Data Processing
Agreement.

1. Parties

• Processor: Discovery AI Limited, a company registered in England and Wales (Company No. 17032815), registered office 167-169 Great Portland Street, London, England, W1W 5PF, United Kingdom, with its affiliate ReDscvry Technology Private Limited, incorporated in India (CIN U63111TS2024PTC183007), SY:11 WeWork Krishe Emerald, Kondapur Main Road, Laxmi Cyber City, Whitefields, Hyderabad, Telangana 500081, India.
• Controller: the customer named in the agreement.

2. Roles

For the personal data described in section 3, the customer is the Controller and Dscvry is the Processor. Dscvry acts only on the Controller’s documented instructions, which are this DPA, the agreement and the Controller’s configuration and use of the service. Personal data collected through our own website is covered by our Privacy Policy, where Dscvry is the controller.

3. Details of the processing

• Subject matter: processing of personal data by Dscvry for the Controller.
• Duration: the term of the agreement, plus any statutory retention period that applies afterwards.
• Nature and purpose: providing, maintaining and supporting the services in the agreement, such as AI-assisted document data extraction, forward deployed engineering, and models, agents and products deployed for the Controller. Data is processed only for those purposes.
• Data subjects: the Controller’s employees, customers, vendors and other individuals whose data is submitted.
• Types of personal data: as set by the Controller in the agreement. They may include names, contact details, identification numbers and other personal data contained in the documents and records the Controller submits.

4. What the Processor will do

• Process personal data only on the Controller’s documented instructions, including for transfers to a third country, unless the law requires otherwise. In that case Dscvry will tell the Controller before processing, unless the law forbids it.
• Make sure the people authorised to process personal data are bound by appropriate confidentiality obligations.
• Apply the security measures in section 6.
• Follow the conditions for sub-processors in section 7 and bind each sub-processor to equivalent obligations.
• Help the Controller answer requests from data subjects under Articles 12 to 22 of the GDPR, using appropriate technical and organisational measures.
• Help the Controller meet its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information Dscvry holds.
• At the Controller’s choice, delete or return all personal data when the services end, and delete existing copies unless the law requires them to be kept (section 10).
• Make available the information needed to show compliance with Article 28, and allow and contribute to audits (section 9).

Dscvry never trains foundation or public models on the Controller’s data. See the Privacy Policy, section 2.

5. Confidentiality

Everyone who may process the Controller’s personal data is subject to appropriate confidentiality obligations, and access is limited to people who need it to deliver the services.

6. Security measures

• Encryption in transit with TLS 1.3 and at rest with AES-256, with customer-managed keys where the deployment supports them.
• Processing of documents in isolated environments.
• Access controls and logging, with access limited to need-to-know.
• Regular testing, assessment and evaluation of the effectiveness of these measures.
• A documented incident response and breach notification process.

Independent assurance: our information security management system is certified to ISO/IEC 27001:2022, we hold a SOC 2 Type 2 report covering Security, Availability and Confidentiality, and we have been independently assessed against the EU GDPR. Certificates and audit reports are available on request, under NDA. See Security & trust.

7. Sub-processors

The Controller gives general authorisation for Dscvry to use sub-processors. Dscvry will tell the Controller about any addition or replacement, and the Controller may object on reasonable data protection grounds. Dscvry keeps the list of sub-processors for each engagement and gives it to the Controller on request. The sub-processors we use for our services and website are:

• Microsoft Azure and Microsoft 365 (United States and EU): cloud infrastructure, email and productivity. Safeguards: Standard Contractual Clauses and the Microsoft data processing terms.
• Cloudflare (United States and global network): web hosting, CDN, DDoS protection, database storage for website forms (European Union jurisdiction) and the Turnstile bot check. Safeguards: Standard Contractual Clauses and the Cloudflare data processing terms.

Engagements that use other infrastructure, for example the Controller’s own cloud, private cloud, on-premise or air-gapped environment, name it in the order form or statement of work.

8. International transfers

Where personal data is transferred outside the EEA or the UK, Dscvry relies on appropriate safeguards: the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), the UK International Data Transfer Addendum where it applies, or an applicable adequacy decision. Dscvry operates from the United Kingdom and India.

9. Data subject requests, breaches and audits

Data subject requests. If Dscvry receives a request that relates to the Controller’s data, it passes the request to the Controller without undue delay and does not answer it unless the Controller instructs it to.

Personal data breaches. Dscvry will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s personal data, and will help the Controller meet its obligations under Articles 33 and 34 of the GDPR.

Audits. Dscvry will provide the information needed to show that it meets this DPA and will allow and contribute to audits and inspections by the Controller or an auditor the Controller appoints, on reasonable notice and subject to appropriate confidentiality safeguards.

10. Return or deletion

When the services end, the Controller chooses whether Dscvry returns or deletes the personal data. Dscvry deletes existing copies unless the law requires it to keep them, and removes deleted data from its systems within 30 days.

11. Term and changes

This DPA lasts for the term of the agreement, plus any statutory retention period. Dscvry may update it to reflect changes in the processing, its sub-processors or the law, and will notify the Controller of material changes by email or through the service.

12. Contact

• Privacy and DPA requests: privacy@dscvryai.com. Write to this address to request a countersigned copy of this DPA.
• Data Protection Officer: Sharad Bapat.
• EU representative (GDPR Article 27): James Stevenson, EU Managing Director.

Related: Privacy Policy, Cookie Policy, Terms of service.