DATA PROCESSING AGREEMENT

This Data Processing Agreement ("DPA") applies where you use Auprimus to process personal data for which you are the controller. It forms part of our Terms of Service. Where this DPA and the Terms conflict on the processing of personal data, this DPA governs.

In this DPA, "GDPR" means Regulation (EU) 2016/679 and, in the United Kingdom, the UK GDPR and Data Protection Act 2018. "Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR.

1. ROLES

You are the controller of the personal data you put into the Services. We are your processor for it. Where you are yourself a processor for someone else, we are your sub-processor, and your own controller's instructions reach us through you.

We are an independent controller for a narrow set of data we need in order to run a business: the account and billing records of the person who signs up, and the operational logs described in our Privacy Notice. That processing is governed by our Privacy Notice, not by this DPA.

2. SCOPE OF PROCESSING

Subject matter: providing the Services.

Duration: for as long as your account exists, and afterwards only as clause 9 permits.

Nature and purpose: storing your workflows and their inputs and outputs; executing the workflows you define; transmitting content to the connectors and AI providers you select; and making the results available to you.

Types of personal data: whatever you choose to put into the Services. We do not restrict it and we do not inspect it. It commonly includes contact details, employment or customer records, and free text.

Categories of data subject: whoever appears in the data you process - your customers, your employees, your suppliers, or anyone else.

You decide what enters the Services. If you put special category data (health, biometrics, political opinion and the rest of Article 9) into a workflow, you do so on your own lawful basis, and you should satisfy yourself that the AI provider you have selected is an appropriate destination for it.

3. OUR INSTRUCTIONS

We process personal data only on your documented instructions. Your use of the Services is itself an instruction: creating a workflow instructs us to run it, connecting a source instructs us to read it, and selecting a model instructs us to send content there.

We will also process where the law requires it. If we are compelled to, we will tell you before we do, unless the law forbids us from telling you.

If we believe an instruction breaches data protection law, we will tell you. We may decline to act on it.

4. CONFIDENTIALITY

Everyone we allow to access personal data processed under this DPA is bound by a duty of confidentiality, and access is limited to those who need it to operate or support the Services.

5. SECURITY

We maintain the technical and organisational measures described in our Privacy Notice, which currently include: encryption of traffic in transit; authentication of every request and scoping of all data access to a single organization; encryption at rest of the connector credentials you store, which are never returned to a browser once saved; and execution of generated code in a sandboxed subprocess that receives only the credentials that step requires.

These measures may change as the product changes. We will not reduce the overall level of security during your subscription.

6. SUB-PROCESSORS

You give us general authorisation to engage sub-processors. The current list, with what each receives, is published at https://auprimus.com/sub-processors.

We will update that page before adding a sub-processor that will receive your personal data. If you object on reasonable data protection grounds, tell us within thirty (30) days; if we cannot resolve it, you may terminate the affected Services and receive a refund of any fees paid for the unused remainder of your term.

Each sub-processor is engaged under terms imposing obligations equivalent to those in this DPA, and we remain liable to you for their performance.

AI providers are a special case. Read clause 7 rather than treating them as ordinary sub-processors.

7. AI PROVIDERS

You select which AI provider processes your content, and except for the single free model we provide, you supply the API key. The consequence is that your relationship with that provider is direct: their terms govern what they do with what you send, including whether they retain it and whether they train on it.

We transmit what your workflow sends and return what the provider answers. We do not choose the provider, we cannot vary its terms, and we cannot inspect its systems. Before sending personal data through a model, satisfy yourself that the provider is an appropriate recipient - including where the transfer leaves your jurisdiction.

Models you run yourself through Ollama transmit nothing to any third party.

8. DATA SUBJECT RIGHTS

The Services are built so that you can answer most requests yourself, immediately: Settings > Data Controls exports everything your organization holds as a structured archive, and permanently deletes chats, stored run files and workflows.

Where a request cannot be answered through those controls, we will assist you, taking into account the nature of the processing. If a data subject contacts us directly about data you control, we will not respond substantively - we will tell them to contact you, and tell you that they did.

9. DELETION AND RETURN

You can export and delete your data at any time from Settings > Data Controls.

On termination, you may export your data before the account closes. We will delete personal data processed on your behalf within ninety (90) days of termination, except where we are legally required to keep it, in which case we will keep only what is required, for only as long as required, and continue to protect it under this DPA.

Backups taken for platform recovery may retain data beyond that point. They are overwritten in the ordinary cycle and are not used to restore individual accounts.

10. AUDIT

We will make available the information reasonably necessary to demonstrate compliance with Article 28, and allow for audits, including inspections, by you or an auditor you appoint. In the first instance we will answer a written questionnaire. Where that is genuinely insufficient, an on-site audit may be conducted once in any twelve-month period, on thirty (30) days notice, during business hours, without unreasonable disruption, and subject to confidentiality. You bear your own costs.

11. PERSONAL DATA BREACH

We will notify you without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting personal data we process for you. The notification will describe what we know: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Where we cannot provide all of it at once, we will provide it in stages as it becomes available.

We will assist you with your own notification obligations to a supervisory authority and to data subjects.

12. IMPACT ASSESSMENTS

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and with prior consultation of a supervisory authority.

13. INTERNATIONAL TRANSFERS

Our sub-processors are located in the United States, the European Union and elsewhere, as set out on the sub-processors page. Where personal data is transferred out of the EEA or the United Kingdom, the transfer is made under the European Commission's Standard Contractual Clauses, and the UK Addendum where the UK GDPR applies, which are incorporated into this DPA by reference: module two (controller to processor) applies where you are a controller, and module three (processor to processor) where you are yourself a processor. We act as data importer.

Transfers to an AI provider you select are made on your instruction and under that provider's own terms, as set out in clause 7.

14. LIABILITY

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where those limitations cannot lawfully be applied to a claim under data protection law.

15. TERM

This DPA takes effect when you begin using the Services to process personal data, and continues until we have deleted or returned that data in accordance with clause 9.

CONTACT

Questions about this DPA, or a request for a countersigned copy: [email protected]