MAISON SASSON LTD

Data Processing Agreement (GDPR Art. 28)

Last updated: 30 October 2026 · Controller: Maison Sasson Ltd, Company No. 13345607, 82a James Carter Road, Mildenhall, Suffolk, England, IP28 7DE · Contact: legal@ai-eu-act.xyz

1. Roles

For content you upload (case data, dossiers, documents), you are the controller and Maison Sasson Ltd acts as processor under Art. 28 GDPR. For account and billing data, Maison Sasson Ltd is the controller.

2. Processing terms

We process personal data only on your documented instructions, ensure confidentiality undertakings, apply technical and organisational measures including mandatory two-factor authentication, row-level tenant isolation, encryption in transit (TLS 1.3) and at rest, and client-side AES-256-GCM encryption for vault files.

3. Sub-processors

Sub-processors include EU-hosted database infrastructure (Frankfurt), PayPal for payments, and enterprise AI language-model APIs for optional analysis features, configured not to retain or train on your data. Sovereign mode disables AI processing entirely. A current sub-processor list is available on request.

4. Assistance and deletion

We assist with data-subject requests, breach notification without undue delay, and deletion or return of data at the end of the service, subject to statutory retention and the tamper-evident ledger's anonymisation approach. Contact: legal@ai-eu-act.xyz.