Data Processing Addendum

Scope and roles

This Data Processing Addendum ("DPA") forms part of the agreement between you (the "Controller") and OpenTurbine (the "Processor") and applies where OpenTurbine processes personal data on your behalf. Where data protection law treats you as a processor and us as a sub-processor, the same obligations apply down the chain.

OpenTurbine analyzes operational data that you provide - SCADA history, turbine telemetry, and the site and asset metadata that accompanies it - and returns findings derived from it. That operational data remains yours, is processed only to serve your fleet, and is governed by your commercial agreement with us. This document concerns the separate, much smaller category of personal information we process to operate our website, your account, and our commercial relationship.

Details of processing

Subject matter: provision of the OpenTurbine services. Duration: the term of the agreement. Nature and purpose: analysis of operational data to produce performance and reliability findings, together with account administration and support. Types of data and data subjects: as determined and controlled by you, which for operational data is typically limited to the identities of personnel recorded in maintenance and alarm logs. We process personal data only on your documented instructions, including those set out in the agreement.

Subprocessors

You authorize us to engage the subprocessors listed on our Subprocessors page. We impose data protection obligations on each subprocessor no less protective than those in this DPA and remain responsible for their performance. We will give notice of intended changes and you may object on reasonable data protection grounds.

Security measures

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls on a least-privilege basis, and audit logging of access to our systems.

Data subject requests

Taking into account the nature of the processing, we will assist you with appropriate measures to respond to requests from data subjects exercising their rights, and will forward any such request we receive directly to you.

Personal data breach

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide information reasonably available to help you meet your notification obligations.

International transfers

Where we transfer personal data across borders, we rely on a lawful transfer mechanism such as the Standard Contractual Clauses, which are incorporated by reference where applicable.

Audits

We will make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, subject to reasonable confidentiality and security conditions.

Return and deletion

On termination, we will delete or return personal data and operational data we process on your behalf, except where retention is required by law. Access to findings and to the platform ends when your agreement ends, subject to any wind-down terms in your order.

Contact

To request a countersigned copy of this DPA, a security questionnaire, or an answer to any data protection question, email [email protected].