Data processing agreement

1. Parties and roles

This agreement is part of the Terms of service between the customer (the "Controller") and Structrl, KvK 67721540 (the "Processor"). It covers personal data the Processor processes on the Controller's behalf when providing the Service ("Customer Personal Data"). Words such as "processing", "personal data breach" and "data subject" have their GDPR meaning.

2. Instructions

The Processor processes Customer Personal Data only on the Controller's documented instructions. The Terms, this agreement and the Controller's use and configuration of the Service (for example connecting integrations, choosing model providers, starting runs) are those instructions. The Processor tells the Controller if it believes an instruction infringes the GDPR, and processes data otherwise only where EU or Dutch law requires it.

3. Confidentiality

Everyone at the Processor with access to Customer Personal Data is bound by confidentiality and has access only where needed for their role.

4. Security

The Processor implements appropriate technical and organisational measures (art. 32 GDPR), including:

• encryption in transit (TLS) and encrypted storage of secrets, API keys and tokens;
• logical separation of customer data per organisation and workspace, and role-based access in the application;
• least-privilege access for staff, multi-factor authentication on administrative systems, and access logging;
• a tamper-evident, hash-chained audit trail of agent activity;
• isolated, short-lived sandboxes for running checks on customer code;
• backups, monitoring, and a documented incident response process.

5. Subprocessors

The Controller authorises the Processor to engage the subprocessors listed on the Subprocessors page. The Processor announces new or replaced subprocessors at least 30 days in advance on that page and by e-mail to account owners who subscribe to updates. The Controller may object on reasonable data protection grounds; if no solution is found, the Controller may terminate the affected service. The Processor imposes the same data protection obligations on each subprocessor and remains responsible for it.

Model providers and integrations the Controller connects with its own credentials (for example OpenRouter, GitHub or a self-hosted model) are chosen and contracted by the Controller. They are not subprocessors of the Processor; data is sent to them on the Controller's instruction.

6. Assistance

Taking into account the nature of the processing, the Processor helps the Controller to respond to data subject requests, and with data protection impact assessments and prior consultations where required. Requests the Processor receives directly from data subjects are forwarded to the Controller.

7. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification includes the information available at that time (nature of the breach, categories and approximate number of data subjects and records, likely consequences, and measures taken), supplemented as more becomes known, so the Controller can meet its own notification obligations.

8. International transfers

Customer Personal Data is hosted in the European Union. Where a subprocessor processes it outside the European Economic Area, the transfer is covered by an adequacy decision (such as the EU-U.S. Data Privacy Framework) or by the European Commission's Standard Contractual Clauses, with supplementary measures where needed.

9. Deletion and return

During the agreement the Controller can export its data (for example the audit trail as JSON) and delete workspaces at any time. After the agreement ends, the Processor deletes Customer Personal Data within 30 days, and from backups within a further 60 days, unless EU or Dutch law requires it to be kept.

10. Audits

The Processor makes available the information needed to demonstrate compliance with this agreement. The Controller may audit compliance once per year, or after a personal data breach, with at least 30 days' notice, at its own cost, through an independent auditor bound by confidentiality, and without disrupting the Service. Existing third-party reports or certifications are used first where they answer the questions.

11. Liability and term

The limitations of liability in the Terms apply to this agreement, except where the GDPR does not allow them. This agreement applies for as long as the Processor processes Customer Personal Data for the Controller. Dutch law governs it.

Annex: description of the processing

Need a signed copy? E-mail support@structrl.dev.