Data Processing Agreement

This Data Processing Agreement ("DPA") sets out the terms on which ISLTech ("ISLTech") processes personal data on behalf of its clients. It forms part of our Terms of service and applies whenever we handle personal data during an engagement, whether we are building a system, training a model or running an evaluation. A signed copy, with an engagement-specific addendum, is provided with every paid engagement.

1. Roles

For personal data processed during an engagement ("engagement data"), you (the client) are the data controller and ISLTech is the data processor. We process engagement data only on your documented instructions, which are the scope document, this DPA and any written instructions you give us during the engagement. If we believe an instruction breaks data protection law, we will tell you before acting on it.

2. Scope and purpose

We process engagement data solely to deliver the services described in your scope document: for example to build and test an AI system on your data, to curate and prepare data for model training, to fine-tune a model, or to run an evaluation against your acceptance criteria. Categories of data vary by engagement and are listed in the addendum; they commonly include customer or patient records, documents, transaction records, support or clinical conversations, and the names and contact details of your staff. We do not process engagement data for our own purposes, and we do not use it to train or improve models for anyone other than you.

3. Training data

Where an engagement involves training or fine-tuning a model, the following apply in addition to section 2.

• Purpose limitation. Training data is used only to train, fine-tune and validate the model named in the scope document, and for no other purpose.
• Data minimisation and de-identification. We work with the minimum data needed. Before training, we de-identify or pseudonymise personal data wherever the agreed task allows it, and we document in the addendum any field that must remain identifiable and why.
• Location. By default, training runs in your cloud environment or an environment you approve in writing. Training data is not copied to ISLTech devices or accounts unless the addendum permits it.
• No reuse across clients. Training data, derived datasets and the resulting model weights or adapters are never used for, shared with or combined with data from any other client.
• Deletion on completion. When the engagement ends, we delete all copies of training data and intermediate artefacts in our control (including caches, checkpoints and logs that contain personal data) within 30 days, and confirm this in writing on request. The trained model and datasets you own are handed over before deletion.

4. Evaluation data

Where an engagement involves evaluating a model or system, the following apply in addition to section 2.

• Evaluation datasets, prompts, transcripts and model outputs that contain personal data are engagement data and are protected under this DPA.
• Evaluation data is used only to measure the system named in the scope document. Evaluation sets built from your data are not reused for any other client; generic, non-personal test cases we author may be retained as ISLTech materials under the Terms of service.
• Evaluation reports we deliver are written so that they do not need to contain personal data. Where an example output must include personal data to be useful, it is redacted unless you instruct otherwise in writing.
• Where evaluation involves sending data to a third-party model API, that provider is listed as a sub-processor in the addendum and is configured so that your data is not used to train the provider's models, where the provider offers that option.
• Raw evaluation data in our control is deleted within 30 days of the engagement ending, in line with section 10.

5. Sub-processors

We use a limited set of sub-processors: cloud infrastructure, AI model providers, data-labelling or annotation services where agreed, and the business tooling we use to run the engagement. Each is bound by data protection terms at least as protective as this DPA. The current list for your engagement is set out in the addendum. We give you at least 30 days' written notice of any new sub-processor so you can object; if we cannot resolve a reasonable objection, you may terminate the affected part of the engagement.

Standing sub-processors for business operations are our hosting, scheduling, email, document, invoicing and accounting providers, as described in our Privacy Policy. Engagement-specific sub-processors, including the cloud provider, any third-party model provider and any annotation service, are named in the addendum before processing begins.

6. Security measures

We protect engagement data with encryption in transit and at rest, role-based access limited to the people working on your engagement, multi-factor authentication on all ISLTech accounts, logging of access to engagement data, segregated storage per client, and secure deletion at the end of the engagement. Personnel with access to engagement data are bound by confidentiality obligations. We review our security measures at least annually. Where you require specific controls (for example work only inside your VPN or virtual desktop), these are recorded in the addendum. ISLTech does not hold a security certification and does not claim one.

7. International transfers

ISLTech is based in Serbia, which is not covered by an EU or UK adequacy decision. Any transfer of engagement data from the EEA to ISLTech relies on the European Commission's Standard Contractual Clauses (Module 2, controller to processor), and any transfer from the UK relies on the UK International Data Transfer Addendum to those clauses; both are incorporated into this DPA by reference and included in the signed copy. Where possible, we avoid transfers altogether by working inside your environment. Sub-processors that process data outside the EEA or UK are listed in the addendum together with the transfer mechanism relied on. For clients in the United States and Canada, the applicable transfer and residency requirements are recorded in the addendum.

8. Data subject rights

We assist you in responding to requests from individuals to access, correct, delete, restrict or port their data, and to objections. If a request reaches us directly, we forward it to you without responding to the individual beyond acknowledging receipt. We action your reasonable instructions on specific records within 30 days. Where a model has been trained on data that is later subject to a deletion request, we will advise you on what is technically feasible (for example removing the record from the dataset and retraining) and act on your instruction.

9. Breach notification

If we become aware of a personal data breach affecting engagement data, we will notify you without undue delay and in any event within 72 hours, with what we know about the nature of the breach, the data and individuals affected, the likely consequences and the measures taken. We will continue to provide information as it becomes available so you can meet your own notification obligations.

10. Return and deletion

When the engagement ends, we hand over all deliverables and make engagement data in our control available for return within 7 days. We then delete all copies of engagement data, including training and evaluation data and any intermediate artefacts containing personal data, within 30 days, unless the law requires us to retain it. We confirm deletion in writing on request.

11. Audit

On reasonable notice, and no more than once a year unless required by a regulator or following a breach, we will provide the information you need to demonstrate our compliance with this DPA and will allow an audit by you or an independent auditor you appoint, at your cost, subject to reasonable confidentiality and scheduling arrangements.

12. Contact

To request a signed DPA, the current sub-processor list or to ask a data processing question, email privacy@isltech.ai.