Data Processing Terms

For personal data you enter about people other than yourself in the course of a profession (“Client Data”), you are the controller and AstroProcessor (Alisa Vasilenko, operating as autónomo; NIF Y9774585J; Calle del Concilio de Trento 78, 08018 Barcelona, Spain) is the processor. These terms form part of your contract with us and supplement our Terms of Service and Privacy Policy. For your own personal data, our Privacy Policy applies and we are the controller.

• Subject-matter and duration: processing of Client Data for as long as your account is active or until the Client Data is deleted, whichever comes first.
• Nature and purpose: to provide the Service to you — storing Client Data and computing charts, interpretations, and reports from it.
• Types of data: identifiers and birth details (date, time, place, derived coordinates and timezone) and any notes you add.
• Categories of data subjects: the people whose charts you create, such as your clients or family members.

• Documented instructions only. We process Client Data only on your documented instructions (including these terms and your use of the Service), and not for any purpose of our own — including improving our Service or training any model — unless the law requires otherwise, in which case we will tell you first where permitted.
• Confidentiality. People authorised to process Client Data are bound by confidentiality.
• Security. We apply appropriate technical and organisational measures (Article 32 GDPR), including encryption in transit and access controls.
• Assistance. Taking account of the nature of the processing, we assist you with data-subject requests (Articles 12–23) and with your obligations under Articles 32–36 (security, breach notification, and data-protection impact assessments).
• Breach notification. We notify you without undue delay after becoming aware of a personal-data breach affecting Client Data.
• Deletion or return. On termination, or at your request, we delete or return Client Data and delete existing copies, unless the law requires us to keep it.
• Audit. We make available the information needed to demonstrate compliance with Article 28 and allow for and contribute to reasonable audits.

You give general authorisation for us to engage sub-processors to provide the Service — currently our hosting and infrastructure providers, the ephemeris calculation API, and AI model providers (each described in our Privacy Policy). We impose data-protection obligations on each sub-processor that are no less protective than these terms, and we will give you advance notice of any intended change so you can object.

Where a sub-processor processes Client Data outside the EEA, we rely on an appropriate transfer safeguard (the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses, with additional measures where needed), as described in our Privacy Policy.

You warrant that you have a lawful basis to provide the Client Data and that you have given the data subjects the information Article 14 GDPR requires — including who we are as your processor and how to contact us. If a data subject contacts us directly, we will refer them to you and assist you in responding.

For any question about these Data Processing Terms, email [email protected].