DPA and Sub-processors

1. Roles

The Customer is the controller of the personal data it enters or has processed through Centropic. The Provider (Centropic / Engineering Factory) acts as processor to provide the SaaS. Paddle, as merchant of record, processes payment data as an independent controller for billing and tax purposes.

2. Subject Matter and Duration

Processing covers accounts, analyzed public URLs, results (scores, findings, artifacts), technical logs, and, if enabled by the plan, LLM probes. It lasts for the life of the account and for the retention periods stated in the Privacy Policy / security and legal requirements.

3. Processor Obligations (Art. 28)

• Process data only to provide Centropic and on documented instructions (use of the service).
• Ensure confidentiality of authorized personnel.
• Apply appropriate technical and organizational measures.
• Use the sub-processors listed in Annex A; material changes are communicated.
• Assist the Customer with data subject rights, DPIAs, and data breaches where applicable.
• Delete or return data after account closure, except where legal obligations apply.
• Make available the information necessary to demonstrate compliance.

4. International Transfers

Some sub-processors (especially LLMs and US-based tools) may process data outside the EEA/UK. Transfers rely on appropriate safeguards (e.g., SCCs / adequacy decisions) under each provider’s policies. For an up-to-date summary, write to info@centropic.ai.

5. Customer Obligations

The Customer represents that it has the right to analyze the specified sites, must not upload special categories of data without a written addendum, and will comply with the Terms (no abusive scanning). For white-label / multi-client Business use, the Customer remains controller toward its own end users.

6. Acceptance

Use of Business/agency features or an order referencing this DPA version constitutes acceptance. Countersigned copy available on request at info@centropic.ai. In the event of a conflict on privacy matters, this DPA controls over the Terms for processing obligations.

Annex A — Active Sub-processors

List updated based on the production configuration. Inactive providers do not receive data from this instance.