Data Processing Addendum

This Data Processing Addendum (Addendum) applies where UPCOMINGSOUNDS S.R.L. (Operator) processes personal data on behalf of a business customer (Controller) through the SolveLang API, hosted MCP, or plugin services. It forms part of the Terms of Use for that customer. The Operator processes personal data only on the Controller's documented instructions, which are: to provide the requested analysis and related account, security, and support functions.

Processing covers account identifiers and contact details of the Controller's authorised users, request metadata, and any personal data contained in workflow or graph payloads the Controller chooses to submit. Hosted remote analysis processes payload data in memory and does not intentionally persist raw payloads. Processing lasts for the duration of the customer's contract, after which personal data processed on the Controller's behalf is deleted or returned at the Controller's choice, subject to legal retention duties.

The Operator will: process personal data only on documented instructions from the Controller, unless EU or Romanian law requires otherwise, in which case the Operator will inform the Controller unless the law prohibits it; ensure that persons authorised to process the data are bound by confidentiality; implement appropriate technical and organisational security measures; assist the Controller, taking into account the nature of the processing, with data-subject requests and with security, breach-notification, impact-assessment, and prior-consultation duties; notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data; and make available the information reasonably necessary to demonstrate compliance with this Addendum.

The Controller gives general authorisation for the Operator to use the sub-processors listed on the Subprocessors page of the SolveLang website. The Operator will give at least 30 days' notice of an intended addition or replacement of a sub-processor, during which the Controller may object on reasonable data-protection grounds. The Operator remains responsible for its sub-processors' performance of the data-protection obligations in this Addendum.

Where processing involves a transfer of personal data outside the European Economic Area, the transfer will rely on an adequacy decision or on the European Commission's standard contractual clauses, which are incorporated into this Addendum for that transfer.

On reasonable notice, the Operator will provide the records and information needed for the Controller's audit of this Addendum, proportionate to the scale of processing. If there is a conflict between this Addendum and the Terms of Use about personal data processed on behalf of a business customer, this Addendum prevails for that processing.