Unif-AI Inc., operator of Embedding Labs. Version 2026-10-12; effective October 12, 2026.
For a client engagement, request our proposed Data Processing Agreement from cjm@embeddinglabs.com. We complete a service-specific schedule identifying parties, instructions, data and people concerned, actual providers and locations, safeguards, assistance, and return/deletion arrangements before agreement. This proposal is supplied on request and takes effect only through the applicable agreement; requesting it is not acceptance.
These terms apply to customers who have accepted them in an order form or agreement. Unif-AI Inc. operates the website; this explanation does not substitute a party, release duties, determine adoption or change an existing contract. The applicable agreed DPA and notice procedure continue to govern. A future schedule identifies the actual subprocessors, obtains the required authorization and states the advance change/objection process; a generic supplier name does not authorize every service or model. General questions go to cjm@embeddinglabs.com; use the contractual notice channel where required.
Data processing agreement (DPA)
Data Processing Agreement
Last updated: March 2026
This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Data Controller") and Embedding Labs ("Data Processor") for the provision of services. This DPA sets out the terms that apply when personal data is processed by the Data Processor on behalf of the Data Controller.
Definitions
For the purposes of this agreement:
- "Personal Data" means any information relating to an identified or identifiable natural person
- "Data Controller" means the customer who determines the purposes and means of processing personal data
- "Data Processor" means Embedding Labs, which processes personal data on behalf of the Data Controller
- "Sub-processor" means any third party engaged by the Data Processor to process personal data
- "Data Subject" means the identified or identifiable natural person to whom personal data relates
Scope and Purpose
The Data Processor shall process personal data only on documented instructions from the Data Controller and solely for the purpose of providing the agreed-upon services. The nature and purpose of processing, the types of personal data, and the categories of data subjects are determined by the Data Controller's use of Embedding Labs services.
Data Processing Details
The processing activities carried out under this agreement include:
- Processing of data uploaded by the Data Controller to Embedding Labs services
- Storage of data necessary for service delivery and account management
- Analysis and transformation of data as instructed by the Data Controller through our platform
Obligations of the Processor
The Data Processor shall:
- Process personal data only on documented instructions from the Data Controller
- Ensure that persons authorized to process personal data have committed to confidentiality
- Implement appropriate technical and organizational security measures
- Respect the conditions for engaging sub-processors
- Assist the Data Controller in responding to data subject rights requests
- Delete or return all personal data upon termination of services, at the Data Controller's choice
Sub-processors
The Data Processor shall not engage another processor without prior specific or general written authorization of the Data Controller. Where general written authorization has been given, the Data Processor shall inform the Data Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Data Controller the opportunity to object.
Data Subject Rights
The Data Processor shall assist the Data Controller in fulfilling its obligation to respond to requests for exercising data subject rights, including:
- Right of access to personal data
- Right to rectification of inaccurate data
- Right to erasure (right to be forgotten)
- Right to restriction of processing
- Right to data portability
Security Measures
The Data Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption of personal data in transit and at rest
- Ongoing confidentiality, integrity, availability, and resilience of processing systems
- Regular testing and evaluation of the effectiveness of security measures
- Access controls and authentication mechanisms
Data Breach Notification
The Data Processor shall notify the Data Controller without undue delay after becoming aware of a personal data breach. The notification shall include the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences, and the measures taken or proposed to address the breach.
Audit Rights
The Data Processor shall make available to the Data Controller all information necessary to demonstrate compliance with this agreement and allow for and contribute to audits and inspections conducted by the Data Controller or an auditor mandated by the Data Controller.
Term and Termination
This DPA shall remain in effect for the duration of the Data Processor's processing of personal data on behalf of the Data Controller. Upon termination of services, the Data Processor shall, at the choice of the Data Controller, delete or return all personal data and delete existing copies unless applicable law requires storage of the personal data.
Contact
For questions about this Data Processing Agreement or to exercise your rights under this agreement, please contact us at:
privacy@embeddinglabs.com