Data Processing Addendum

DPA for organizations · version of 17 September 2026.

1. Roles

The organization is the controller of the personal data it submits; Enew is the processor for the data processed on the organization's behalf. For data Enew processes for its own purposes (security, billing, service improvement), Enew acts as controller as described in the Privacy Policy.

2. Scope and instructions

Enew processes data only to provide the service and per the organization's documented instructions, including configuration of models, retention and access.

3. Confidentiality and security

Access is restricted, content is encrypted at rest, credentials are stored encrypted and access is audited. Measures follow industry practice and may be described in a security addendum for Enterprise.

4. Subprocessors

The organization authorizes the use of subprocessors needed to run the service (AI providers, cloud storage, email and payment). The list is available on request and updated with notice; the organization may object as set out in its contract.

5. International transfers

Data may be processed outside the organization's country. Transfers rely on appropriate safeguards, to be defined with the organization and validated legally.

6. Data subject requests

Enew assists the organization in responding to requests of data subjects within its role, using the export and deletion tools available in the product.

7. Return and deletion

On termination, data is returned or deleted within the retention window, unless retention is required by law.

8. Audit

The organization may request information to demonstrate compliance. On-site audits follow the terms agreed with the Enew team.