Categories of Data Subjects and Categories of Personal Data
Annex to the Data Processing Agreement ("DPA") between customer as the Controller and Opper AI as Processor.
This Annex describes, for the purposes of Article 28(3) and Article 30 GDPR, the categories of data subjects and the categories of personal data processed by the Processor on behalf of the Controller in connection with the Services.
A. Categories of Data Subjects
| Category | Description |
|---|---|
| Controller's authorized users | Employees, contractors, or other individuals authorized by the Controller to access, administer, or use the Service (e.g. account administrators, developers, API key holders). |
| Individuals identified in Input content | Any data subject whose personal data is contained within the prompts, files, or other content (“Inputs”) submitted to the Service by or on behalf of the Controller. The specific individuals depend entirely on the Controller's use case and may include, without limitation, the Controller's customers, employees, job applicants, end users, or other third parties referenced within such content. |
| Individuals identified in Output content | Any data subject whose personal data appears within the content generated by an AI Model in response to an Input (“Outputs”), to the extent such Outputs contain or reproduce personal data. |
B. Categories of Personal Data
| Category | Description |
|---|---|
| Account and administrative data | Name, business contact details (email, phone), job title, login credentials, API keys or access tokens, billing and payment details, and IP address of the Controller's authorized users. |
| Usage and technical/metadata | Timestamps, request and response metadata, session identifiers, device and browser information, the AI Model selected, token/usage counts, and system or error logs generated through use of the Service. |
| Input content (Controller-determined) | Any personal data contained within the Inputs submitted by the Controller. Because Input content is determined solely by the Controller, this may include ordinary categories of personal data (e.g. names, contact details, identification numbers, professional information) and, where applicable, special categories of personal data under Article 9 GDPR or personal data relating to criminal convictions and offences under Article 10 GDPR, subject to Art 9 Appendix (Special Category Data). |
| Output content (derived) | Personal data generated, summarized, or reproduced within Outputs returned by an AI Model in response to an Input, which may mirror or otherwise reflect personal data contained in the corresponding Input. |
Where the Controller's use of the Service involves special categories of personal data within the meaning of Article 9 GDPR, the terms of Art 9 Appendix (Special Category Data) apply in addition to this Annex.