Data Processing
Addendum
Version 1.0 · Effective 1 June 2026 · Pentabeam d.o.o. · Ljubljana, Slovenia
This Data Processing Addendum ("DPA") forms part of the subscription agreement between Pentabeam d.o.o. ("Processor") and the customer entity ("Controller"). It sets out the terms on which the Processor will process personal data on behalf of the Controller, as required by Article 28 of Regulation (EU) 2016/679 (GDPR).
1. Definitions
Terms not defined here have the meaning given in the GDPR. "Services" means the Pentabeam AI platform provided under the subscription agreement. "Project Data" means Bills of Quantities, invoices, contracts, email threads, and related documents uploaded or connected by the Controller.
2. Subject Matter and Duration
The Processor shall process personal data for the duration of the active subscription agreement plus 90 days post-termination, after which all personal data shall be securely deleted or returned as directed by the Controller.
3. Nature and Purpose of Processing
| Category | Purpose | Legal Basis |
|---|---|---|
| Account registration data | Platform access, authentication | Contract performance (Art. 6(1)(b)) |
| Project documents & BoQ data | BoQ gap detection, cost forecasting | Contract performance (Art. 6(1)(b)) |
| Subcontractor invoice data | Invoice verification, dispute detection | Contract performance (Art. 6(1)(b)) |
| Email threads (connected inbox) | Change order detection | Contract performance (Art. 6(1)(b)) |
| Usage logs | Security, service improvement | Legitimate interests (Art. 6(1)(f)) |
4. Categories of Data Subjects
- Employees and contractors of the Controller.
- Subcontractors and suppliers named in project documents or invoices.
- Clients and project owners named in contracts.
- Platform users (employees of the Controller accessing the platform).
5. Processor Obligations
The Processor shall:
- Process personal data only on documented instructions from the Controller.
- Ensure that persons authorised to process personal data are bound by confidentiality obligations.
- Implement appropriate technical and organisational security measures (Art. 32 GDPR).
- Assist the Controller in fulfilling data subject rights requests within 5 business days.
- Notify the Controller of any personal data breach within 48 hours of becoming aware.
- Delete or return all personal data at the end of the service relationship.
- Make available all information necessary to demonstrate compliance with this DPA.
6. Sub-processing
The Controller grants general authorisation to engage the following sub-processors:
| Sub-processor | Role | Location |
|---|---|---|
| EU Cloud Infrastructure Provider | Compute & storage hosting | EU / EEA |
| Email connector service | IMAP / OAuth integration | EU / EEA |
The Processor shall notify the Controller at least 14 days in advance of any intended addition or replacement of a sub-processor. The Controller may object within this period. All sub-processors are bound by equivalent data protection obligations.
7. International Transfers
All personal data is stored and processed within the European Economic Area. No transfers to third countries are made without the Controller's prior written consent and an applicable transfer mechanism under GDPR Chapter V (adequacy decision or Standard Contractual Clauses).
8. Security Measures
The Processor maintains the following security measures as a minimum:
- Encryption in transit: TLS 1.2 or higher for all data transfers.
- Encryption at rest: AES-256 for stored project data.
- Access control: role-based access, multi-factor authentication for administrative access.
- Customer data isolation: each customer's AI model and data is logically and technically isolated.
- Audit logging: access and processing activities are logged and retained for 12 months.
- Annual security review and penetration testing.
9. Audits
The Controller may audit the Processor's compliance with this DPA no more than once per calendar year, upon 30 days' written notice. Audits are conducted at the Controller's expense. The Processor may satisfy audit requests by providing a current ISO 27001 certificate or equivalent third-party audit report, where available.
10. Governing Law
This DPA is governed by the laws of the Republic of Slovenia. Disputes shall be subject to the exclusive jurisdiction of the courts of Ljubljana, Slovenia, without prejudice to the rights of data subjects to lodge complaints with a supervisory authority.
11. Contact
To execute a signed version of this DPA or to raise any data processing queries, contact: tej.huc@pentabeam.com