Eurus data processing agreement

About this document

Article 28 of the GDPR (Regulation (EU) 2016/679) requires a written contract whenever a processor handles personal data for a controller. This is that contract. When you use Eurus, you are the controller and we are the processor for the personal data Eurus reads and keeps for you. "We", "us" and "you" mean what they mean in the client terms.

1. Subject matter, duration, nature and purpose

We process personal data to provide Eurus as the client terms and your order form describe: reading the systems you connect, keeping what you enter in its registers, checking what happens against your controls, keeping the results and evidence, raising issues, running the workflows you switch on, carrying out the audit and, if your admin switches it on, answering questions through Ask. Processing lasts for the term of the agreement and the period after it set out in section 9. Annex 1 gives the details.

2. Instructions

• We process personal data only on your documented instructions. The agreement, the systems you connect, the workflows you switch on and the settings your admins choose are your instructions. The same applies to any transfer outside the EEA.
• Where EU or Irish law requires us to process without your instruction, we tell you what the law requires before we process, unless that law forbids it.
• If we think an instruction breaks data protection law, we tell you immediately, and may pause that instruction until it is resolved.

3. Confidentiality

Everyone we authorise to process the personal data is bound by confidentiality, by contract or by law, and has access only to what they need.

FourWinds' owner can open your organisation in Eurus as your admin sees it, to provide and support the service. A view is read-only: nothing can be changed during it. Each view, its reason and each page opened in it are written to your audit trail with the date and time, where your admins can see them.

4. Security

We apply the technical and organisational measures in Annex 2, which take account of the state of the art, the cost, and the nature, scope, context and purposes of the processing and its risks, as Article 32 requires. We will not materially reduce the overall level of protection while the agreement runs.

5. Sub-processors

• You give us general written authorisation to use the sub-processors in Annex 3.
• We give you at least 30 days' notice before adding or replacing one. You may object on reasonable data protection grounds within that time. We will then work with you on an alternative, and if there is none you may end the affected service without penalty.
• Each sub-processor is bound by data protection obligations no less protective than these, and we remain fully liable to you for their performance.

6. Helping you meet your own obligations

• Data subject requests. We help you answer access, correction, erasure and other requests within the month, by the means Eurus provides (including its data subject request workflow) and further on request, so far as the nature of the processing allows.
• Security, breaches and impact assessments. We help you with Articles 32 to 36, taking account of the nature of the processing and the information we have.
• Breaches. We tell you of a personal data breach affecting your data without undue delay and in any case within 24 hours of becoming aware of it, with what we know then and the rest as we learn it, so that you can meet the 72-hour notification to the Data Protection Commission.

7. Erasure and the evidence record

Eurus keeps an append-only record of check results, each with a SHA-256 fingerprint chained to the one before. Results name records by their identifier, never by a person's name or contact details, so erasing a person from your records removes them from Eurus while every result and fingerprint stays true. Ask's questions, answers and drafts about an erased person are removed with them.

8. Audits and information

We make available the information you need to show that this agreement and Article 28 are met, and we allow for and contribute to audits, including inspections, by you or an auditor you appoint. Unless a regulator requires otherwise or there is a breach, an audit takes place no more than once a year, on 30 days' notice, during working hours, by an auditor bound by confidentiality, and at your cost. We may answer first with documents, such as Annex 2 and the evidence the platform keeps of its own controls. For a financial entity under DORA, the client terms' DORA schedule gives wider rights, and this section does not limit them.

9. When the agreement ends

At your choice we return your personal data, by export in standard formats during the 30 days after the end, or delete it. After those 30 days we delete it from the live database. Copies in our nightly backups expire on their own schedule: the last 35 nights are kept, and the first night of each month for a year. A backup is never restored to process your data after the end, except to restore our service as a whole, in which case your data is deleted again at once. We keep personal data longer only where EU or Irish law requires it.

10. Transfers outside the EEA

The database and the app run in the EEA. Where a sub-processor in Annex 3 can reach personal data from outside the EEA, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework for a certified US company) or the Commission's standard contractual clauses, with the additional measures they require. If a basis we rely on ends, we tell you and agree a replacement before continuing.

11. Liability and precedence

Liability under this agreement is governed by the client terms. Where this agreement and the client terms differ on personal data, this agreement wins.

Annex 1. Details of the processing

Annex 2. Technical and organisational measures

• Each organisation kept apart. Every table holding an organisation's records forces row-level security: the database returns only the signed-in organisation's rows. A test reads every table as one organisation and finds none of another's.
• Keys sealed. Each key or sign-in token for your systems is sealed with AES-256-GCM, bound to its one connection, and never written to a log. The sealing key can be rotated.
• Least access to your systems. Connections read only. Writing is a separate permission granted per connection. Where a vendor offers restricted keys, only a restricted key is accepted.
• Card numbers kept out. A full card number in any field is removed before anything is stored.
• Signed traffic. Requests from your systems are signed; a bad signature, old timestamp or oversized body is refused before it is read.
• Sign-in. Named accounts only; two-step sign-in; single sign-on with Microsoft and Google; access end dates; FourWinds staff do not become members of your organisation, and FourWinds' owner can view it read-only, with every view on your audit trail.
• An audit trail. Every change of access and every action is recorded in an append-only trail.
• Evidence integrity. Results are append-only, fingerprinted with SHA-256 and chained; the chain verifies with code that runs outside the database.
• Encryption. In transit (HTTPS with HSTS) and at rest by the hosting platforms.
• Backups. Every night, sealed with the deployment's key, kept apart from the database, read back and opened before the night counts. 35 nights, plus the first of each month for a year.
• The app. Loads nothing from other addresses, cannot be framed, and its public pages set no cookies.
• People. Access to client data is limited to named FourWinds staff who need it, bound by confidentiality, and removed the day they leave.

This is a statement of what we do. FourWinds is not certified against ISO/IEC 27001.

Annex 3. Sub-processors

Changes

• Version 1.1, 8 November 2026. Section 3 and Annex 2 say that FourWinds' owner can view your organisation read-only, with every view, its reason and each page opened on your audit trail.