute updated SCCs or amendments required by Data Protection Law.
Appendix 1 – Processing details
Subject matter and duration
Processing supports provision of AI4Business during the Subscription Term and the retention, export, switching and deletion periods described in the Contract and this DPA.
Nature and purpose
Hosting, storage, retrieval, transmission, AI inference routing, generation of Outputs, account administration, authentication, permissions, usage metering, security, abuse prevention, support, backup, deletion, export, switching and compliance with legal duties.
Categories of data subjects
Customer personnel, contractors, administrators, end users, customers, suppliers, prospects, contacts and other individuals whose Personal Data the Customer submits, retrieves through a Connector or includes in Customer Materials.
Categories of Personal Data
Business contact and account data; authentication, role and permissions data; prompts, messages, files, documents, emails, connected-source data, projects, workflows, templates and Outputs; Connector credentials; usage, diagnostic, security, billing and support data. The Customer controls whether Customer Materials contain special categories, criminal-offence data or children’s data, subject to the Contract restrictions.
Processing operations
Collection from the Customer, Authorised Users or configured systems; recording; organisation; structuring; storage; adaptation; retrieval; consultation; AI inference; transmission; disclosure to authorised recipients or Subprocessors; alignment; restriction; erasure; destruction; and other operations necessary to provide the Service on documented instructions.
Appendix 2 – Technical and organisational measures
Hub4AI maintains measures appropriate to risk and reviews them periodically. The following is a summary, subject to the current DPA security annex and evidence provided under the audit clause.
| Control area | Measures |
| Tenant separation and hosting | Dedicated single-tenant Customer cluster hosted in Microsoft Azure in the EU; EU-hosted AI Gateway and self-hosted analytics environment. |
| Identity and access | Microsoft Entra ID authentication, mandatory multi-factor authentication, individual accounts, role-based permissions, least privilege and periodic access review. |
| Encryption | Encryption in transit and at rest; encrypted Connector tokens; from version 2.9, designated browser-cache content encrypted with the relevant key stored in a cookie. |
| Gateway content | Prompt and Output content retained for exactly 30 days and automatically deleted; CEO/CTO-only human access under the logged, documented scenarios in this DPA. |
| Routing and transfers | Auto and EU routes remain in the EU; USA and Global routes require deliberate user selection and Chapter V GDPR safeguards. Administrators may restrict the engine catalogue. |
| Security operations | Monitoring, logging, incident response, vulnerability management, secure development, backup, recovery and abuse-prevention controls. |
| Supplier management | Written subprocessor terms, no-training/no-resale provider commitments, subprocessor register and 30-day change notice. |
| Assurance | ISO 27001 and ISO 9001 certification within the scope stated in current certificates; documentary audit evidence and limited audit procedure. |
Appendix 3 – Subprocessor and AI engine categories
The current register at https://hub4ai.com/Hub4AI_Subprocessor_and_Engine_Register/ is incorporated by reference and must be completed before signature. It identifies the legal entity, function, location, transfer safeguard, retention and change-notice status for each live route.
| Category | Purpose | Typical processing location |
| Microsoft Azure | Dedicated customer cluster, hosting, storage, AI Gateway and EU analytics | European Union |
| Google Cloud Platform and AWS | Selected AI-engine routing where enabled | EU, USA or Global according to label |
| OpenAI and Anthropic | Selected AI inference route where enabled | USA or Global according to label |
| Microsoft Entra ID | Authentication and identity management | As disclosed by Microsoft and the configured tenant |
| Microsoft Office APIs and marketplace | Add-in functionality and procurement channel | As selected by Customer/channel |
| Customer-enabled Connectors | Retrieve, analyse or write data on Customer instruction | As selected by Customer |