Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between the entity agreeing to these terms (“Controller” or “Customer”) and DataRoom Snap (“Processor” or “we”) for the provision of AI-powered document analysis services (the “Service”). This DPA sets out the terms governing the Processor's processing of Personal Data on behalf of the Controller.

1. Definitions

2. Scope of Processing

DataRoom Snap processes documents uploaded by the Controller for the purpose of AI-powered analysis. The Processor shall process Personal Data only in accordance with the Controller's documented instructions, which are defined by the Controller's use of the Service. The Processor shall not process Personal Data for any purpose other than providing the Service, unless required by applicable law.

3. Categories of Data

4. Purpose of Processing

Personal Data is processed solely for the following purposes:

• Automated document analysis and AI-powered insights generation
• KPI extraction from uploaded financial and corporate documents
• Risk scoring and red flag detection
• User authentication and access control
• Audit logging and compliance reporting

5. Sub-processors

The Controller authorizes the Processor to engage the following sub-processors. The Processor shall ensure that each sub-processor is bound by data protection obligations no less protective than those set out in this DPA.

The Processor shall notify the Controller of any intended changes to sub-processors at least 30 days in advance, giving the Controller the opportunity to object.

6. Security Measures

The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk. For comprehensive details, refer to our Trust Center. Key measures include:

• AES-256 encryption at rest and TLS 1.3 encryption in transit
• Row-Level Security (RLS) for complete data isolation between organizations
• Role-based access control (RBAC) with 18 granular permissions
• Immutable audit logs with 7-year retention
• IP allowlisting per organization
• Annual penetration testing and automated vulnerability scanning

7. Data Subject Rights

The Processor shall assist the Controller in responding to requests from Data Subjects exercising their rights under applicable data protection laws, including GDPR Articles 15 through 22:

• Right of Access (Art. 15): Data Subjects may request a copy of their Personal Data being processed.
• Right to Rectification (Art. 16): Data Subjects may request correction of inaccurate Personal Data.
• Right to Erasure (Art. 17):Data Subjects may request deletion of their Personal Data. Erasure is available via Settings > Billing > Danger Zone within the platform.
• Right to Restriction (Art. 18): Data Subjects may request restriction of processing of their Personal Data.
• Right to Portability (Art. 20): Data Subjects may request their Personal Data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Data Subjects may object to the processing of their Personal Data.

The Processor shall respond to any such request promptly and no later than 30 days from receipt.

8. Data Retention

9. International Transfers

Personal Data is processed and stored in the United States (AWS us-east-1, N. Virginia). Where Personal Data originating from the European Economic Area, the United Kingdom, or Switzerland is transferred to the United States, such transfers are governed by Standard Contractual Clauses (SCCs) as adopted by the European Commission. Customers may request a copy of the applicable SCCs by contacting privacy@dataroomsnap.com. EU data residency is available on Enterprise plans upon request.

10. Breach Notification

In the event of a Personal Data breach, the Processor shall notify the Controller without undue delay and in any event within 24 hours of becoming aware of a confirmed breach. The notification shall include the nature of the breach, the categories and approximate number of Data Subjects affected, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.

11. Term and Termination

This DPA is coterminous with the Controller's subscription agreement for the Service. The DPA shall automatically terminate when the subscription agreement expires or is terminated. Upon termination, the Processor shall delete or return all Personal Data to the Controller in accordance with Section 8 (Data Retention), unless retention is required by applicable law.

12. Audits

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. The Controller shall provide reasonable notice of any audit and conduct the audit in a manner that minimizes disruption to the Processor's operations.

13. Contact

For questions regarding this DPA or to exercise any rights hereunder, please contact:

For a full overview of our security and compliance posture, visit our Trust Center.