This Data Processing Agreement (“DPA”) forms part of, and is governed by, the Capptions Terms of Service. It is entered into between Capptions B.V. (“Processor”) and the customer identified in the order or main agreement (“Controller”). By using Capptions products under a paid or trial subscription, the Controller accepts this DPA. A counter-signed PDF is available on request from privacy@capptions.com.
- Version: 2026.1
- Effective date: 1 January 2026
- Supersedes: all earlier Capptions data processing agreements
1. Definitions
Terms in bold have the meaning given in Articles 4 and 28 GDPR (EU 2016/679). “Customer Data” means personal data submitted to the Capptions services by or on behalf of the Controller. “Sub-processor” means any third party engaged by the Processor to process Customer Data.
2. Subject matter, duration, nature and purpose
The Processor processes Customer Data solely to provide and support the Capptions services subscribed to by the Controller (Capptions One, Capptions Direct, Capptions AI, Seveso.app, the Marketplace, and related support and AI features). Processing continues for the term of the main agreement plus the periods set out in Section 9 (Return and deletion).
3. Types of personal data and categories of data subjects
- Categories of data subjects: Controller’s employees, contractors, visitors, customers, suppliers, and any other natural persons whose data the Controller chooses to upload.
- Categories of personal data: identification data, contact data, professional data (role, certifications), inspection and audit findings, photos and other media, location data when enabled by the Controller, and any other categories the Controller chooses to upload.
- Special categories (Art. 9): the services are not designed to process special categories of personal data. If the Controller chooses to upload such data (e.g. health data for occupational health records), the Controller is responsible for the appropriate legal basis under Art. 9(2).
4. Processor obligations
The Processor will:
- process Customer Data only on documented instructions from the Controller, including with regard to transfers (Art. 28(3)(a) GDPR);
- ensure persons authorised to process Customer Data are under a duty of confidentiality (Art. 28(3)(b));
- implement appropriate technical and organisational measures under Art. 32 — see Security Statement (Art. 28(3)(c));
- only engage sub-processors with prior general written authorisation per Section 6 (Art. 28(3)(d));
- assist the Controller with data subject requests (Art. 28(3)(e));
- assist the Controller with Art. 32–36 obligations (security, breach notification, DPIA, prior consultation) (Art. 28(3)(f));
- delete or return Customer Data per Section 9 (Art. 28(3)(g));
- make available all information necessary to demonstrate compliance and allow audits per Section 8 (Art. 28(3)(h)).
5. Personal data breach
If the Processor becomes aware of a personal data breach affecting Customer Data, it will notify the Controller without undue delay and in any event within 48 hours of becoming aware. The notification includes the nature of the breach, categories and approximate number of data subjects and records, likely consequences, and measures taken or proposed.
6. Sub-processors
The Controller grants the Processor a general written authorisation to engage sub-processors. The current list is published at Sub-processors. The Processor notifies the Controller of any intended changes by email or in-app notice at least 30 days in advance. The Controller may object on reasonable, documented data protection grounds within that 30-day window. If the parties cannot resolve the objection, the Controller may terminate the relevant service for cause without penalty.
All sub-processors are bound by data protection terms providing at least the same level of protection as this DPA.
7. International transfers
Primary processing occurs in the European Union, on Hetzner in Germany (primarily Nuremberg), with specific ancillary services on AWS in Dublin (Ireland). Where Customer Data is transferred outside the EEA, the Processor relies on:
- the EU Standard Contractual Clauses (Commission Decision 2021/914/EU), Module 2 (controller-to-processor) or Module 3 (processor-to-processor), with the country-specific UK and Swiss addenda where applicable;
- the EU–US Data Privacy Framework where the sub-processor is certified;
- supplementary measures documented in a Transfer Impact Assessment per sub- processor (encryption, pseudonymisation, contractual challenge of access requests).
8. Audit rights
The Controller may, no more than once per 12-month period and on at least 30 days’ written notice, audit the Processor’s compliance with this DPA. The Processor satisfies the audit obligation by making available:
- its current ISO/IEC 27001 certificate and Statement of Applicability;
- its current SOC 2 Type II report under NDA;
- penetration test summaries;
- written answers to a reasonable security questionnaire.
On-site audits are permitted where these documents are insufficient, at the Controller’s cost, conducted by a mutually agreed auditor under NDA, and in a way that does not disrupt the Processor’s operations or the data of other customers.
9. Return and deletion of Customer Data
On termination of the main agreement, the Processor will, at the Controller’s choice, return Customer Data via export tooling or delete it. Unless the Controller exports the data within 30 days of termination, the Processor will delete all Customer Data within 60 days of termination, including backups within their normal rotation window (≤ 35 days). Deletion is certified on request.
10. AI processing annex
This annex applies when the Controller enables AI features in Capptions products (including Capptions AI and Seveso.app).
- No training on Customer Data. Customer Data is not used to train, fine- tune or evaluate foundation models, whether by the Processor or its AI sub- processors. This is contractually enforced with every AI sub-processor.
- Zero retention at the AI sub-processor. Prompts and completions are not retained by the AI sub-processor beyond what is required to return a response, and in any event no longer than 24 hours for abuse monitoring purposes where applicable. Where the sub-processor offers a true zero-retention mode, the Processor configures it.
- EU residency by default. AI inference is routed to EU regions of the sub-processor for tenants in the EU/EEA. The current AI sub-processors and their regions are listed on the Sub-processors page. If no EU region is available for a given feature, the feature is disabled by default and the Controller must opt in.
- Scoped context. Each AI call uses only the minimum context necessary from the Controller’s tenant. Cross-tenant prompt leakage is prevented by tenant-scoped retrieval, tenant identifiers in every request, and isolated vector indexes per tenant where embeddings are used.
- Human oversight. AI outputs that affect a person or a safety-critical decision are surfaced as suggestions for a human user to accept, edit or reject. The Processor logs the human decision.
- Transparency. AI-generated content is labelled in the user interface. The Controller can disable AI features per tenant or per user role.
- EU AI Act. The Processor positions current AI features as limited-risk systems (transparency obligations) and Seveso.app AI-assisted features in a safety context as high-risk under Annex III to the extent applicable; the Processor maintains the documentation and risk management practices required by the Act.
- Sub-processors. Current AI sub-processors are listed on the Sub-processors page and updated under Section 6.
11. Liability and governing law
Liability under this DPA is subject to the limitations in the main agreement. This DPA is governed by Dutch law; disputes are submitted to the competent court in Amsterdam, the Netherlands, without prejudice to mandatory rules of jurisdiction under the GDPR.
A counter-signed copy is available on request: privacy@capptions.com.