Urbano DX
信頼とコンプライアンス

Data Processing Agreement

Operator / Processor: Urbano DX (EU / Poland) Contact: urbano@urbanodx.com Version: 1.0 Last updated: 2026-07-14

This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Controller") and Urbano DX ("Processor") for the provision of the services. It reflects Article 28 of the GDPR. The engagement-specific details in Annex I are completed when the agreement is signed with a client. Where the customer is itself a processor, references to Controller apply to that customer as the relevant controller's processor.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", and "supervisory authority" have the meanings given in the GDPR. "Subprocessor" means any processor engaged by Urbano DX. "SCCs" means the European Commission's Standard Contractual Clauses.

2. Roles and scope

The Controller determines the purposes and means of processing. Urbano DX processes personal data only as a processor, on the Controller's documented instructions (including those set out in the service agreement and this DPA), except where required by EU or member-state law, in which case Urbano DX informs the Controller unless the law prohibits it.

3. Processor obligations

Urbano DX shall:

  1. process personal data only on documented instructions from the Controller;
  2. ensure persons authorised to process personal data are bound by confidentiality;
  3. implement the technical and organisational measures set out in Annex II;
  4. respect the conditions in Section 4 for engaging subprocessors;
  5. assist the Controller, by appropriate measures, in responding to data-subject

requests (Section 5);

  1. assist the Controller with security, breach notification, data protection impact

assessments, and prior consultation (Articles 32 to 36 GDPR);

  1. at the Controller's choice, delete or return all personal data at the end of the

services and delete existing copies unless retention is required by law (Section 7);

  1. make available the information necessary to demonstrate compliance and allow for and

contribute to audits (Section 8).

4. Subprocessors

The Controller grants general authorisation to engage the subprocessors listed in subprocessor register (Annex III). Urbano DX imposes data-protection obligations on each subprocessor no less protective than this DPA and remains liable for their performance. Urbano DX will give the Controller prior notice of any intended addition or replacement of a subprocessor and a reasonable period to object on reasonable data-protection grounds.

5. Data-subject rights

Taking into account the nature of the processing, Urbano DX assists the Controller by appropriate technical and organisational measures, insofar as possible, to fulfil the Controller's obligation to respond to requests to exercise data-subject rights (access, rectification, erasure, restriction, portability, and objection). Requests received directly by Urbano DX are forwarded to the Controller without undue delay.

6. International transfers

Where personal data is transferred outside the EEA, the transfer relies on an adequacy decision or the SCCs, together with the supplementary measures described in Annex II and in AI Governance Framework. The relevant subprocessors and their transfer bases are identified in Annex III.

7. Personal-data breach

Urbano DX notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and provides the information the Controller needs to meet its own notification obligations.

8. Return and deletion

On termination of the services, and at the Controller's choice, Urbano DX deletes or returns the personal data and deletes existing copies, unless EU or member-state law requires storage. Deletion covers application databases and backups within the backup rotation period.

9. Audit

Urbano DX makes available the information necessary to demonstrate compliance with Article 28 GDPR, including Trust and Security overview, this DPA, and the subprocessor register, and contributes to audits or inspections conducted by the Controller or a mandated auditor, subject to reasonable notice and confidentiality.

Annex I: Details of processing

  • Subject matter: provision of the services described in the applicable agreement.
  • Duration: the term of the service agreement plus any legally required retention.
  • Nature and purpose: [describe per engagement, for example: lead handling and

reply drafting; property search; document generation; outbound message drafting].

  • Categories of data subjects: [for example: the Controller's leads, customers,

contacts, or end users].

  • Categories of personal data: [for example: name, email, phone number, message and

call content, and any data the Controller submits]. No special-category data unless expressly agreed in writing.

  • Controller: [Controller legal name and contact].
  • Processor: Urbano DX, urbano@urbanodx.com.

Annex II: Technical and organisational measures

The measures in Trust and Security overview, Section "Security controls", form Annex II, including in summary: TLS in transit; network isolation of internal services (never routed through the public edge); secrets held in environment configuration and never committed; least-privilege admin allowlists; prompt-injection sanitisation and keeping secrets out of AI prompts; daily database backups; centralised logging and error tracking; and deploy-time review. Limitations are stated honestly in the Trust and Security overview.

Annex III: Subprocessors

See subprocessor register, which is incorporated into this DPA by reference and kept current as subprocessors change.