GDPR & DPA

This page is for business clients. It explains how SIA SVR AGENCY (“SVR Automations”) handles personal data when we build or run solutions for you. How we handle data of people who contact us through this website is in the Privacy policy.

1. Our roles

When an AI agent, automation or app we build for you processes personal data of your customers, staff or contacts, you are the controller and we are the processor (Art. 28 GDPR). You decide why and how the data is used. We process it only to deliver the agreed service. If we ever decide purposes ourselves (for example for our own accounting), we are an independent controller for that data.

2. What we commit to as a processor

• We process personal data only on your documented instructions, including for transfers outside the EU/EEA, unless the law requires otherwise (in which case we tell you first, if allowed).
• People who handle the data at our side are bound by confidentiality.
• We apply appropriate technical and organisational measures to protect the data (section 6).
• We use only the sub-processors in section 4, and tell you before adding or replacing one, so you can object.
• We help you answer data subject requests (section 7) and meet your security, breach-notification and impact-assessment duties, as far as our role allows.
• We delete or return the data at the end of the service (section 9).
• We give you the information needed to show our compliance and allow reasonable audits, with notice and during business hours.
• We tell you if we think one of your instructions breaks data protection law.

3. Data and purposes

The exact types of data, the categories of people, the purpose, the retention period and the sub-processors are set per project and written into the signed data processing agreement. Typical examples:

We design solutions to collect the minimum data needed. We recommend that agents are told not to request special categories of data (such as health data) unless you have a lawful basis and we have agreed this in writing.

4. Sub-processors

Which providers are used depends on the solution you choose. For each project we name them in the data processing agreement, and we tell you before adding or replacing one. Providers used for this website:

5. Where data is processed

We agree with you per project where data is processed. EU-based options are available where the providers offer them. If a provider processes data outside the EU/EEA, we use a lawful transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, and tell you before the project goes live.

6. Security measures

We apply appropriate technical and organisational measures to protect personal data, as Art. 32 GDPR requires. The measures for each project are set out in the data processing agreement.

7. Helping with data subject requests

If a person asks us directly to access, correct or delete their data, we forward the request to you without undue delay and do not answer it ourselves unless you tell us to. We help you technically to find, export, correct or delete the data in the solutions we built, within a reasonable time.

8. Personal data breaches

If we become aware of a breach affecting your data, we tell you without undue delay and in any case within 48 hours where possible, with the information we have (what happened, the data and people affected, the likely consequences and the measures taken), so you can meet your own notification duties.

9. Deletion and return

When the service ends we return or delete the personal data we hold for you within 30 days, as you choose, and confirm this in writing on request. We may keep data longer only where the law requires it.

10. AI transparency

AI agents we build show users a clear notice that they are talking to an AI, as required by EU rules on AI transparency.

11. Getting a signed DPA

Email [email protected] with your company details and the planned solution. We send a data processing agreement for signature before any personal data is processed.