Data Processing Agreement

Effective from 27 October 2026

This agreement (the Agreement) is concluded between the organisation that uses Glosa (the Controller) and [company name], company code [company code], registered address [registered address], email [contact email] (the Processor) under Article 28 of the General Data Protection Regulation (GDPR). The Agreement forms part of the Terms of Use and takes effect when an owner or administrator of the Controller confirms, when creating the organisation or later in the Service, that they agree to it on the Controller's behalf (the time and version are recorded). A written, signed version of the Agreement can be requested by email at [contact email].

1. Subject matter and duration

The Processor processes personal data only to the extent necessary to provide the Glosa service (manuscript and layout proofreading, collaboration, AI proofreading), for the entire period the Service is used and until the data is deleted under section 9.

2. Categories of data and data subjects

• Data subjects: the Controller's employees and collaborators (editors, typesetters, authors), as well as people written about in uploaded manuscripts.
• Data: first name, last name, email address, project role, comments and replies, activity log; any personal data contained in manuscripts and layouts uploaded by the Controller.
• The Controller ensures that it has a legal basis to upload and process this data and uploads special categories of data only where necessary and lawful.

3. Obligations of the Processor

• To process data only on the documented instructions of the Controller – this Agreement and the Service settings.
• To ensure that persons processing the data are bound by confidentiality.
• To apply the technical and organisational security measures set out in section 10 (GDPR Art. 32).
• To help the Controller respond to data subject requests (access, rectification, erasure, portability) – the Service provides export, deletion and account removal for this purpose.
• To help the Controller carry out a data protection impact assessment where required.
• Not to use the data for its own purposes, not to use it to train AI models, and not to sell or transfer it to third parties other than those listed in section 4.

4. Sub-processors

The Controller agrees that the Processor may engage the following sub-processors:

• [hosting provider and country] – servers;
• Cloudflare, Inc., JAV (duomenys ES) – storage of uploaded files;
• Cloudflare, Inc., JAV (duomenys ES) – backup storage (backups are encrypted and the provider cannot read them);
• the email delivery provider – sending notifications and invitations (name, email, notification content). If the Controller sets up its own mail server, its invitations and notifications are sent through that server, which the Controller chooses and is responsible for;
• Anthropic, PBC (USA) – AI proofreading; data is transmitted only when AI features are used, and the Controller can turn them off in the organisation settings. Only the text of the pages being checked (for the layout check, also images of those pages), the dictionary and the style guide are sent; the data is not used to train models and is deleted within 30 days.

The Processor gives at least 30 days' notice of any intended addition or replacement of a sub-processor; during this time the Controller may reasonably object and, failing agreement, stop using the Service. Sub-processors are bound by data protection obligations no less strict than those in this Agreement.

5. Transfers outside the EEA

Data is transferred outside the European Economic Area only with the safeguards provided for in Chapter V of the GDPR – standard contractual clauses approved by the European Commission or, where the recipient is certified, the Commission's adequacy decision (the EU-US Data Privacy Framework).

6. Personal data breaches

Upon becoming aware of a personal data breach, the Processor notifies the Controller without undue delay and no later than within 48 hours by email (to the organisation owners), providing the information available: the nature of the breach, the categories and approximate number of data affected, the likely consequences and the measures taken or proposed.

7. Audits and information

At the Controller's request, the Processor provides the information needed to demonstrate compliance with Article 28 of the GDPR and allows reasonable audits, agreed at least 30 days in advance.

8. Instructions of the Controller

The Controller gives instructions through the Service settings (member roles, enabling AI features, data retention periods, deletion) or by email. If, in the Processor's opinion, an instruction infringes the law, it informs the Controller without delay.

9. Return and deletion of data

The Controller can export its data at any time (PDF with comments, CSV, Word, attached files) and delete projects or the entire organisation. Deleted data and files are removed immediately, and from backups no later than within 30 days, unless the law requires them to be kept.

10. Technical and organisational security measures

• Encrypted connections (HTTPS, HSTS), strict browser security headers.
• Role-based access in projects and organisations; a project is visible only to invited users.
• Passwords stored only as hashes; two-factor authentication; single sign-on (SSO) with domain verification.
• Session management, request rate limiting, sign-in attempt limiting.
• An activity log (who did what and when), exportable for audits.
• Regular backups and restore testing.
• Upload file type and size checks; attached files open in the browser in isolation.

11. Final provisions

The Agreement is governed by the law of the Republic of Lithuania. It remains in force while the Controller uses the Service, and the obligations of section 9 until the data is deleted. Contact for data protection matters: [contact email].