Data Processing Agreement
1. Parties and roles
- The Customer (the controller): the business that subscribes to a hosted plan of Agentivity.
- SMART PIXEL BV, enterprise number BE 0731.739.690, registered office in Wasseiges, Belgium ("Agentivity", the processor).
Agentivity processes personal data on behalf of the Customer only to provide the hosted workspace described in the Terms of Sale. For the data it processes about the Customer as its client (account, billing), Agentivity is a controller under its Privacy Policy, not a processor.
2. Subject matter, nature and duration
| Subject matter | Hosting and running the Customer's Agentivity workspace: its agents, teams, workflows, executions, data tables, knowledge bases, files and the accounts of its people. |
|---|---|
| Nature of processing | Storage, backup, execution of the Customer's workflows and agents, transmission to the services the Customer connects. |
| Duration | The term of the subscription, then until deletion as described in section 9 (at most 120 days after the plan ends, backups included). |
| Categories of data subjects | Determined by the Customer: its people (users of the workspace) and any person whose data the Customer processes through its workflows (customers, prospects, employees, contacts). |
| Categories of data | Determined by the Customer. For the users of the workspace: name, e-mail, role, sign-in history, audit journal (Business). Special categories of data may be processed only if the Customer has a lawful basis and appropriate safeguards (Terms of Use, section 7). |
3. Instructions
Agentivity processes the data only on the documented instructions of the Customer, which are these Terms, the Customer's configuration of its workspace (its workflows, agents, connections), and any further written instruction. Agentivity tells the Customer if it believes an instruction infringes data protection law.
What the Customer decides alone: which AI providers and third-party services its workflows call, with its own credentials. Data sent to those services is processed by them under their own terms, as processors or controllers of the Customer, not as sub-processors of Agentivity.
4. Confidentiality
Persons authorised by Agentivity to access the data are bound by confidentiality. Agentivity does not look into the content of a workspace except where needed to provide support requested by the Customer, to ensure security, or where the law requires it.
5. Security measures (Article 32)
- Each workspace runs on its own machine and its own storage volume, isolated from other customers.
- Encryption in transit (TLS) for every connection; the storage volume of each workspace is encrypted at rest.
- The secrets of the connections (credentials to AI providers and other services) are encrypted with AES-256-GCM, with a key of each workspace; passwords are kept only as a PBKDF2 hash and API keys only as a SHA-256 hash, never in clear.
- Sign-in by e-mail and password, roles and permissions per person, spaces to separate data inside a workspace; API keys per person with scopes; audit journal on Business.
- Daily backups of the storage volume, kept 7, 14 or 30 days according to the plan.
- Access to production restricted to authorised personnel, through the providers' consoles with multi-factor authentication; the operator console is behind Cloudflare Access.
- Updates installed by Agentivity, without cutting executions in progress.
- Detection and handling of security incidents (section 8).
6. Sub-processors
The Customer gives a general authorisation to the following sub-processors. Agentivity tells the Customer at least 30 days before adding or replacing one; the Customer may object on reasonable grounds and, if no solution is found, cancel.
| Sub-processor | Service | Location of processing |
|---|---|---|
| Fly.io, Inc. | Machines and storage of the workspaces, backups | European Union (Frankfurt, Germany); company in the USA |
| Cloudflare, Inc. | Gateway in front of the workspaces (TLS, routing), DNS | Global network; company in the USA |
| Brevo (Sendinblue SAS) | Transactional e-mails sent for the workspace (invitations, password resets) | EU (France) |
| Stripe Payments Europe, Ltd. | Payment of the subscription (Customer as client, not workspace content) | EU (Ireland), USA |
Stripe processes only the data of the Customer as a client (billing), never the content of the workspace. Agentivity imposes on each sub-processor obligations equivalent to those of this Agreement.
7. International transfers
Workspace data is stored in the European Union. Where a sub-processor established outside the EEA may access it, the transfer relies on the EU–US Data Privacy Framework where the sub-processor is certified, or on the Standard Contractual Clauses adopted by the European Commission, as provided in the data processing terms of each sub-processor.
8. Personal data breaches
Agentivity notifies the Customer without undue delay, and at the latest within 48 hours after becoming aware of a breach affecting the Customer's data, with the information available (nature, categories and approximate number of data subjects and records, likely consequences, measures taken), so that the Customer can meet its own obligations.
9. End of processing
When the plan ends, the workspace follows the steps of the Terms of Sale (read only 30 days, paused until day 90, trash 30 days). During that time the Customer can bring it back or export its content (Administration › Data). At day 120 the workspace, its data and its backups are deleted, unless the law requires Agentivity to keep them. On request, Agentivity deletes the workspace earlier.
10. Assistance and rights of data subjects
Agentivity helps the Customer, by appropriate technical means, to answer requests of data subjects: the Customer can find, change, export and delete the data in its workspace itself. Agentivity also assists the Customer, to the extent reasonable, with impact assessments and prior consultations.
11. Audits
Agentivity makes available the information necessary to demonstrate compliance with this Agreement and answers reasonable questionnaires. On-site audits, at the Customer's expense and with reasonable notice, are possible at most once a year, unless a breach justifies more.
12. Precedence
In case of conflict, this Agreement prevails over the Terms of Sale and the Terms of Use for the processing of personal data.