Your data. Your instructions.

"Customer Personal Data" means personal data submitted to, stored in, or otherwise processed by Sense on Customer's behalf. "Data Protection Laws" means privacy and data-protection laws applicable to that processing, including the EU GDPR and UK GDPR where applicable.

Customer is the controller or business and Decionis is the processor or service provider for Customer Personal Data. Customer is responsible for its instructions, notices, legal bases, permissions, and the lawfulness of data supplied to Sense. Decionis will notify Customer if an instruction appears to violate applicable Data Protection Laws, unless legally prohibited from doing so.

Subject matter and purpose

Decionis processes Customer Personal Data to authenticate users, operate customer workspaces, connect authorized sources, produce judgments and contradiction findings, preserve customer-selected evidence and decision records, provide support, secure the service, and perform the agreement.

Duration

Processing continues for the term of the agreement and any documented return, export, backup, legal-retention, or deletion period described below.

Data subjects

Data subjects may include Customer's users, team members, contractors, collaborators, customers, candidates, and other people referenced in content Customer elects to process.

Categories of personal data

Customer Personal Data may include account and workspace identifiers; business contact and profile information; work artifacts, excerpts, tasks, meetings, issue and page metadata; judgments, findings, evidence hashes, and decision records; connector authorization metadata; and operational security and audit data. Sense is not designed for special-category or highly regulated personal data unless the parties expressly agree in writing.

The agreement, Customer's configuration and authorized use of Sense, and written support requests are Customer's documented instructions. Decionis will process Customer Personal Data only on those instructions, including for transfers, unless law requires other processing. If law requires other processing, Decionis will inform Customer before it occurs unless the law prohibits notice.

Decionis will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive access only where needed for their responsibilities.

Decionis maintains technical and organizational measures designed for the nature of the processing and the risks to data subjects. These measures include:

• HTTPS/TLS for data in transit.
• Encrypted server-side credential storage and exclusion of OAuth tokens from connector responses and application logs.
• Tenant-aware authorization, scoped device credentials, and least-privilege connector access.
• In-browser redaction of common personal and secret-like values before browser-extension transmission.
• Content hashing and derived evidence records where raw source text is not required for the selected feature.
• Backups, service monitoring, change controls, incident response, and recovery procedures appropriate to the service.

Customer authorizes Decionis to use subprocessors needed to provide Sense. Decionis remains responsible for each subprocessor's performance of its data-protection obligations and requires protections materially consistent with this DPA.

Decionis will publish changes to this list and provide reasonable advance notice of a new subprocessor where Data Protection Laws require it. Customer may object on reasonable data-protection grounds by contacting privacy@decionis.com within 15 days of notice. The parties will work in good faith on a reasonable alternative; if none is available, either party may terminate the affected service.

Taking into account the nature of processing and information available to Decionis, Decionis will reasonably assist Customer with verified data-subject requests, security obligations, data protection impact assessments, and regulator consultations. Customer remains responsible for responding to requests and may use available workspace controls before requesting assistance.

Decionis will notify Customer without undue delay after confirming a personal-data breach affecting Customer Personal Data and will provide available information reasonably needed for Customer's legal notifications. Notice is not an admission of fault or liability.

During the agreement, Customer may use available export, share, revocation, connector, and deletion controls. After termination or a verified deletion request, Decionis will delete or return Customer Personal Data within 30 days unless Customer requests an earlier technically available export or law requires retention. Data retained by law will remain protected and isolated from ordinary product use.

Decionis will not transfer Customer Personal Data across borders except as permitted by Data Protection Laws. Where a restricted transfer requires a transfer mechanism, the parties incorporate the European Commission Standard Contractual Clauses, Module Two (controller to processor), as updated or replaced, with Customer as data exporter and Decionis as data importer. The UK International Data Transfer Addendum applies where required for UK transfers.

Decionis will make information reasonably necessary to demonstrate compliance with this DPA available to Customer. No more than once annually, unless required by a regulator or after a confirmed incident, Customer may request a reasonable audit. Audits must protect other customers, confidentiality, security, and service availability, and Customer bears its costs unless the audit identifies material noncompliance by Decionis.

If this DPA conflicts with the agreement on processing Customer Personal Data, this DPA controls. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses control. The remainder of the agreement stays in effect.

This DPA is offered electronically and does not require a separate signature where Customer has accepted the agreement online. For a countersigned copy, privacy questions, or a subprocessor objection, contact the address below.