Data processing agreement

1.1Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, where applicable, the UK GDPR. "Sub-processor" means a third party engaged by the Processor that processes personal data on behalf of the Controller.

2.1Subject: the provision of AI agents that carry out tasks for the Controller on their own computers in the cloud, around the clock if the Controller wishes, as described in the Terms of service.

2.2Nature and purpose: storing, organising, consulting, using, transmitting and deleting personal data, insofar as needed to carry out the tasks the Controller explains or shows to its AI agents, to deliver messages through the channels the Controller connects, and to secure and support the Service.

2.3Duration: for the term of the agreement and until the data is deleted in accordance with the section "Deletion and return of data".

3.1Data subjects: the Controller's customers and prospects, contacts, suppliers, staff and team members, recipients of messages and any other persons whose data the Controller puts into the Service or lets its AI agents process, including data on websites and in accounts the AI agents use for the Controller and in messages exchanged through connected channels.

3.2Categories of data: identification and contact data, communication (emails, chat messages, calendar items), documents and files, order, contract and financial data (such as invoices, prices and payment status), data shown on websites and in applications the AI agents use, screenshots and screen recordings, and any other data contained in the content the Controller provides.

3.3The Controller does not put special categories of personal data (Article 9 GDPR) or data relating to criminal convictions into the Service, unless this is necessary and lawful and the Controller has assessed the risks itself.

4.1The Processor processes personal data only on documented instructions of the Controller, including with regard to transfers to third countries, unless EU or Member State law requires otherwise; in that case the Processor informs the Controller beforehand, unless the law prohibits this.

4.2The Terms of service, this DPA, the configuration of the Service and the tasks the Controller and its team members explain or show to their AI agents together constitute the Controller's instructions.

4.3The Processor informs the Controller immediately if, in its opinion, an instruction infringes the GDPR.

4.4The Controller is responsible for the lawfulness of the processing, including the legal basis, informing data subjects and respecting the terms of the third-party websites and channels used on its behalf.

5.1The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and only have access insofar as necessary.

6.1The Processor implements appropriate technical and organisational measures in accordance with Article 32 GDPR, in particular:

• hosting in the European Union (OVHcloud, Gravelines, France);
• encryption in transit (TLS) and at rest, with a separate data key per workspace, wrapped by a master key; deleting the workspace destroys the key (crypto-shredding);
• logical separation of workspaces in the database (row-level security) and isolated computers with their own encrypted disk for the AI agents, which can reach the internet but not the Processor's internal systems or other workspaces;
• logins for third-party websites stored in an encrypted vault, never shown in plain text in logs;
• least-privilege access to production systems, secrets management and logging of administrative actions;
• approval by the Controller before important actions of AI agents;
• daily and weekly backups, tested restores, logs kept for 7 days;
• monitoring, alerting and an incident procedure.

6.2The Processor may update these measures as long as the overall level of protection is not reduced.

7.1The Controller gives general authorisation for the use of sub-processors. On the date of this DPA, these are the following; messaging channels are only involved when the Controller connects them:

7.2The Processor informs the Controller by email at least 30 days in advance of any intended addition or replacement of a sub-processor. The Controller may object on reasonable grounds within that period. If no solution is found, the Controller may terminate the affected part of the Service before the change takes effect, without costs.

7.3The Processor imposes on every sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA, and remains liable towards the Controller for the performance of the sub-processor's obligations.

8.1The Processor stores the personal data in the European Union. Personal data may be accessed or processed outside the EEA only with the safeguards of Chapter V GDPR: by the Processor itself from the United Arab Emirates for management and support, and by sub-processors as listed in the table above.

8.2Insofar as a transfer from the Controller to the Processor takes place, the Standard Contractual Clauses of the European Commission (Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference. For onward transfers to sub-processors the Processor concludes the Standard Contractual Clauses (Module Three) or relies on another valid transfer mechanism, such as the EU-US Data Privacy Framework.

8.3For the Standard Contractual Clauses, the optional docking clause does not apply, option 2 (general authorisation) applies under clause 9, the governing law is that of Belgium and the competent courts and supervisory authority are those of Belgium.

To be confirmed by counsel: SCC module choice, UK addendum, transfer impact assessment and the details of Annex I–III to be confirmed by counsel.

9.1Taking into account the nature of the processing, the Processor assists the Controller with appropriate measures in responding to requests from data subjects (access, rectification, erasure, restriction, portability, objection). Requests the Processor receives directly are forwarded to the Controller without undue delay.

9.2The Processor also assists the Controller in ensuring compliance with its obligations regarding security, data protection impact assessments and prior consultation of the supervisory authority, insofar as related to the Service.

10.1The Processor notifies the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Controller's data.

10.2The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information that is not yet available is provided as soon as possible.

11.1During the agreement, the Controller can download all data of its workspace at any time. After the end of the agreement the Processor, on request, helps the Controller export its data within 30 days.

11.2After the end of the agreement, or when the Controller erases its workspace, the workspace is suspended and all personal data of the Controller is permanently deleted after 30 days, including the AI agents' computers and the workspace's encryption key, unless EU or Member State law requires storage. Copies in encrypted backups are deleted automatically when those backups expire, within 90 days at most (plus at most 7 days for superseded versions). Logs are deleted after 7 days.

11.3On request, the Processor confirms the deletion in writing.

12.1The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, such as a description of its security measures and the reports of its sub-processors.

12.2The Controller may carry out an audit, or have it carried out by an independent auditor bound by confidentiality, at most once a year, with at least 30 days' notice and without disrupting the Service, unless a personal data breach or a supervisory authority justifies an earlier audit. Each party bears its own costs.

13.1The limitation of liability in the Terms of service applies to this DPA, without prejudice to the liability of the parties towards data subjects under Article 82 GDPR.

13.2This DPA remains in force for as long as the Processor processes personal data on behalf of the Controller. In case of contradiction with the Terms of service, this DPA prevails with regard to the processing of personal data.