Data processing

When your organisation uses the OBLIGO platform, Obligo processes the personal data contained in the contracts, documents, and records you bring into the platform strictly on your organisation's documented instructions, for the purpose of obligation management. Processing is limited to what is necessary for obligation management; the categories of documents and personal data are those your organisation chooses to bring into the platform, and Cybersol B.V. acts only as processor on your documented instructions.

Cybersol B.V. applies technical and organisational security measures, engages sub-processors only under equivalent data-protection obligations, and processes data only on your organisation's documented instructions. Taking account of the nature of processing, Cybersol B.V. assists your organisation by appropriate technical and organisational measures, insofar as possible, in responding to data-subject requests. Taking account of the nature of processing and the information available to it, Cybersol B.V. also assists your organisation with security, breach-notification, data-protection-impact-assessment and prior-consultation obligations, including engagement with supervisory authorities. Cybersol B.V. currently engages the following sub-processors for the OBLIGO platform: Microsoft Ireland Operations Limited (Microsoft Azure — AI-assisted contract analysis via Azure OpenAI, key management via Azure Key Vault, document and database storage with backups stored in encrypted EU storage, and platform hosting; all in EU regions (Sweden)); and Plus Five Five, Inc. (d/b/a Resend), which delivers transactional email (account notices and obligation reminders). Resend stores account data, message metadata and logs in the United States regardless of sending region; that transfer is made under the EU Standard Contractual Clauses (Commission Decision 2021/914), and Resend states that it is certified under the EU-US Data Privacy Framework. Stripe Payments Europe, Limited processes payments for the OBLIGO platform as an independent controller for billing purposes and is not a sub-processor of customer personal data. The sub-processors listed above are engaged under data-protection terms equivalent to those Cybersol B.V. applies.

For processing questions or data-processing documentation, contact legal@obligo.tech. The OBLIGO data processing agreement is being prepared for publication; this page will reference it when it is available.