Data Processing Agreement
Last updated: March, 19 - 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between Terran Labs BV, a company incorporated under the laws of Belgium ("Processor", "Tuplex"), and the entity agreeing to the Agreement ("Controller", "Customer").
This DPA sets out the terms that apply when Tuplex processes Personal Data on behalf of Customer in the course of providing the Service under the Agreement. This DPA is incorporated into and subject to the Agreement.
1. Definitions
Terms not defined in this DPA have the meanings given to them in the Agreement. In this DPA:
"Applicable Data Protection Law" means all applicable laws and regulations relating to the processing of Personal Data, including: (a) Regulation (EU) 2016/679 ("GDPR"); (b) the Belgian Data Protection Act of 30 July 2018; (c) the UK Data Protection Act 2018 and UK GDPR; (d) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"); and (e) any other applicable data protection laws.
"Controller", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" (and "Process"), "Processor", and "Supervisory Authority" have the meanings given to them in the GDPR.
"Customer Data" means Personal Data that Customer provides to Tuplex, or that Tuplex processes on behalf of Customer, in order to provide the Service.
"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to processors established in third countries, as approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
"Sub-processor" means any third party appointed by Tuplex to process Customer Data on behalf of Customer.
2. Scope and Roles
2.1. Roles. With respect to the processing of Customer Data, Customer is the Controller and Tuplex is the Processor.
2.2. Processing Details. The details of the processing (subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects) are set out in Schedule 1 (Details of Processing).
2.3. Compliance. Each party shall comply with its obligations under Applicable Data Protection Law. Customer shall ensure it has a lawful basis for transferring Customer Data to Tuplex and for instructing Tuplex to process Customer Data as contemplated by the Agreement.
3. Customer Instructions
3.1. Tuplex shall process Customer Data only on documented instructions from the Controller, as specified in the Agreement, this DPA, and any additional written instructions agreed by the parties.
3.2. The Agreement (including this DPA) constitutes Customer's complete and final instructions to Tuplex regarding the processing of Customer Data. Additional instructions require the parties' written agreement.
3.3. Tuplex shall promptly inform Customer if, in Tuplex's reasonable opinion, an instruction from Customer infringes Applicable Data Protection Law. Tuplex shall not be required to carry out any instruction it reasonably believes to be in violation of Applicable Data Protection Law.
3.4. Tuplex shall not process Customer Data for any purpose other than as set out in this DPA and the Agreement, unless required to do so by European Union or Member State law to which Tuplex is subject. In such case, Tuplex shall inform Customer of that legal requirement before processing, unless the law prohibits such notification.
4. Confidentiality
4.1. Tuplex shall ensure that persons authorized to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
4.2. Tuplex shall ensure that access to Customer Data is limited to those personnel who require such access to perform the Service.
5. Security
5.1. Tuplex shall implement and maintain appropriate technical and organizational measures to protect Customer Data against unauthorized or unlawful Processing, accidental loss, destruction, or damage, as required by GDPR Article 32. These measures include, as appropriate:
- (a) Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256 or equivalent);
- (b) Measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
- (c) The ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
- (d) A process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures;
- (e) Access controls, including role-based access, multi-factor authentication, and least-privilege principles;
- (f) Regular security assessments and penetration testing;
- (g) Employee security awareness training.
5.2. The specific technical and organizational measures currently in effect are described in Schedule 2 (Security Measures).
5.3. Tuplex may update its security measures from time to time, provided that such updates do not materially decrease the overall level of protection of Customer Data.
6. Sub-processing
6.1. General Authorization. Customer grants Tuplex a general written authorization to engage Sub-processors for the processing of Customer Data. The current list of authorized Sub-processors is set out in Schedule 3 (Sub-processor List) and is available on request at compliance@tuplex.ai.
6.2. Obligations on Sub-processors. Tuplex shall:
- (a) enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA;
- (b) remain fully liable to Customer for the performance of each Sub-processor's obligations.
6.3. Changes to Sub-processors. Tuplex shall notify Customer at least 14 days in advance of any intended addition or replacement of Sub-processors by email to the Account administrator or through the Service. Customer may object to a new Sub-processor on reasonable grounds related to data protection by notifying Tuplex in writing within 7 days of receiving the notification. If Customer objects and Tuplex cannot reasonably accommodate the objection, Customer may terminate the affected portion of the Agreement by providing written notice. Tuplex will refund any prepaid Fees for the unused portion of the Subscription Term.
7. Personal Data Breach
7.1. Tuplex shall notify Customer without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data Breach affecting Customer Data.
7.2. Such notification shall include, to the extent available:
- (a) a description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records concerned;
- (b) the contact details of Tuplex's data protection officer or other point of contact;
- (c) a description of the likely consequences of the Personal Data Breach;
- (d) a description of the measures taken or proposed to be taken to address the Personal Data Breach, including measures to mitigate its possible adverse effects.
7.3. Tuplex shall cooperate with Customer and take commercially reasonable steps to assist in the investigation, mitigation, and remediation of the Personal Data Breach.
7.4. Tuplex's notification of a Personal Data Breach shall not be construed as an acknowledgment of fault or liability.
8. Data Subject Rights
8.1. Tuplex shall assist Customer, by appropriate technical and organizational measures and taking into account the nature of the processing, in fulfilling Customer's obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law (including rights of access, rectification, erasure, restriction, portability, and objection).
8.2. If Tuplex receives a request from a Data Subject directly, Tuplex shall promptly redirect the Data Subject to Customer, unless Tuplex is legally required to respond directly.
9. Data Protection Impact Assessments and Prior Consultation
9.1. Tuplex shall provide reasonable assistance to Customer with any data protection impact assessments or prior consultations with Supervisory Authorities that Customer is required to carry out under GDPR Articles 35 and 36, taking into account the nature of the processing and the information available to Tuplex.
10. Audit Rights
10.1. Tuplex shall make available to Customer all information necessary to demonstrate compliance with this DPA and Applicable Data Protection Law, and shall allow for and contribute to audits, including inspections, conducted by Customer or a third-party auditor mandated by Customer.
10.2. Customer shall provide at least 30 days' written notice of any audit request. Audits shall be conducted during normal business hours, no more than once per year (unless required by a Supervisory Authority or following a Personal Data Breach), and shall not unreasonably interfere with Tuplex's operations.
10.3. Customer shall bear the costs of any audit, unless the audit reveals a material breach of this DPA by Tuplex.
10.4. Tuplex may satisfy audit requests by providing: (a) relevant third-party audit reports (e.g., SOC 2 Type II, ISO 27001); (b) responses to reasonable written audit questionnaires; or (c) on-site or remote audits subject to the conditions in this Section 10.
11. International Data Transfers
11.1. Customer acknowledges that the provision of the Service may involve the transfer of Customer Data to countries outside the EEA, including the United States.
11.2. Transfer Mechanism. To the extent that such transfers involve a transfer of Customer Data to a country not subject to an adequacy decision by the European Commission, the parties agree that such transfers shall be subject to the Standard Contractual Clauses (Module Two: Controller to Processor), as set out in Schedule 4 of this DPA. The SCCs are hereby incorporated by reference.
11.3. Supplementary Measures. In addition to the SCCs, Tuplex implements the supplementary technical, organizational, and contractual measures described in Schedule 2 to ensure an adequate level of protection for Customer Data.
11.4. EU-U.S. Data Privacy Framework. Where a Sub-processor is certified under the EU-U.S. Data Privacy Framework, such certification may serve as a valid transfer mechanism in accordance with the GDPR.
11.5. UK Transfers. For transfers of Customer Data from the UK, the International Data Transfer Addendum to the EU Standard Contractual Clauses (as issued by the UK Information Commissioner under Section 119A of the UK Data Protection Act 2018) shall apply and is incorporated by reference.
12. Deletion and Return of Data
12.1. Upon termination or expiration of the Agreement, and upon Customer's written request, Tuplex shall either:
- (a) return all Customer Data to Customer in a structured, commonly used, and machine-readable format; or
- (b) securely delete or anonymize all Customer Data.
12.2. Tuplex shall complete the return or deletion within 30 days of receiving Customer's written instruction, unless Applicable Data Protection Law requires continued storage.
12.3. If Customer does not provide instructions within 30 days of termination, Tuplex shall delete or anonymize Customer Data within 90 days, unless otherwise required by law.
13. CCPA-Specific Provisions
This Section 13 applies to the extent Customer Data includes Personal Information of California residents subject to the CCPA.
13.1. For purposes of the CCPA, Tuplex is a "Service Provider" with respect to Customer Data. Tuplex shall not:
- (a) sell or share Customer Data;
- (b) retain, use, or disclose Customer Data for any purpose other than the business purposes specified in the Agreement;
- (c) retain, use, or disclose Customer Data outside of the direct business relationship between Tuplex and Customer;
- (d) combine Customer Data received from or on behalf of Customer with personal information received from other sources, except as permitted by the CCPA.
13.2. Tuplex certifies that it understands the restrictions in Section 13.1 and will comply with them.
13.3. Tuplex shall assist Customer in responding to verifiable consumer requests under the CCPA.
14. Term
14.1. This DPA shall remain in effect for the duration of the Agreement. The obligations of Tuplex with respect to the processing of Customer Data shall continue for as long as Tuplex retains Customer Data.
Schedule 1: Details of Processing
| Detail | Description |
|---|---|
| Subject matter | Processing of Customer Data to provide the Tuplex AI agent platform Service |
| Duration | For the term of the Agreement, plus any post-termination retention period |
| Nature of processing | Collection, storage, retrieval, transmission, organization, use (including AI processing via third-party models), and deletion |
| Purpose of processing | Providing the Service, including AI agent execution, data storage, collaboration features, integrations, and customer support |
| Types of Personal Data | May include: names, email addresses, IP addresses, user identifiers, device information, content of communications and documents, any personal data included in Customer inputs to AI features |
| Categories of Data Subjects | Customer's employees, contractors, agents, end-users, and any individuals whose data is included in Customer Content |
Schedule 2: Technical and Organizational Security Measures
Tuplex implements the following security measures:
Infrastructure Security
- Cloud infrastructure hosted on Cloudflare, E2B and Railway with data centres in Amsterdam, Frankfurt, Ireland.
- Network segmentation and firewalls
- DDoS protection
- Intrusion detection and prevention systems
Data Protection
- Encryption in transit: TLS 1.2+ for all data transmissions
- Encryption at rest: AES-256 for stored data
- Database-level row-level security (RLS) policies
- Automated backups with 365-day retention
Access Control
- Role-based access control (RBAC)
- Multi-factor authentication for administrative access
- Principle of least privilege
- Regular access reviews
Application Security
- Secure software development lifecycle (SDLC)
- Input validation and output encoding
- Regular vulnerability assessments
- Dependency scanning and patch management
Operational Security
- 24/7 monitoring and alerting
- Incident response procedures
- Business continuity and disaster recovery plans
- Regular security awareness training for personnel
Sub-processor Security
- Due diligence assessments before engagement
- Contractual data protection obligations
- Periodic review of sub-processor compliance
Schedule 3: Sub-processor List
Current as of March, 19 - 2026
| Sub-processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Anthropic, PBC | AI model provider (Claude) | EU (Frankfurt, via Google Vertex AI) | AI inputs and outputs |
| OpenAI, LLC | AI model provider (GPT) | EU (Dublin) | AI inputs and outputs |
| Google LLC | AI model provider (Gemini) | EU (Frankfurt) | AI inputs and outputs |
| Mistral AI | AI model provider | France (EU) | AI inputs and outputs |
| Supabase, Inc. | Database, authentication, storage | EU (Frankfurt) | Account data, Customer Data |
| E2B, Inc. | Sandboxed code execution | EU | Code and data processed in agent sandboxes |
| Stripe, Inc. | Payment processing | United States | Billing and payment data |
| Resend, Inc. | Email delivery | United States | Email addresses, communication content |
| Axiom, Inc. | Logging and observability | EU (Frankfurt) | Usage data, device data |
| Sentry (Functional Software, Inc.) | Error tracking and monitoring | EU (Frankfurt) | Error data, device data, IP addresses |
The up-to-date Sub-processor list is maintained at .
Schedule 4: Standard Contractual Clauses
The Standard Contractual Clauses (Module Two: Controller to Processor) adopted by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 are hereby incorporated by reference and apply to any transfer of Customer Data to a country outside the EEA not subject to an adequacy decision.
For the purposes of the SCCs:
- Module Two (Controller to Processor) applies.
- Clause 7 (Docking clause): The optional docking clause IS included.
- Clause 9(a) (Sub-processors): Option 2 (General written authorization) applies. The time period for prior notice of Sub-processor changes is [•] days.
- Clause 11 (Redress): The optional language IS NOT included.
- Clause 13(a) (Supervision): The competent supervisory authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données).
- Clause 17 (Governing law): Option 1 applies. The governing law is the law of Belgium.
- Clause 18(b) (Forum): Disputes shall be resolved before the courts of Brussels, Belgium.
- Annex I.A (List of parties): As set out in the Agreement.
- Annex I.B (Description of transfer): As set out in Schedule 1 of this DPA.
- Annex I.C (Competent supervisory authority): Belgian Data Protection Authority.
- Annex II (Technical and organizational measures): As set out in Schedule 2 of this DPA.
- Annex III (List of sub-processors): As set out in Schedule 3 of this DPA.
For transfers from the United Kingdom, the International Data Transfer Addendum (UK Addendum) issued by the UK Information Commissioner under Section 119A of the UK Data Protection Act 2018 is incorporated by reference and supplements the SCCs.
Contact
For questions about this DPA, contact:
Data Protection Officer
Terran Labs BV
Email: dpo@tuplex.ai