Data Processing Agreement

Preamble

This Data Processing Agreement (the DPA) is offered to business customers of Decret (the Service) by Sorenor, LLC, a Delaware limited liability company (Delaware file number 10762175), which operates the Service (Decret or Processor). Mailing address: 2810 N Church St STE 90277, Wilmington, DE 19802, United States. It is intended to satisfy Article 28 of the EU GDPR and the UK GDPR in respect of processing carried out when the Service is used. Notification periods in clause 10 are contractual targets. Continuous 24-hour incident staffing is not represented as implemented.

A signed counterpart, or the European Commission’s Article 28 standard contractual clauses on Decret letterhead, may be requested at hello@decret.ai. This version applies when the Customer uses the workspace under the Terms of Service, unless a signed DPA provides otherwise.

1. Parties and precedence

Customer means the business that holds the Decret account and determines the purposes and means of processing Customer Data. Decret processes that data to provide the Service. This DPA is incorporated into the Terms of Service. In the event of conflict on data-protection matters, this DPA prevails, and the Standard Contractual Clauses, where they apply, prevail over both (clause 8). The Privacy Policy describes processing for which Decret is controller and is not a substitute for this DPA.

2. Definitions

Applicable Data Protection Law means the UK GDPR, the Data Protection Act 2018, the EU GDPR, and any national law applying to the processing, including, where relevant, Romanian Law no. 190/2018. Customer Data means personal data processed by Decret on the Customer’s behalf in the workspace (Annex A). Subprocessor means a third party engaged by Decret to process Customer Data. Controller, processor, personal data, personal data breach, and supervisory authority have the meanings given in Applicable Data Protection Law.

3. Roles

The Customer is the controller of Customer Data or, if itself a processor, warrants that it is authorised to appoint Decret as a subprocessor. Decret is the processor. Each party shall comply with the obligations applying to its role. The Customer is responsible for the lawfulness of data it uploads, including notices to data subjects whose data appear on drawings or site records, and shall not instruct Decret to process data in violation of law.

Decret is an independent controller of account, billing, and website data, as described in the Privacy Policy. That processing is outside the scope of this DPA.

4. Instructions

Decret shall process Customer Data only on documented instructions from the Customer, including this DPA, the Terms of Service, and actions taken in the Service (upload, generate, export, delete), unless Union, Member State, or United Kingdom law requires otherwise, in which case Decret shall inform the Customer unless prohibited by law.

The Service includes automated extraction and model inference. Use of those functions constitutes an instruction to process Customer Data for that purpose, including transmission to subprocessors in Annex C. The Customer shall not upload special-category data unless the parties have agreed additional terms. The Service is not designed as a health-record or human-resources system.

If Decret reasonably believes an instruction infringes Applicable Data Protection Law, it shall inform the Customer and may decline to follow that instruction pending clarification.

5. Confidentiality

Decret shall ensure that persons authorised to process Customer Data are subject to a confidentiality obligation (contractual or statutory) and access Customer Data only as required to provide, secure, or support the Service.

6. Security

Taking into account the state of the art, the costs of implementation, the nature of the data (construction files that may be commercially sensitive, and limited personal data), and the risk, Decret shall implement appropriate technical and organisational measures as summarised in Annex B and the Security Measures document. Decret is not presently certified under SOC 2, ISO/IEC 27001, or equivalent schemes. Security controls are designed with reference to widely recognised frameworks, including the control themes commonly associated with ISO/IEC 27001 and SOC 2. Measures may evolve. Decret shall not materially reduce the overall level of protection without notice.

7. Subprocessors

The Customer gives general written authorisation for Decret to engage the subprocessors listed in Annex C and to add or replace subprocessors as this clause provides. Decret engages each under a written contract with data protection obligations equivalent to those in this DPA and remains responsible for their performance as required by Article 28(4).

Decret shall maintain a current list (this page or a successor URL) and shall give the Customer at least fourteen (14) days’ notice before adding or replacing a subprocessor that processes Customer Data, by updating this page and, where it holds an account email, by sending notice. The Customer may object on reasonable data-protection grounds within that period. If Decret cannot accommodate the objection, the Customer may terminate the affected Service as its sole remedy for the objection. Emergency replacements (security incident or provider failure) may occur on shorter notice; Decret shall notify as soon as practicable.

Annex C names the subprocessors Decret uses at the date of this DPA, with what each does, where it processes Customer Data and the safeguard for any transfer.

8. International transfers

8.1 Where Customer Data is. Customer Data is stored in the EEA, in AWS Europe (Frankfurt), as Annex C states. Decret is established in the United States, and its personnel and some of its subprocessors process Customer Data from outside the EEA and the United Kingdom.

8.2 Standard Contractual Clauses. To the extent that providing the Service involves a transfer of Customer Data from the Customer to Decret that the EU GDPR restricts, the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the SCCs) are incorporated into this DPA by reference, with the Customer as data exporter and Decret as data importer, and are completed as follows:

• Module Two applies where the Customer is a controller, and Module Three where the Customer is a processor;
• the optional docking clause in Clause 7 applies;
• in Clause 9, Option 2 (general written authorisation) applies, with the notice of at least fourteen (14) days and the right to object in clause 7 of this DPA;
• in Clause 11, the optional language does not apply;
• in Clause 13, the competent supervisory authority is the one responsible for the Customer as data exporter, as Annex D sets out;
• in Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland;
• in Clause 18(b), disputes are resolved by the courts of Ireland;
• Annexes I, II and III of the SCCs are completed by Annex D of this DPA.

8.3 United Kingdom. For Customer Data protected by the UK GDPR, the SCCs apply as amended by the International Data Transfer Addendum (version B1.0) issued by the Information Commissioner under section 119A of the Data Protection Act 2018 (the UK Addendum). Its Tables 1 to 3 are completed by Annex D, and in Table 4 neither party may end it.

8.4 Switzerland. For Customer Data protected by the Swiss Federal Act on Data Protection, the SCCs apply with the Federal Data Protection and Information Commissioner as competent supervisory authority, and “Member State” does not exclude data subjects in Switzerland from bringing proceedings where they habitually reside.

8.5 Precedence and governing law. Where the SCCs or the UK Addendum conflict with this DPA or the Terms of Service, they prevail. The choice of Irish law and courts applies to the SCCs only; the rest of this DPA is governed as clause 15 provides.

8.6 Subprocessors. Decret transfers Customer Data to a subprocessor outside the EEA only under a valid safeguard, either an adequacy decision (including the EU-U.S. Data Privacy Framework for a certified subprocessor) or the SCCs with the UK Addendum, as Annex C states for each. The Customer authorises those transfers.

9. Assistance

Taking into account the nature of processing, Decret shall assist the Customer, by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer’s obligations to respond to data-subject requests, and with data-protection impact assessments and consultation with supervisory authorities, at the Customer’s reasonable request. If a data subject contacts Decret about Customer Data, Decret shall direct the data subject to the Customer unless legally required to handle the request itself.

Workspace functions (access, export, and deletion of projects) are the primary means of assistance. Assistance beyond ordinary support may be charged at a reasonable professional rate.

10. Personal data breach

Decret shall notify the Customer of a personal data breach affecting Customer Data without undue delay, and as a target within seventy-two (72) hours of becoming aware, so that the Customer may meet its obligations under Article 33. Notification shall describe, as then known: the nature of the breach; categories and approximate numbers of data subjects and records; likely consequences; and measures taken or proposed. Decret shall update the Customer as further information becomes available.

Continuous 24-hour incident response is not represented as a certified capability. The seventy-two (72) hour period is the standard to which processes are being designed. The Customer shall notify hello@decret.ai if it believes a breach has occurred on its side.

Decret shall not notify supervisory authorities or data subjects on the Customer’s behalf unless required by law or instructed by the Customer in writing.

11. Deletion and return

At the end of the provision of services relating to processing, Decret shall, at the Customer’s choice, delete or return Customer Data and delete existing copies, unless Union, Member State, or United Kingdom law requires storage. The Customer may export files during the applicable access and download periods. Unless the Customer instructs earlier deletion or return, Decret deletes live copies on the schedule in the Terms and Privacy Policy: sixty (60) days after a paid subscription ends, moved later only when the account owner could not be warned on schedule, and twenty-four (24) hours after delivery for a one-off order without a subscription whose delivery screen and email stated that time. Automated backups of the database, with point-in-time recovery, expire after seven (7) days. No expiry is configured yet for earlier versions of project files kept by storage versioning, including versions of files that have since been deleted: they are retained until one is. The planned expiry is ninety (90) days, unless a legal hold applies. A copy of the Service’s data as it stood on 22 October 2026, kept from the move of the Service to its managed database, is held in the Service’s AWS account (on the application host and in its nightly backups) until the move is declared complete. Personal data that was in the Service on that date and was deleted later remains in that copy until the copy is deleted; no date has been set for that deletion.

The Customer instructs Decret, by using the free 14-day test, to delete a test project with its files when the test period ends, unless the account has moved to a paid plan by then. Email received at a project address from a sender who is neither a project member nor approved by the Customer is deleted with its attachments thirty (30) days after receipt unless the project owner accepts it.

12. Information and audit

Decret shall make available information reasonably necessary to demonstrate compliance with this DPA. The Customer may audit once in any twelve-month period, on reasonable written notice of at least thirty (30) days, during business hours, in a manner that does not compromise other customers’ security. Audits are limited to systems that process Customer Data. Decret may satisfy an audit request with current policies, architecture summaries, and, when available, independent reports. On-site or invasive testing requires a mutually agreed scope and is at the Customer’s cost. Decret is not obliged to permit unrestricted audit access or to disclose another tenant’s data.

Independent certifications are not presently held. Decret may provide this Security Measures document and completed questionnaires in lieu of a SOC 2 report.

13. Liability

Liability under this DPA is subject to the limitations in the Terms of Service, except where Applicable Data Protection Law prohibits limitation as between a controller and a data subject, or where a limitation would be unenforceable. Each party remains liable to data subjects as provided by law. Administrative fines imposed on one party are not automatically passed to the other except as the Terms of Service and applicable law allow.

14. Term

This DPA continues for so long as Decret processes Customer Data. Confidentiality, deletion, liability, and audit rights survive for the period required to wind down processing.

15. Governing law

This DPA is governed by the same law and jurisdiction as the Terms of Service (clause 19 there: the laws of the State of Delaware, United States, without regard to its conflict of laws rules), without prejudice to mandatory data-protection rules and the competence of supervisory authorities. The Standard Contractual Clauses are governed as clause 8 provides.

Annex A: Description of processing

Annex B: Security measures

The following measures correspond to the Security Measures document.

• TLS for data in transit to the Service as offered at https://decret.ai.
• Access control: authenticated sessions; a non-administrator user reaches only the projects it owns or was invited to, with the role granted; a link for an outside party reaches only the items it was made for, until it expires or is revoked.
• Passwords hashed with Argon2id; session identifiers stored hashed; verification and reset tokens hashed.
• HttpOnly, SameSite cookies; __Host- prefix in production.
• Origin checks on authentication POST requests; per-route rate limits; security response headers (including CSP and frame denial).
• Least-privilege operator and administrator access; administrators designated other than by first registration.
• Authentication event logging without secrets.
• Encryption at rest by the storage provider for the database (Amazon RDS) and project files (Amazon S3, private and versioned). Application-level encryption of project files is not implemented.
• Vulnerability reports to hello@decret.ai (see Security Measures).

Annex C: Subprocessors

The subprocessors of Customer Data at the date of this DPA. The same list is Annex III of the Standard Contractual Clauses (Annex D) and opens the recipients table of the Privacy Policy.

These recipients are not subprocessors: the Norwegian Meteorological Institute, which receives a site’s coordinates when the Customer chooses automatic weather, and the OpenStreetMap Foundation, which receives a locality with its county or country when the site’s coordinates are looked up (one a user enters or confirms, or, in Romania, one the official register of localities lists), never the project’s location text, a street or a house number, each as an independent controller; the push service of a user’s browser, which receives push notifications encrypted; and Stripe and the European Commission’s VIES, which receive billing data for which Decret is controller. The Privacy Policy (clause 7) describes them. Decret keeps this Annex current as clause 7 provides.

Annex D: Standard Contractual Clauses particulars

I.A List of parties

• Data exporter: the Customer, with the name, address and contact email held for its account. Activities: use of the Service. Role: controller (Module Two) or processor (Module Three).
• Data importer: Sorenor, LLC, a Delaware limited liability company, 2810 N Church St STE 90277, Wilmington, DE 19802, United States. Contact: hello@decret.ai. Activities: providing the Service. Role: processor.
• Signature and date: the SCCs and this Annex are taken as signed by both parties when the Customer accepts the Terms of Service, into which this DPA is incorporated, and on that date.

I.B Description of the transfer

• Data subjects and personal data: as Annex A describes them.
• Sensitive data: none intended; the Customer does not upload special-category data unless the parties have agreed additional terms (clause 4).
• Frequency: continuous, for as long as the Customer uses the Service.
• Nature and purpose: providing the Service, as Annex A describes.
• Retention: as clause 11 provides, with the backup periods set out there.
• Transfers to subprocessors: the processing, location and safeguard Annex C gives for each, for as long as the Customer uses the Service.

I.C Competent supervisory authority

The supervisory authority responsible for the Customer as data exporter under Clause 13(a) of the SCCs: that of the Member State where the Customer is established or, for a Customer not established in the EU, that of its representative in the EU or else that of the Member State where the data subjects are. For data protected by the UK GDPR, the Information Commissioner; for data protected by the Swiss Federal Act on Data Protection, the Federal Data Protection and Information Commissioner.

II Technical and organisational measures

The measures in Annex B, described in full in the Security Measures document.

III Subprocessors

The subprocessors listed in Annex C.