GDPR Article 28 Assurance

1. Introduction & Context

Under Article 28 of the GDPR, data controllers must only use processors providing sufficient guarantees to implement appropriate technical and organizational measures. AGICY is designing trusted infrastructure for GDPR-aligned sovereign European AI compute with EU data-residency targets — this is compliance design status, not a claim of held certification or absolute present-tense compliance.

This document establishes the planned legal, technical, and organisational framework under which AGICY would process personal data on behalf of its enterprise clients. It should be read in conjunction with the AGICY Master Services Agreement (MSA) and Data Processing Agreement (DPA).

2. Data Sovereignty & Localization

Unlike hyperscalers routing data across trans-Atlantic cables — risking extraterritorial data access under the US CLOUD Act — AGICY's design target is 100% data residency and localization within the Republic of Cyprus. No EU citizen data processed on AGICY hardware is intended to leave the jurisdiction of the European Union.

2.1 Physical Isolation Guarantees

• Hardware boundary: All 1,801 Tenstorrent Galaxy servers are planned to be physically located at the Vasilikos Energy Center, Republic of Cyprus — an EU Member State (pre-construction).
• Network boundary: No data egresses to non-EU destinations by design. All inter-server traffic is confined to the on-site 800 GbE Ethernet mesh with no external routing.
• Legal boundary: AGICY operates today as a project / brand operator. Planned Cyprus Cap. 113 vehicles (including AGICY Holdings Ltd) are target / not yet formed — no HE or company number is published. The architecture is designed without a US parent entity or CLOUD Act nexus for core compute.

3. Right to Erasure (Article 17) in AI Models

AGICY is pioneering "Machine Unlearning" protocols for large language models. Should a data subject enforce their Right to be Forgotten, AGICY plans to provide the compute infrastructure required to excise specific data points from localized RAG (Retrieval-Augmented Generation) vector databases and fine-tuned weights without requiring a full model retraining from scratch.

3.1 Erasure Verification

Post-erasure, AGICY plans automated membership inference attacks against the modified model to cryptographically verify that the target data points are no longer recoverable from the model's parameters. A signed attestation report is intended for the data controller within 72 hours.

4. Data Processing Agreement (Article 28(3))

AGICY's planned standard DPA includes the following binding commitments:

• Processing only on documented instructions from the controller.
• Ensuring that persons authorised to process personal data have committed themselves to confidentiality.
• Taking all measures required pursuant to Article 32 (security of processing).
• Assisting the controller in ensuring compliance with Articles 32–36 (security, breach notification, DPIAs, prior consultation).
• Deletion or return of all personal data at the end of service provision.
• Making available to the controller all information necessary to demonstrate compliance.

5. Sub-Processor Management

AGICY does not plan to engage third-party sub-processors for core inference or training workloads. All compute is intended on AGICY-owned hardware, maintained by AGICY-employed engineers. Where ancillary sub-processors are engaged (e.g. payment processing), they are disclosed in Annex B of the DPA and subject to equivalent contractual safeguards.

6. Organizational Measures

• Appointment of an independent Data Protection Officer (DPO) reporting directly to the Board (planned).
• Mandatory Data Protection Impact Assessments (DPIA) for generative models deployed on AGIOS.
• Multi-signature cryptographic access controls requiring both client and AGICY authorization for administrative overrides.
• Planned Article 28 compliance audits by an independent EU-accredited body — roadmap, not currently held.
• Documented training programme for all personnel with access to processing systems.

7. Data Breach Notification (Articles 33–34)

In the event of a personal data breach, AGICY intends to notify the data controller without undue delay and in any case within 24 hours of becoming aware of the breach — a design target faster than the GDPR's 72-hour requirement. The notification includes:

• Nature of the breach, including categories and approximate number of data subjects affected.
• Name and contact details of the DPO.
• Likely consequences of the breach.
• Measures taken or proposed to address the breach and mitigate adverse effects.

8. International Transfer Safeguards

AGICY does not intend to transfer personal data outside the European Economic Area. In the event a client requests processing involving data flows to non-EU jurisdictions, AGICY will refuse the instruction and escalate to the DPO, consistent with its obligations under Article 28(3)(a).