Data Processing Agreement

Last updated: August 19, 2026

This DPA is incorporated by reference into the Evolve Edge Terms of Service. It governs the processing of Personal Data by Evolve Edge on behalf of the Customer and includes EU Standard Contractual Clauses (Module 2: Controller to Processor) and a UK International Data Transfer Agreement (IDTA) Addendum as Annexes A and B.

To request an executed, countersigned DPA for your organization, email info@evolveedgeai.com with subject line “DPA Request — Evolve Edge.” We will return an executed copy within 5 business days.

1. Definitions

• “Controller” — The Customer: the entity determining the purposes and means of processing Personal Data.
• “Processor” — Evolve Edge AI (Strong Redemption LLC): processes Personal Data on behalf of and under the instructions of the Controller.
• “Personal Data” — Any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Law.
• “Data Protection Law” — EU GDPR (Regulation 2016/679), UK GDPR (as retained in UK law by the Data Protection Act 2018), and any other applicable data protection legislation.
• “EU SCCs” — European Commission Standard Contractual Clauses (Commission Implementing Decision 2021/914 of 4 June 2021), Module 2 (Controller to Processor).
• “UK IDTA” — The UK International Data Transfer Agreement approved by the UK Secretary of State under Section 119A of the Data Protection Act 2018.
• “Sub-processor” — Any third party engaged by Evolve Edge to assist in processing Personal Data under this DPA.

2. Roles of the Parties

The Customer is the Controller. Evolve Edge is the Processor, processing Personal Data solely on behalf of and under the documented instructions of the Customer. Where Evolve Edge processes Personal Data for its own purposes (e.g., billing, account management), it acts as an independent Controller subject to its Privacy Policy.

3. Processing Instructions

Evolve Edge will process Personal Data only on documented instructions from the Customer, including those set out in this DPA and the Terms of Service, unless required to process by applicable law. Evolve Edge will immediately inform the Customer if, in its opinion, an instruction violates applicable Data Protection Law.

4. Purposes, Data Subjects, and Categories

Purpose of processing: Delivery of the Evolve Edge AI governance and compliance platform, including account management, compliance workflow execution, AI risk assessment generation, evidence management, audit log delivery, and platform security.

Data subjects: Customer’s authorized end users; employees and contractors referenced in compliance workflows.

Categories of Personal Data: Name, email address, job title, authentication credentials (hashed), usage data, audit logs, and compliance documentation uploaded by the Customer.

Special categories: Evolve Edge does not intentionally process special categories of Personal Data (Art. 9 GDPR). Customers must not upload special category data without prior written agreement.

5. Technical and Organizational Security Measures

Evolve Edge implements and maintains the following measures (Art. 32 GDPR):

• Encryption in transit: TLS 1.2 or higher for all data transfers
• Encryption at rest: AES-256-GCM field-level encryption for sensitive compliance data
• Authentication: strong password hashing (bcrypt), multi-factor authentication available
• Access control: role-based access with principle of least privilege
• Audit logging: comprehensive, tamper-evident logs of all data access and modifications (TrustLedger)
• Incident response: documented procedures for detection, containment, and notification
• Vendor management: all sub-processors under contractual data processing obligations
• Personnel: confidentiality obligations and security training for all staff with data access

6. Sub-Processors

The Customer provides general authorization for Evolve Edge to engage the following sub-processors. Evolve Edge will provide at least 14 days’ advance notice of any intended additions or replacements, allowing the Customer reasonable opportunity to object.

7. Data Subject Rights Assistance

Evolve Edge will provide reasonable technical assistance to the Customer in responding to data subject rights requests (access, rectification, erasure, portability, restriction, objection) within applicable legal timeframes. Requests received directly by Evolve Edge will be forwarded to the Customer without undue delay.

8. Personal Data Breach Notification

Evolve Edge will notify the Customer of a confirmed Personal Data breach without undue delay and within 72 hours of becoming aware, as required by Art. 33 GDPR. Notification will include: nature and scope of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed. Evolve Edge will cooperate fully with the Customer in meeting regulatory notification obligations.

9. International Data Transfers

Personal Data is processed and stored primarily in the United States. Evolve Edge relies on the following mechanisms for international transfers:

• Annex A — EU Standard Contractual Clauses (EU SCCs): Commission Implementing Decision 2021/914, Module 2 (Controller to Processor), incorporated herein by reference. The SCCs govern all transfers of EEA Personal Data to Evolve Edge in the United States. Clause 9 Option 2 (general authorization for sub-processors) applies. The governing law is that of the EU Member State of the Customer’s establishment.
• Annex B — UK International Data Transfer Agreement (UK IDTA): The UK IDTA (approved March 21, 2022) is incorporated herein for transfers of UK Personal Data. The mandatory clauses of the UK IDTA take precedence over any conflicting provisions. The governing law is the law of England and Wales.

Customers requiring a fully executed copy of the EU SCCs or UK IDTA addendum should contact info@evolveedgeai.com.

10. Data Retention and Deletion

Upon termination or expiry of the Services, Evolve Edge will, at the Customer’s written election, return or securely delete all Customer Personal Data within 30 days, except where retention is required by applicable law. Written confirmation of deletion will be provided upon request. Compliance audit data is retained for the period configured by the Customer (default: 7 years) consistent with regulatory requirements.

11. Confidentiality of Processing

Evolve Edge ensures that all persons authorized to process Personal Data are subject to binding confidentiality obligations and have received appropriate data protection training. Access to Personal Data is limited to personnel who require it to perform their functions in delivering the Services.

12. Audit Rights

Evolve Edge will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA and applicable Data Protection Law (Art. 28(3)(h) GDPR). Evolve Edge will cooperate with audits or inspections by the Customer or an authorized third-party auditor, subject to reasonable advance notice (minimum 30 days), confidentiality obligations, and agreement on reasonable scope and cost allocation.

13. Liability

Each party’s liability under this DPA is subject to and does not exceed the limitations set out in the Evolve Edge Terms of Service, except where such limitations are prohibited by applicable Data Protection Law.

14. Contact

Data Processor (Evolve Edge):
Strong Redemption LLC (DBA Evolve Edge AI)
11400 Robinwood Drive, Hagerstown, MD 21742, USA
info@evolveedgeai.com

Submit a data subject rights request →