This Data Processing Agreement (“DPA”) forms part of the agreement between you and us for the use of BizPlan AI Pro Global. It governs the processing of Customer Personal Data and is written to satisfy Article 28 of the EU General Data Protection Regulation, the UK GDPR, India’s Digital Personal Data Protection Act, and — where applicable — the California Consumer Privacy Act as amended by the CPRA.
Executive overview for procurement and legal counsel
This DPA supplements our Terms of Service. By using the Services you enter into this DPA on behalf of yourself and any authorised Affiliates. The current subprocessor list is published at /subprocessors/ and forms part of this DPA.
1. Definitions and construction
Capitalised terms not defined here take the meaning given in the Terms of Service or in applicable Data Protection Legislation.
- “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing”, “Personal Data Breach”, “Supervisory Authority”, and “Appropriate Technical and Organisational Measures” have the meanings given in Regulation (EU) 2016/679 (GDPR).
- “Customer Personal Data” means any Personal Data processed by us on your behalf in connection with the Services, including data contained in plans, uploaded documents, and prompts sent to our model providers.
- “Data Protection Legislation” means all applicable privacy and data-protection law, including the GDPR, the UK GDPR and Data Protection Act 2018, India’s Digital Personal Data Protection Act 2023, the California Consumer Privacy Act as amended by the CPRA, and any implementing national legislation.
- “Standard Contractual Clauses” or “SCCs” means Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for transfers of personal data to third countries.
- “Subprocessor” means any third party engaged by us to assist in providing the Services or infrastructure, as listed at /subprocessors/.
2. Scope, roles and instructions
2.1 Role designation. With respect to Customer Personal Data, you are the Controller (or a Processor acting for a third-party Controller) and we act strictly as Processor.
2.2 Documented instructions. We process Customer Personal Data only on your documented instructions, including with respect to transfers to a third country, unless required otherwise by law to which we are subject — in which case we will inform you before processing, unless that law prohibits us from doing so on important public-interest grounds.
2.3 What counts as an instruction. Your configuration of the workspace, the plans and documents you submit, and the generation requests you dispatch constitute documented instructions to process data for the purpose of producing the output you asked for.
2.4 Purpose limitation. We do not sell Customer Personal Data and do not process it for advertising. We process it to provide the Services, maintain your account, provide support you request, and meet legal obligations.
3. Our obligations as Processor
- Process Customer Personal Data only on your documented instructions, as set out in Section 2.
- Ensure personnel authorised to process Customer Personal Data are bound by confidentiality obligations, with production access restricted to the operator account under least-privilege principles.
- Implement and maintain the Appropriate Technical and Organisational Measures in Annex II.
- Assist you in responding to Data Subject requests under Section 7.
- Assist you in meeting your obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to us.
- Delete or return Customer Personal Data at the end of the Services under Section 6.
- Make available the information in this DPA, our Security page, and our Subprocessors page, and allow audits under Section 9.
- Notify you without undue delay if, in our opinion, an instruction infringes Data Protection Legislation.
4. Your obligations as Controller
- Ensure you have a lawful basis for the Customer Personal Data you submit, including personal data about third parties appearing in a business plan, market analysis, or uploaded document.
- Provide the notices and obtain the consents your processing requires.
- Give instructions that comply with applicable law, and do not instruct processing that would breach it.
- Use the Services in line with the documentation, including keeping your credentials confidential.
5. Subprocessors and international transfers
5.1 General authorisation. You give general written authorisation for us to engage Subprocessors. The approved list, with each provider’s purpose, the data it receives, and its location, is published at /subprocessors/.
5.2 Notice of changes. We give at least thirty (30) calendar days’ prior notice before a new Subprocessor is appointed or an existing one is replaced. You may object on reasonable data-protection grounds within fourteen (14) days of that notice. If we cannot resolve an objection, you may terminate the affected Services and receive a pro-rata refund of prepaid fees.
5.3 Pass-through obligations. We impose data-protection terms on each Subprocessor that offer at least the same level of protection as this DPA, and we remain fully liable to you for their performance.
5.4 International transfers. Our Subprocessors are located in the United States, India, the United Kingdom, and globally distributed infrastructure. To the extent the Services involve a transfer of Customer Personal Data originating in the EEA, Switzerland, or the United Kingdom to a country that does not ensure an adequate level of protection, the parties agree to be bound by the EU SCCs — Module 2 (Controller to Processor) or Module 3 (Processor to Processor) as applicable — and the UK International Data Transfer Addendum, which are incorporated into this DPA.
6. Deletion, return and retention
6.1 Your control during the term. You can delete individual plans and uploaded documents from your workspace at any time; deletion removes them from active storage.
6.2 Post-termination. On termination you may export your plan content. We then retain workspace data for a soft-retention window of 30 days to allow export, after which Customer Personal Data is deleted from active storage and purged from backups within the cycle described in our Security page, except where retention is required by law — for example billing records kept for tax.
6.3 Certification of deletion. On written request we will confirm in writing that deletion has taken place, describing the systems covered.
7. Data subject rights and regulatory assistance
Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests exercising Data Subject rights under Chapter III GDPR — access, rectification, erasure, restriction, portability, and objection. The Services let you access, correct, export, and delete plan content and account data directly.
If we receive a request directly from a Data Subject concerning Customer Personal Data, we will not respond to its substance ourselves; we will redirect the Data Subject to you without undue delay, unless legally required to act.
8. Personal data breach
8.1 Notification. We notify you without undue delay, and where feasible within 72 hours of becoming aware of a verified Personal Data Breach affecting Customer Personal Data.
8.2 Content. The notification describes, as far as then known: the nature of the breach and the categories and approximate volume of data and Data Subjects affected; the likely consequences; the measures taken or proposed to address it; and a contact point for further information.
8.3 Mitigation and documentation. We take reasonable steps to contain and remedy the breach and document the facts, its effects, and the remedial action. We cooperate with you in meeting your obligations to notify Supervisory Authorities or Data Subjects.
9. Audits and information rights
We make available this DPA, the Security page, and the Subprocessors page to demonstrate compliance. On request, you may receive a written response to a security questionnaire once per twelve-month period, or more often where required by a Supervisory Authority or following a Personal Data Breach.
On-site audits are available only where that information is insufficient: on at least thirty days’ notice, during business hours, subject to confidentiality, at your cost, and no more than once per twelve months.
10. Liability and indemnity
Each party’s liability under this DPA is subject to the limitations in the main agreement between us. Nothing in this DPA limits liability that cannot be limited under applicable law, including liability to Data Subjects under Article 82 GDPR.
11. Term, precedence and governing law
This DPA applies for as long as we process Customer Personal Data on your behalf. Where this DPA and the main agreement conflict on a data-protection matter, this DPA prevails.
This DPA is governed by the laws of India, and the courts of India have exclusive jurisdiction over disputes arising out of or in connection with it, without prejudice to any mandatory rights you have under the law of your own country of residence.
12. EU and UK representation
If you are in the European Union or the United Kingdom you may raise any data-protection question or request directly with us at privacy@bizplanaipro.com, and we will respond within the time limits set by the GDPR. We have not appointed a separate Article 27 representative. Where a representative is required for a jurisdiction in which we actively offer the Services, we will designate one and publish their details on this page before doing so.
Annex I — Description of the processing
A. List of parties
Data exporter / Controller: the customer entity subscribing to the Services.
Data importer / Processor: S. Enterprise, operator of BizPlan AI Pro Global at bizplanaipro.com and tools.bizplanaipro.com.
B. Categories of data subjects
Your account holders, and any individuals whose personal data appears in content you submit — for example a named founder, employee, or customer described in a business plan.
C. Categories of personal data
Name, email address, bcrypt-hashed password, authentication and session tokens, IP address and device metadata, uploaded document text, business and financial information you enter, and generated plan output. We do not request special-category data; if you include it, you determine the lawful basis.
D. Nature and frequency of the transfer
Continuous processing for the duration of your subscription, triggered by your use of the Services and by the generation requests you dispatch.
E. Competent supervisory authority
The supervisory authority of the EU Member State in which you are established, or where you have designated an EU representative under Article 27 GDPR. For customers in the United Kingdom, the Information Commissioner’s Office. For customers in India, the Data Protection Board of India.
Annex II — Technical and organisational measures
Pursuant to Article 32 GDPR, we maintain the following controls across the production environment:
1. Encryption in transit. All traffic is served over HTTPS with TLS, with plain HTTP redirected. Traffic reaches the application through an nginx reverse proxy.
2. Credential protection. Passwords are stored only as bcrypt hashes; plain-text passwords are never stored or logged. Sessions use signed JSON Web Tokens with an expiry, delivered in an HttpOnly cookie, with a bearer-token fallback for authenticated application routes.
3. Administrative access control. Administrative API routes require an administrator-level token in addition to a valid session, and reject requests that lack one. Production system access is restricted to the operator account on the application server.
4. Input handling. User-supplied content is sanitised before rendering (DOMPurify) to mitigate cross-site scripting. Database access uses parameterised queries. Uploaded files are parsed by dedicated document parsers rather than executed.
5. Payment data segregation. Card data never enters our systems. Payment details are captured on the hosted checkout of the payment processor, and we receive only payment status and the identifiers needed to provision your plan.
6. Model provider data handling. Generation requests are sent to paid API endpoints of our model providers for the sole purpose of returning a result. Per those providers’ published API terms, data submitted through their APIs is not used to train their foundation models. We do not train models on Customer Personal Data.
7. Data at rest and logging. Customer data is stored in a MySQL database on the application server. We do not currently apply application-level encryption at rest; protection relies on restricting server access to the operator account, together with the transport encryption described above. Web-server access logs are retained on the server for a limited rolling period for security and troubleshooting.
How to execute this DPA
Write to privacy@bizplanaipro.com with your legal entity name, registered address, and the email address on your account. We return a countersigned copy referencing your account. Business customers requiring a signed agreement before purchase can request one in advance.
Related documents
- Security — the technical measures in plain language
- Subprocessors — the current vendor list
- Privacy Policy — collection, purposes, and your rights
- Terms of Service — the main agreement