GDPR
isotope13 LLC is a US company with no EU establishment.
We are a processor for our customers' API requests, under our DPA. We are a controller for everything else, under our Privacy Policy: accounts, billing, uploads, verdicts, correspondence, and API requests made without a customer token.
| Requirement | Where |
|---|---|
| Notice and records of processing (Art. 13, 14, 30) | Privacy Policy |
| Processor terms (Art. 28) | DPA |
| Annex I: description of processing | DPA, Scope |
| Annex II: security measures (Art. 32) | Security Measures |
| Annex III: subprocessors | Approved Subprocessors |
| International transfers (Chapter V) | DPA, Transfers: Standard Contractual Clauses |
| Breach notification (Art. 33–34) | Incident Response Plan |
| Impact assessment (Art. 35) | DPIA |
| Data flows | API Architecture |
| EU and UK representative (Art. 27) | None. Exempt under Art. 27(2): business-to-business processing of account identifiers and an unlogged IP address, with no special-category data, is unlikely to put anyone at risk. |