ConvergeHCA
EN
Create account

LEGAL

Data Processing Addendum

When your organisation puts personal data into Converge, Pave Technologies processes it for you. This page summarises the terms that govern that processing, written to meet Article 28 of the EU and UK GDPR and section 29 of the Nigeria Data Protection Act 2023.

  • Version 1.0
  • Effective
  • Last updated

1. Scope and roles#

  • This addendum ("DPA") applies to personal data in Customer Data that Pave processes on behalf of a business customer when providing the hosted Converge service.
  • The customer is the controller (or a processor acting for its own client), and Pave is its processor (or sub-processor).
  • Pave is a controller, not a processor, for account, billing, security and website data. Our Privacy Notice covers that data.
  • If this DPA conflicts with the Terms of Service on data protection, this DPA wins. If the Standard Contractual Clauses apply, they win over both.

2. Details of the processing#

Subject matter and duration
Providing the Converge service for the subscription term, plus the export and deletion period in section 10.
Nature and purpose
Hosting, storage, backup, computation, display, transmission to AI providers when users request it, support at the customer's request, and deletion.
Types of personal data
Whatever the customer chooses to upload. Typically: names, job titles, signatures and business contact details of staff, contractors and laboratory personnel appearing in reports and project files; user names inside comments, scripts and AI conversations.
Categories of data subjects
The customer's employees, contractors, partners, clients and laboratory or service-company personnel named in Customer Data.
Special categories
None intended. The customer agrees not to upload them.

3. Processing only on your instructions#

  • We process personal data only on the customer's documented instructions. The Terms of Service, this DPA, and the customer's use and configuration of the service (including users sending requests to the AI Engineer) are those instructions.
  • We do not sell the data, use it for our own purposes, or use it to train AI models.
  • If the law requires us to process data otherwise, we will tell the customer first unless the law forbids it.
  • We will tell the customer if we believe an instruction breaks data protection law.

4. Confidentiality of personnel#

Everyone at Pave who can access Customer Data is bound by a duty of confidentiality, receives data protection training, and has access only as far as their role needs. Support staff have read-only access, and staff actions are recorded in an audit log.

5. Security measures#

We maintain technical and organisational measures appropriate to the risk, including:

  • a separate database for each customer Company;
  • hosting on Google Cloud in the europe-west1 region (Belgium), with encryption in transit (TLS) and at rest;
  • backups and point-in-time recovery;
  • salted password hashing (PBKDF2-SHA256), hashed session tokens, reset links and API keys;
  • server-side checks on seats and permissions, and rate limits on sign-in and password reset;
  • session revocation and company-wide suspension;
  • an audit log of security-relevant actions, with IP address and user agent;
  • role-based staff access through a separate admin portal.

We may update these measures provided we do not reduce the overall level of protection. A fuller description is available on request.

6. Sub-processors#

  • The customer gives general authorisation for us to use the sub-processors listed in our Privacy Notice: Google Cloud (hosting), Cloudflare (network and security), Brevo (email) and the AI providers (Google Gemini today; Anthropic, OpenAI and Moonshot AI supported).
  • We impose data protection terms on each sub-processor that are at least as protective as this DPA, and we remain responsible for their performance.
  • We will give at least 30 days' notice before adding or replacing a sub-processor, by email to Admins or to a contact the customer registers with us.
  • The customer may object on reasonable data protection grounds within that period. We will try to resolve the concern; if we cannot, the customer may end the affected service and receive a refund of prepaid fees for the rest of the term.

7. International transfers#

  • Customer Data is stored in the European Union. Some sub-processors process data in other countries, including the United States and Singapore.
  • For personal data from the EU or EEA, transfers outside it are covered by an adequacy decision (such as the EU-US Data Privacy Framework, where the recipient is certified) or the Standard Contractual Clauses adopted by the European Commission in 2021 (Module 2 controller-to-processor, or Module 3 processor-to-processor), with transfer risk assessments and supplementary measures.
  • For personal data from the UK, we use the UK International Data Transfer Addendum to those clauses, or the UK extension to the Data Privacy Framework.
  • For personal data from Nigeria, transfers meet sections 41 to 43 of the Nigeria Data Protection Act, using adequacy or appropriate safeguards such as contractual clauses, and we keep records of the basis for each transfer.

8. Helping you meet your obligations#

  • Data subject requests: we will pass on any request we receive about Customer Data and help the customer respond, mainly through the export and deletion features of the service.
  • Impact assessments: we will give reasonable information and help for data protection impact assessments and consultations with regulators.
  • Records: we keep a record of processing activities carried out for customers.

9. Personal data breaches#

  • We will notify the customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting its Customer Data, so that it can meet its own 72-hour duty to notify regulators under the GDPR and the Nigeria Data Protection Act.
  • The notice will describe, as far as we know at the time, what happened, the data and people affected, likely consequences, and what we are doing about it. We will provide updates as we learn more.
  • Notifying a breach is not an admission of fault.

10. Return and deletion#

The customer can export its data at any time. When the subscription ends, the account stays read-only for 30 days for export. We then delete Customer Data from live systems within a further 30 days, and backup copies expire within 35 days after that. We will confirm deletion in writing on request. We keep data longer only where the law requires us to, and then protect it under this DPA.

11. Audits#

  • We will make available the information reasonably needed to show compliance with this DPA, including security documentation and answers to reasonable security questionnaires.
  • If that is not enough, or a regulator requires it, the customer may audit us (itself or through an independent auditor under confidentiality terms) once a year, on at least 30 days' notice, during working hours and at its own cost, in a way that does not interfere with our operations or compromise other customers' data.

12. Liability#

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where data protection law or the Standard Contractual Clauses do not allow it.

13. Request a signed DPA#

The full DPA, with its annexes (processing details, security measures and sub-processor list) and the completed Standard Contractual Clauses, is available for signature. Email [email protected] with:

  • your organisation's legal name and registered address;
  • the name and email of the person who will sign;
  • your data protection contact, if different; and
  • any region your data must stay in.

Enterprise customers may agree different terms in their enterprise agreement.