This Data Processing Agreement (the "DPA") forms part of the Eidren Terms of Service (the "Agreement") between Aletarch Inc ("Aletarch") and the customer that has accepted the Agreement on behalf of an organization ("Customer"). It applies to the extent Aletarch processes Personal Data on Customer's behalf and Data Protection Law applies to that processing. Customer accepts this DPA by accepting the Agreement on behalf of an organization or by countersigning it; either party may request a signed copy.

1. Definitions#

1.1 "Customer Data" means Personal Data that Customer or its Users submit to the Service, that Eidren reads or generates while performing tasks for Customer, and that is stored in Customer's workspace.

1.2 "Data Protection Law" means all laws applicable to the processing of Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and applicable United States state privacy laws.

1.3 "Personal Data", "Controller", "Processor", "Data Subject", "Processing", "Personal Data Breach", and "Supervisory Authority" have the meanings given in the GDPR, and their equivalents under other Data Protection Law.

1.4 "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

1.5 "Subprocessor" means a third party engaged by Aletarch to process Customer Data.

1.6 "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

1.7 "Users" means the individuals Customer authorizes to use the Service under its Account.

Other capitalized terms have the meaning given in the Agreement.

2. Roles#

2.1 For Customer Data, Customer is the Controller, or a Processor acting on behalf of its own controller, and Aletarch is Customer's Processor.

2.2 For account, billing, usage, security, and support information that Aletarch processes for its own purposes, Aletarch is an independent Controller, as described in the Eidren Privacy Policy. This DPA does not apply to that processing.

3. Details of processing#

The subject matter, duration, nature, and purpose of the processing, and the categories of Data Subjects and Personal Data, are set out in Annex I.

4. Aletarch's obligations as Processor#

4.1 Instructions. Aletarch will process Customer Data only on Customer's documented instructions, which consist of the Agreement, this DPA, and the instructions Customer's Users give through the Service, unless required to do otherwise by law, in which case Aletarch will inform Customer before processing unless the law prohibits it. Aletarch will inform Customer if it believes an instruction infringes Data Protection Law.

4.2 Confidentiality. Aletarch will ensure that persons authorized to process Customer Data are bound by obligations of confidentiality.

4.3 Security. Aletarch will implement the technical and organizational measures in Annex II and may update them, provided that the overall level of security does not decrease.

4.4 Assistance. Taking into account the nature of the processing and the information available to it, Aletarch will assist Customer in responding to Data Subject requests (Section 7), in meeting its obligations relating to security and Personal Data Breach notification, and in carrying out data protection impact assessments and prior consultations, at Customer's reasonable cost where the assistance goes beyond the Service's built-in tools.

4.5 Personnel and access. Aletarch limits access to Customer Data to personnel who need it to provide the Service or to support Customer.

5. Subprocessors#

5.1 Authorization. Customer gives general authorization for Aletarch to engage the Subprocessors on the list Aletarch provides to Customer on acceptance of this DPA (the "Subprocessor List"), as updated in accordance with this Section 5.

5.2 Notice and objection. Aletarch will give Customer at least 15 days' notice by email before adding or replacing a Subprocessor that processes Customer Data. Customer may object on reasonable, documented data-protection grounds within that period. If the parties cannot resolve the objection in good faith, Customer may terminate the affected part of the Service, and Aletarch will refund any prepaid, unused fees for it.

5.3 Flow-down. Aletarch will impose on each Subprocessor data-protection obligations no less protective than those in this DPA and remains liable for the Subprocessor's performance of them.

6. International transfers#

6.1 Locations. Aletarch processes Customer Data in the United States and in the countries in which its Subprocessors operate.

6.2 EEA transfers. Where Customer Data protected by the GDPR is transferred to Aletarch or a Subprocessor in a country without an adequacy decision, the SCCs apply and are incorporated into this DPA as follows: Module Two (controller to processor) where Customer is a Controller, and Module Three (processor to processor) where Customer is a Processor; Clause 7 (docking clause) is included; under Clause 9, Option 2 (general authorization) applies with the notice period in Section 5.2; the optional language in Clause 11 is not included; under Clause 13 and Annex I.C, the competent Supervisory Authority is that of the EEA member state in which Customer is established; under Clause 17, the governing law is the law of Ireland; under Clause 18, the courts of Ireland. Annex I.A of the SCCs is completed by the parties' account details and the record of acceptance of this DPA; Annex I.B by Annex I of this DPA; Annex II by Annex II of this DPA; and Annex III by the Subprocessor List.

6.3 UK transfers. For Customer Data protected by the UK GDPR, the UK Addendum applies, with Table 2 selecting the SCCs as completed in Section 6.2 and Table 4 permitting either party to end the UK Addendum as set out in its Section 19.

6.4 Swiss transfers. For Customer Data protected by the FADP, the SCCs apply with the adaptations required by the Federal Data Protection and Information Commissioner, including that references to the GDPR are read as references to the FADP and the competent authority is the Commissioner.

6.5 Transfer assessments. Aletarch will notify Customer if it becomes aware of a law or practice that prevents it from fulfilling its obligations under the SCCs, and will provide reasonable information to support Customer's transfer impact assessment on request.

7. Data Subject requests#

The Service provides tools with which Users can export and delete their data. If Aletarch receives a request directly from a Data Subject concerning Customer Data, it will, where the Data Subject is identifiable as Customer's User, direct the Data Subject to Customer and notify Customer, and will not respond substantively except as required by law or instructed by Customer.

8. Personal Data Breach#

Aletarch will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Data, by email to Customer's Account administrator. The notice will describe the nature of the breach, the categories and approximate numbers of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point, and Aletarch will provide updates as further information becomes available. Aletarch will cooperate with Customer's own notification obligations. Notification is not an admission of fault or liability.

9. Audit#

On written request no more than once in any 12-month period, and additionally following a Personal Data Breach, Aletarch will make available the information reasonably necessary to demonstrate compliance with this DPA, in the form of written responses, its security documentation, and any third-party audit reports or certifications it holds. Where that information is insufficient to satisfy a requirement of Data Protection Law, Customer, or an independent auditor bound by confidentiality, may conduct a remote or on-site audit on 30 days' notice, during business hours, at Customer's cost, and without unreasonable disruption to Aletarch's operations.

10. Return and deletion#

On termination or expiry of the Agreement, Customer may export Customer Data for 30 days. After that period, or earlier at Customer's written request, Aletarch will delete Customer Data within 30 days, and from backups within a further 30 days, unless law requires retention, in which case the retained data remains subject to this DPA and is not processed for any other purpose.

11. Liability and precedence#

Each party's liability under this DPA is subject to the exclusions and limitations in the Agreement, except that nothing limits either party's liability to Data Subjects under the SCCs. In the event of conflict, the SCCs prevail over this DPA, and this DPA prevails over the Agreement in respect of its subject matter.

12. Term#

This DPA takes effect on acceptance and continues until Aletarch has ceased processing Customer Data in accordance with Section 10.

Annex I — Details of processing#

Subject matter	Provision of the Eidren AI agent service to Customer
Duration	The term of the Agreement plus the deletion period in Section 10
Nature and purpose	Hosting, storing, and processing Customer Data to carry out tasks instructed by Customer's Users, including transmission of content to AI model providers, operation of sandboxes, browsers, and cloud desktops, and Actions in Connected Accounts
Categories of Data Subjects	Customer's Users; individuals whose Personal Data appears in content Customer submits or that Eidren reads while performing tasks, such as Customer's employees, customers, contacts, and correspondents, and users of websites Eidren visits
Categories of Personal Data	Names, contact details, message and document contents, identifiers for Connected Accounts, screenshots and page contents of visited websites, and any other Personal Data Customer's Users choose to involve in a task
Special categories	Not intended. Customer will not instruct processing of special-category data without Aletarch's prior written agreement
Frequency	Continuous, for the duration of the Agreement
Subprocessors	As set out in the Subprocessor List

Annex II — Technical and organizational measures#

Aletarch implements the following measures.

Encryption. TLS 1.2 or higher for data in transit; encryption at rest for databases, object storage, and backups; Connected Account credentials encrypted under a dedicated key.
Isolation. Each task's sandbox and desktop is an isolated environment with a bounded lifetime; workspaces are logically separated by Account, with row-level security enforced in the database.
Access control. Least-privilege access for personnel; multi-factor authentication on administrative consoles; hashed API keys; no shared credentials; access reviewed at least annually and on every departure.
Logging and monitoring. Application and infrastructure logs retained for 30 days; alerts on security-relevant events; an append-only usage ledger.
Secure development. Code review, automated testing, dependency and secret scanning, and change management through version control.
Vendor management. Subprocessors engaged under written agreements with security and confidentiality terms; the list published and maintained.
Business continuity. Managed database with point-in-time recovery; infrastructure defined as code to enable redeployment.
Incident response. A documented plan with defined roles, customer notification within 72 hours, and post-incident review.
Data minimization. Detailed task records pruned after 14 days; screenshots masked for password and payment fields by design; a published retention schedule.
Personnel. Confidentiality obligations in every contractor and employee agreement; security briefing on onboarding.

Eidren Data Processing Agreement