Data Processing Addendum

You are the data controller for decision content and user accounts in your organization. Bacenik is the processor for data you submit to operate the service.

We process account identifiers, decision artifacts, audit logs, and billing metadata solely to provide, secure, and support the service.

Hosting, database, email, and payment providers — the current list, including purpose and region for each, is published at /trust. We will give enterprise customers at least 30 days' notice before engaging a new material sub-processor, and you may object on reasonable data protection grounds by contacting enterprise@bacenik.com; if we cannot resolve the objection, you may terminate the affected service.

Where processing your data involves a transfer outside the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (or an equivalent recognized transfer mechanism) with the relevant sub-processor.

Access controls, encryption in transit, audit trails, and incident response per our security runbooks. See /enterprise for OIDC, RBAC, and audit export capabilities.

We assist controllers with verified requests within reasonable timelines. Contact info@bacenik.com with your workspace identifier.

On reasonable written notice, and no more than once per 12 months absent a security incident, we will provide you with our latest security documentation and answer reasonable written questions to help you verify our compliance with this DPA.

On termination of your subscription, you may export your data for 30 days. After that window, we will delete or anonymize your data within a reasonable period, except where retention is required for billing, legal, or security-incident records.

This DPA is governed by the laws of the State of Delaware, consistent with our Terms of Service, without prejudice to any data protection law that applies to you as controller.

Enterprise customers may request a countersigned DPA and security questionnaire package at enterprise@bacenik.com or visit Enterprise.