Data Processing Agreement

1. Scope

This Data Processing Agreement ("DPA") supplements the General Terms and Conditions between Alex AI BV, Jozef Plateaustraat 75/201, 9000 Gent, Belgium (BCE 1029.742.102) ("Processor") and the Customer ("Controller") and governs the processing of personal data by the Processor on behalf of the Controller through the Aiqaramba platform.

2. Processing Details

• Subject matter: Automated browser-based testing of the Controller's web applications
• Duration: For the term of the underlying service agreement
• Nature and purpose: AI agents navigate the Controller's application in real browsers, capturing screenshots, logs, and interaction data to produce test reports
• Types of personal data: Test account credentials provided by Controller, page content encountered during testing (which may include personal data of the Controller's end users in non-production environments)
• Categories of data subjects: Controller's test users, Controller's employees

3. Obligations of the Processor

The Processor shall process personal data only on documented instructions from the Controller, ensure that persons authorised to process the personal data have committed themselves to confidentiality, implement appropriate technical and organisational measures (Art. 32 GDPR), assist the Controller with data subject rights requests, delete or return all personal data after the end of the provision of services, and make available to the Controller all information necessary to demonstrate compliance.

4. Sub-processors

The Controller provides general authorisation for the engagement of sub-processors. Current sub-processors: Google Cloud Platform (EU, hosting and compute), Google Vertex AI (EU, LLM inference), Stripe (EU/US, payment processing). The Processor shall inform the Controller of any intended changes and provide the Controller with an opportunity to object.

5. International Transfers

All processing takes place within the EU/EEA. Any transfer to a third country shall only occur on the basis of an adequacy decision or appropriate safeguards (Standard Contractual Clauses) pursuant to Chapter V GDPR.

6. Security Measures

Technical measures include: encryption in transit (TLS 1.3) and at rest, isolated browser sessions per agent, automatic data deletion after retention period, access controls with API key authentication, audit logging, and regular security reviews.

7. Data Breach Notification

The Processor shall notify the Controller without undue delay (and in any event within 48 hours) after becoming aware of a personal data breach, providing all information required under Art. 33(3) GDPR.

8. Contact

For DPA-related inquiries: privacy@alex-ai.eu
To request a signed copy of this DPA, email us with your company details and subscription reference.