Legal Information
Last updated: March 2026. This Data Processing Agreement ("Agreement") forms an integral part of the contract between OSavul Inc. ("Osavul," the "Processor") and the company using the Osavul platform (the "Client," the "Controller"), and sets out the terms on which Osavul processes personal data in the course of providing access to the platform and its modules (Echo, Nebula, Janus).
Osavul processes, on the Client's behalf, personal data of users to whom the Client has granted access to the platform: name, work email, role and access rights, and system activity logs. Where the platform's modules analyze open-source material in response to queries configured by the Client, processing may also touch personal data contained in that material (for example, the authors or participants of a given publication). Osavul processes such data solely to provide, support, and improve the platform, ensure information security, and fulfill its contractual obligations to the Client, and does not use it for any other purpose.
Osavul processes personal data only on the Client's documented instructions and to the extent necessary to provide the services under the main agreement. Osavul keeps the data confidential, limits access to staff who need it for their role, and applies technical and organizational safeguards, including encryption of data in transit and at rest, access controls, and regular backups. If Osavul discovers a security incident affecting personal data, it notifies the Client without undue delay and provides the information needed to assess the impact and meet the Client's obligations to regulators and data subjects. Osavul may engage sub-processors (in particular, cloud infrastructure and supporting-service providers) only after notifying the Client in advance, binds them to data-protection terms no weaker than those in this Agreement, and remains responsible for their actions as if they were its own. Osavul assists the Client in fulfilling data subject rights — access, correction, deletion — and in responding to regulatory inquiries, and on request provides documentation evidencing compliance with this Agreement.
The Client warrants that any personal data it provides to Osavul was obtained lawfully and that it holds all necessary legal grounds and, where required, data subject consents for such transfer and processing. The Client will promptly inform Osavul of any changes to the scope, purpose, or conditions of the processing.
This Agreement remains in effect for as long as the main agreement between the parties is in effect. Upon termination of the main agreement, for any reason, Osavul will, at the Client's choice, delete all of the Client's personal data processed on the platform or return it to the Client in a structured, machine-readable format, and then delete any remaining copies, including backups, within 30 days of termination. Osavul may retain data longer than this period only to the extent required by applicable law, and will inform the Client of such grounds on request. The confidentiality obligations set out in this Agreement survive for 3 years after its termination.
For any questions about how we process personal data, write to [email protected].