An Article 28 GDPR data processing agreement for the customer personal data Prometiam processes through the API: screened names, monitoring lists and webhook endpoints. The customer is the controller and Prometiam the processor. It covers instructions, confidentiality, security, sub-processors (30 days' notice of changes), data-subject requests, breach notice within 72 hours, audits, Standard Contractual Clauses for transfers and deletion on termination. It is accepted by using the service; a countersigned copy is available on request at support@prometiam.com.