Data Processing Agreement

Effective 2026-10-31

This is the Data Processing Agreement (the "DPA") for the Aitonomy platform and for Aitonomy's services, between Aitonomy B.V., a private limited company established in Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 42198573, and in this DPA referred to as "Aitonomy", and the Customer.

This DPA forms an integral part of the SaaS Terms and Conditions, of the Services Terms and Conditions, or of both, whichever apply to the Agreement, and of the Agreement itself. Words written with a capital that are not defined in this DPA have the meaning given in the applicable Terms.

1. Definitions

1.1 In this DPA the following terms have the following meaning, and words written with a capital that are not defined here have the meaning given in the Terms. Where a word is defined in only one of the Terms, that definition applies:

1.1.1 Controller: the party that determines the purposes and means of the processing of Personal Data.

1.1.2 Processor: the party that processes Personal Data on behalf of the Controller.

1.1.3 Data Subject: an identified or identifiable natural person to whom Personal Data relates.

1.1.4 Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

1.1.5 Sub-processor: a third party engaged by Aitonomy to process Personal Data in connection with the Services.

1.1.6 Supervisory Authority: the competent data protection supervisory authority, which in the Netherlands is the Autoriteit Persoonsgegevens.

1.1.7 Services: the Aitonomy service (agents as a service) as defined in the SaaS Terms and Conditions, the advisory, assessment, design and implementation services as defined in the Services Terms and Conditions, or both, as applicable to the Agreement.

1.1.8 Terms: the SaaS Terms and Conditions, the Services Terms and Conditions, or both, whichever apply to the Agreement.

2. Roles and scope

2.1 This DPA applies to the processing of Personal Data by Aitonomy on the Customer's behalf under the Agreement, whether that Agreement concerns the Service, the Services, or both. Neither requires Personal Data to function. However, the Customer Data and Customer Materials that the Customer connects to or makes available (documents, records, tickets, code, prompts, and the process and system documentation drawn from the systems the Customer connects), together with the account data of the Customer's Users, may contain Personal Data.

2.2 To the extent Aitonomy processes Personal Data in connection with the Services, Aitonomy acts as Processor and the Customer as Controller within the meaning of the GDPR. The Customer determines the purposes and means of the processing.

2.3 This DPA applies to all processing of Personal Data that Aitonomy carries out on the Customer's behalf for the performance of the Agreement, whatever the configuration of the Services. Schedule 2 describes, for each configuration, the processing activities that Aitonomy carries out.

2.4 This DPA forms an integral part of the Agreement, and the liability arrangements in the Terms apply to it. In the event of a conflict between this DPA and the Terms in respect of the processing of Personal Data, this DPA prevails.

2.5 This DPA does not cover processing for which Aitonomy is an independent controller, including the processing of sign-in events and usage data of Users for the purposes of securing and billing the Service, as described in the Privacy Statement published at joinaitonomy.ai/legal/privacy, and the Personal Data of the Customer's personnel and other participants that Aitonomy records in the course of an Assignment, such as contact details, meeting notes, recordings and transcripts, which is described in clause 8.8 of the Services Terms and Conditions, and the evaluation and improvement of the Service described in clauses 7.9 and 7.10 of the SaaS Terms and Conditions, for which Aitonomy removes Personal Data with automated filters before storage, as an obligation of means.

3. Processing of Personal Data

3.1 Aitonomy processes Personal Data only to provide and support the Services and on the documented instructions of the Customer, including with regard to transfers of Personal Data to a third country, unless required to do so by Union or Member State law to which Aitonomy is subject; in such a case, Aitonomy informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The Agreement, the Order Form, and the Customer's configuration and use of the Services constitute the Customer's documented instructions. Aitonomy will inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law, unless prohibited from doing so by law.

3.2 The subject matter of the processing is the provision of the Services. The nature and purpose of the processing is the governance, execution, review and measurement of Agents and the related operation of the platform and, where the Agreement includes services, the assessment, design and implementation work described in the Order Form. The processing continues for the duration of the Agreement.

3.3 The types of Personal Data processed are determined by the Customer and may include the business email address of the Customer's Users, their team membership and, where the Customer uses it, a cost centre, together with sign-in and usage metadata generated as the Service runs, except where Aitonomy processes that metadata for securing and billing the Service, for which it is an independent controller under clause 2.5, and any Personal Data incidentally contained in Customer Data or Customer Materials that the Customer chooses to make available to the Services.

3.4 The categories of Data Subjects are determined by the Customer and may include the Customer's Users and employees, and any individuals whose Personal Data is incidentally contained in Customer Data.

3.5 Special categories of personal data within the meaning of Article 9 of the GDPR, and personal data relating to criminal convictions and offences within the meaning of Article 10 of the GDPR, are processed only where the Order Form expressly provides for that processing. Absent such a provision, the Customer will not make such data available to the Services.

3.6 Where the Order Form provides for the processing of such data, the parties record in the Order Form, for each process concerned: the categories of data involved, the purpose, the legal basis on which the Customer relies, the retention period, and the additional safeguards that apply. Those safeguards include in any event that the processing takes place within the European Economic Area, that only the fields required for the relevant processing step are transferred, that access is restricted to named personnel, and that the data are not used to train AI models.

3.7 In a Scan as defined in the Services Terms and Conditions, no such data are processed. Where they are relevant to a process under assessment, they are described as a data flow only.

4. Confidentiality and security

4.1 Aitonomy ensures that the persons authorised to process Personal Data under its responsibility are bound by an appropriate duty of confidentiality.

4.2 Aitonomy implements and maintains the technical and organisational measures set out in Schedule 1 to protect Personal Data against loss and against unlawful processing, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to Data Subjects.

4.3 The Customer may request Aitonomy to implement additional security measures. Aitonomy may charge the reasonable costs of implementing measures requested by the Customer. Aitonomy does not guarantee that the security measures are effective in all circumstances; this does not limit Aitonomy's obligation to implement and maintain the measures set out in Schedule 1.

5. Sub-processors

5.1 The Customer grants Aitonomy general authorisation to engage Sub-processors for the processing of Personal Data. A current list of Sub-processors is available at joinaitonomy.ai/legal/sub-processors.

5.2 Aitonomy imposes on each Sub-processor, by contract, data protection obligations that are in substance the same as those set out in this DPA. Aitonomy remains responsible to the Customer for the performance of each Sub-processor's obligations. The Sub-processors list refers to the processing terms of each Sub-processor, so that the Customer can see what they contain. This does not affect Aitonomy's responsibility under the previous sentence, which reflects Article 28(4) of the GDPR, and does not affect clause 5.4, which prevails.

5.3 Aitonomy will inform the Customer at least thirty (30) days before an intended addition or replacement of a Sub-processor takes effect, through its website or otherwise in writing. The Customer may object on reasonable data protection grounds within fifteen (15) days of the notice, in which case Aitonomy does not use that Sub-processor for the Customer's Personal Data while the parties discuss a solution in good faith, failing which the Customer may terminate the affected part of the Services. Where the affected part cannot reasonably be separated from the rest of the Services, the Customer may terminate the Service with effect from the date of the change, and clause 9.4 of the SaaS Terms and Conditions applies to prepaid Fees.

5.4 Where Aitonomy contracts a third party provider of AI models itself, Aitonomy engages and configures that provider under terms that prohibit the use of Customer Data, Customer Materials and Personal Data to train or otherwise improve the provider's models, in line with clause 7.4 of the SaaS Terms and Conditions and clause 7.7 of the Services Terms and Conditions. Aitonomy does not use Personal Data to train AI models.

5.5 A Customer AI Provider, as defined in the SaaS Terms and Conditions, is not engaged by Aitonomy and is not a Sub-processor. The Customer contracts with it directly and is responsible for the processing by that provider, including any transfer outside the European Economic Area that it involves. Clause 6 does not apply to that processing.

6. International transfers

6.1 Aitonomy and its Sub-processors process Personal Data within the European Economic Area, or outside it only where a valid transfer mechanism under Chapter V of the GDPR is in place, such as an adequacy decision or the European Commission's standard contractual clauses. The Sub-processors list states, for each Sub-processor and each provider of AI models, where processing takes place, whether access from outside the European Economic Area is possible, and which mechanism applies. A change is notified in accordance with clause 5.3.

6.2 Where Aitonomy engages a provider of AI models as a Sub-processor, including for frontier models, the Sub-processors list states where the processing takes place, whether the provider belongs to a group that is subject to the law of a country outside the European Economic Area, and the transfer mechanism that applies to any processing or access outside the European Economic Area, such as an adequacy decision or the European Commission's standard contractual clauses. Processing outside the European Economic Area takes place only where such a mechanism is in place.

7. Assistance, data subject requests and Personal Data Breaches

7.1 Taking into account the nature of the processing and the information available to it, Aitonomy provides reasonable assistance to the Customer in meeting its obligations to respond to requests from Data Subjects, to implement appropriate security measures, to notify and handle Personal Data Breaches, and to carry out data protection impact assessments and any prior consultation with a Supervisory Authority. Aitonomy may charge its reasonable costs for such assistance.

7.2 If Aitonomy receives a request from a Data Subject relating to Personal Data processed under this DPA, it will, where legally permitted, forward the request to the Customer without undue delay and will not respond to the request itself except on the Customer's instruction.

7.3 Aitonomy notifies the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data, and provides the information reasonably available to it to enable the Customer to meet its obligations under the GDPR.

7.4 The Customer remains responsible for notifying the relevant Supervisory Authority and, where required, the affected Data Subjects.

7.5 Aitonomy's contact point for Personal Data Breaches and security incidents is security@joinaitonomy.ai, and for other matters under this DPA hello@joinaitonomy.ai, or another address that Aitonomy notifies to the Customer in writing. Aitonomy sends notifications under clause 7.3 to the contact stated in the Order Form.

8. Audit

8.1 Aitonomy makes available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including documentation of the technical and organisational measures set out in Schedule 1 and, where Aitonomy holds one, a certificate, an audit report or a third party report.

8.2 The Customer may, at most once per calendar year and on at least two weeks' prior notice, have an audit carried out at its own cost by an independent auditor bound by confidentiality, in order to verify Aitonomy's compliance. The audit will be conducted so as to cause the least possible disruption to Aitonomy's operations.

8.3 The parties will discuss the findings of an audit, and Aitonomy will implement reasonable improvement measures, taking into account the risks, the state of the art, and the costs of implementation.

9. Return and deletion

9.1 On termination of the Agreement, Aitonomy returns or, at the Customer's choice, deletes the Personal Data it processes on the Customer's behalf, within a reasonable period and in such a way that it can no longer be used, unless storage is required by law. Where the Service runs on the Customer Environment, Personal Data held there remains within the Customer Environment. Aitonomy confirms the deletion in writing.

9.2 Personal Data contained in routine backups is deleted in accordance with Aitonomy's backup cycle, and remains subject to the confidentiality and security obligations of this DPA until deleted.

10. General

10.1 This DPA is governed by the laws of the Netherlands. Any dispute arising from or in connection with it is submitted exclusively to the competent court of The Hague (Rechtbank Den Haag), the Netherlands.

10.2 If any provision of this DPA is invalid or unenforceable, the remaining provisions remain in force, and the invalid provision is replaced by a valid provision that reflects the original intention as closely as possible.

Schedule 1: Technical and Organisational Measures

These are the technical and organisational security measures that Aitonomy implements. They form part of this DPA and, through clause 8.2 of the SaaS Terms and Conditions and clause 8.5 of the Services Terms and Conditions, they apply to all Customer Data and Customer Materials, whether or not these contain Personal Data. In this Schedule, references to Customer Data include Customer Materials and Deliverables.

Where the Service is hosted by Aitonomy, these measures apply to the hosted Service. Where the Service runs on the Customer Environment or with a Customer AI Provider, the Customer controls that environment and that provider, and the measures apply to the governed layer that Aitonomy operates and to Aitonomy's access and tooling. Where Aitonomy performs services, they apply to Aitonomy's access to and handling of Customer Materials and Deliverables.

Standards we follow. Aitonomy uses ISO/IEC 27001 and ISO/IEC 42001 as reference frameworks in designing its information security and its management of AI systems. Aitonomy does not implement every control of those standards, is not certified against either, and does not hold itself out as certified.

Hosting and data location. The Service is hosted on cloud infrastructure of European providers, in the locations stated in the Sub-processors list, and subject to clause 6. Customer Materials and Deliverables provided for an Assignment are stored within the European Economic Area.

Access control. Access to Customer Data is restricted to authorised personnel on a least privilege, role-based basis, is granted on individual accounts, and is reviewed and withdrawn when no longer needed. Administrative access to the infrastructure runs over a private network; there is no administrative access exposed to the public internet. Personnel access Customer Data only from within the European Economic Area. Aitonomy acts within the Customer's environment in the Service only with the Customer's permission, for a limited period, and each action is logged under the individual's own account; access needed to handle a security incident or to keep the Service running is logged in the same way. Users sign in through the Customer's own identity provider, so that the Customer's authentication policy, including multi-factor authentication, applies.

Encryption. Customer Data is encrypted in transit using current transport encryption, and encrypted at rest by the storage services on which it is held. Credentials that the Customer provides, such as keys for a Customer AI Provider, are encrypted using a key management service.

Separation. Customer environments are logically separated. In the database this is enforced through row level security and least privilege database roles, so that a query in one customer's context does not return another customer's data.

Secrets management. Operational secrets are held in a secrets vault rather than in application files, are not committed to source control, and are restricted on the systems that use them.

Logging and audit trail. Actions taken through the Service are recorded in an audit trail that is chained so that later alteration is detectable, and that records what happened without recording the content it processed. Systems are monitored for security events.

Secure development. Changes follow a review process with automated checks, including static analysis and type checking. A software bill of materials and a dependency vulnerability scan are produced for each release. Development and testing use synthetic data; Customer Data is not used for those purposes.

Security testing. The security of the Service is tested by an independent party at least once a year.

Backup and recovery. Backups are made daily, are encrypted before they leave the hosting environment with a key the backup provider does not hold, are held with a European provider separate from the host that produced them, are protected against deletion or alteration during their retention period, and have a documented restore procedure.

Personnel. Personnel and the persons Aitonomy engages are bound by confidentiality and receive access on a need to know basis. Access is withdrawn when a person leaves, at the latest on their last working day.

Sub-processors. Sub-processors are engaged under a data processing agreement with the obligations required by Article 28 of the GDPR, are listed at joinaitonomy.ai/legal/sub-processors, and are reviewed.

Security incidents. Aitonomy investigates and handles security incidents and notifies the Customer in accordance with clause 7.3 of this DPA and clause 8.4 of the SaaS Terms and Conditions.

Retention and deletion. Aitonomy keeps Customer Data no longer than it needs it to provide the Services, and applies the periods below unless the Order Form provides otherwise or a statutory retention period applies. On termination, Aitonomy returns or deletes Customer Data in accordance with clause 9.

Where a statutory retention period applies, for example to financial records, Aitonomy keeps the data concerned for that period and only for that purpose.

Aitonomy may update these measures to keep pace with the state of the art. An update does not reduce the overall level of protection they provide during the term of the Agreement.

Schedule 2: Processing activities per configuration

In every configuration: processing, not storage. Content from the Customer's connected systems, such as documents, messages and records, is retrieved when a task needs it, processed for that task, and where the task writes a result, written back to the Customer's own systems. Aitonomy does not keep that content as a store or repository; it is held only for as long as needed to perform the task. What Aitonomy does keep is set out in Schedule 1 under "Retention and deletion": the account data of Users, the Customer-specific configuration and company context, the learned context the Service derives from corrections, the inputs to and outputs of Agents, and the event and audit log.

Service hosted by Aitonomy. Aitonomy hosts the Service on the infrastructure of its Sub-processors, in the locations stated in the Sub-processors list and subject to clause 6. Inputs are processed by the providers of AI models that Aitonomy engages as Sub-processors, as the Customer's configuration determines. The processing activities are retrieval of content from connected systems, processing by Agents under the Customer's configuration, writing results back to the Customer's systems where the configuration provides for it, storage of what is listed above, logging, support, backup, and return or deletion.

Service hosted by Aitonomy, used through a Customer AI Provider. Aitonomy hosts the connections, the company context and the event and audit log, and retrieves Customer Data from the connected sources when a User asks for it through the Customer's own AI client. The Customer AI Provider receives that data under the Customer's own contract with it (clause 5.5). The processing activities are retrieval, passing data to the Customer AI Provider on the User's instruction, writing results back to the Customer's systems on the User's instruction where the Order Form permits it, logging, support, and return or deletion.

Service on the Customer Environment. Customer Data held in the Customer Environment remains there, and the processing by the Customer AI Provider falls under the Customer's own contract with that provider (clause 5.5). Aitonomy processes Personal Data to the extent reasonably necessary to set up and configure the Service under the authority given in the SaaS Terms and Conditions, to operate the governed layer that Aitonomy provides, including the data passing through it and the event and audit log, to provide support, and to export any Service Metrics agreed in the Order Form.

Services, including a Scan. Aitonomy processes the Personal Data contained in the Customer Materials that the Customer makes available for the Assignment, to the extent reasonably necessary to perform the Assignment described in the Order Form. A Scan works without production data unless the Order Form states otherwise (clause 3.7 of this DPA and clause 8.7 of the Services Terms and Conditions). Processing for which Aitonomy is an independent controller is described in clause 2.5 and is not covered by this DPA.

Aitonomy B.V. · KvK 42198573

Version 2026-10-16