Data Processing Agreement

This Data Processing Agreement governs the processing of personal data by AIAgentCycle on behalf of a business client. AIAgentCycle is a trade name of Good Nature Vibe B.V., Dutch Chamber of Commerce no. 95865101, correspondence address Houtwal 29B, 8431 EX Oosterwolde, the Netherlands, email info@aiagentcycle.com. The Client and its authorised contact are identified in the accepted quotation or assignment description.

This agreement, together with the assignment-specific annexes, is agreed in writing, including electronically, before the relevant processing begins. Visiting this page or submitting a contact request alone does not conclude a data processing agreement. Existing agreements do not change solely because a new version of this page is published.

This agreement forms part of the agreed services. In the event of a conflict, it prevails for the processing and protection of personal data. Article 10 connects it to the liability arrangement. For its own contact, quotation and business administration, AIAgentCycle generally acts as controller; those activities are covered by our privacy statement. The actual role and processing are decisive.

Article 1 — Subject matter, nature, purpose and duration

1.1. As processor, AIAgentCycle processes only the personal data necessary for the agreed building, integration, hosting and management of workflows, AI agents and technical environments. The Client determines the purposes and lawful instructions.

1.2. Before processing begins, Annex 1 records the specific purposes, operations, duration, types of data, categories of data subjects, and the Client’s rights and obligations. A quotation or implementation annex may serve this purpose if it contains these details and the parties accept it as part of this agreement.

1.3. The duration follows the relevant assignment and the necessary wind-down under Article 9. Special-category data, criminal-offence data, citizen service numbers and other data subject to additional legal requirements are not included by default. Processing such data requires a prior assessment and express written arrangements on lawfulness, necessity and measures.

Article 2 — Instructions and Client responsibility

2.1. AIAgentCycle processes only on documented instructions, including for transfers. If Union or Member State law requires otherwise, it informs the Client in advance unless that law prohibits this.

2.2. The Client ensures a valid legal basis, the necessary information to data subjects, appropriate data selection and lawful instructions. AIAgentCycle promptly informs the Client if, in its opinion, an instruction infringes the GDPR or other applicable data protection rules. It suspends the affected processing to the extent necessary to prevent unlawful processing and discusses a lawful solution.

2.3. AIAgentCycle does not use personal data processed for the assignment for its own purposes or to train AI models. Use of AI services in development or operation is defined in advance within the instructions and provider arrangements. API use alone does not mean that storage or logging does not occur.

Article 3 — Confidentiality and access

3.1. Access is limited to authorised persons who need it for their work. Persons acting under AIAgentCycle’s authority are bound by confidentiality or an appropriate statutory duty. This protection continues after their work ends.

Article 4 — Security and locations

4.1. AIAgentCycle implements and maintains appropriate technical and organisational measures under Article 32 GDPR. It takes account of the state of the art, implementation costs, the nature and scale of processing and risks to data subjects. Assignment-specific Annex 2 records the concrete measures, responsibilities and review frequencies. The required statutory level of security continues to apply even where a measure is not separately named.

4.2. The setup includes risk-based access restrictions, secure connections, protected secrets management, appropriate security for equipment used, maintenance and an incident procedure. Annex 2 specifies, among other things, multi-factor authentication, encryption of storage and devices, protection of administration interfaces, relevant logging, backups and restore tests where needed. Mentioning a technology does not state that every product or client device already applies it. Agreed concrete measures remain binding performance obligations. No absolute security, uninterrupted availability or guaranteed recovery time is promised without a separate express agreement.

4.3. For our own hosting, we use Contabo in Germany. For our business calendar and CRM, we use Zoho One in its EU environment. This describes our own setup and does not automatically make these services part of every client assignment. The concrete storage locations, access from other countries and providers for a client assignment are recorded in Annex 3.

4.4. A server in the EEA does not mean that all connected services or support process data exclusively within the EEA. Transfers outside the EEA take place only under the written instructions, the data flow notified in advance and the applicable Chapter V GDPR requirements. The transfer basis, assessment and supplementary measures are recorded as needed. EU storage at Zoho does not fully exclude support access from outside the EEA.

Article 5 — Subprocessors

5.1. By accepting this agreement and Annex 3, the Client gives general written authorisation for the subprocessors described there. AIAgentCycle imposes data protection obligations on them by contract that align with this agreement and remains responsible to the Client for their obligations under Article 28(4) GDPR.

5.2. AIAgentCycle gives prior written notice of a proposed addition or replacement, including identity, function, relevant locations and data protection impact. The Client has fourteen calendar days after the notice to raise a reasoned objection before the change is used for its data. Updating the general provider page does not replace this notice.

5.3. On a substantiated objection, the parties investigate a reasonable solution. Until the objection is resolved, the new subprocessor is not used for the affected processing. If suitable continuation is not possible, the parties may terminate the affected part; existing rules on settlement and secure transfer continue to apply. An objection does not automatically end all services.

5.4. A provider engaged directly by the Client is not thereby a subprocessor of AIAgentCycle. The actual contractual role, access and instructions are recorded. AIAgentCycle remains responsible for its own work.

Article 6 — Assistance

6.1. Taking the nature of the processing into account, AIAgentCycle assists with appropriate measures for data-subject requests. It promptly forwards requests concerning the Client and does not answer them independently unless instructed or legally required.

6.2. AIAgentCycle provides necessary assistance with security, personal-data breaches, data protection impact assessments and prior consultation of the supervisory authority, taking account of the nature of the processing and available information.

6.3. Work outside the agreed services is estimated in advance and charged after approval. Necessary statutory cooperation is not delayed until agreement on costs. Remediation or assistance needed because of AIAgentCycle’s own attributable failure is not charged as additional service; the general terms continue to apply.

Article 7 — Personal-data breaches

7.1. AIAgentCycle notifies the designated contact of an established personal-data breach without undue delay and no later than 48 hours after becoming aware of it. This period runs in calendar hours and is not extended by office or service hours. It does not wait for a complete investigation.

7.2. The notice contains the information then available about nature and scale, possible consequences, measures taken or proposed and a contact point. Missing information is supplemented without undue further delay. AIAgentCycle documents the incident and provides necessary assistance with containment and recovery.

7.3. As controller, the Client assesses and makes notifications to the supervisory authority and data subjects. AIAgentCycle’s own statutory obligations remain. An incident notice is not an admission of liability; this does not limit factual assistance or statutory rights.

Article 8 — Information and audit

8.1. AIAgentCycle provides information necessary to demonstrate compliance and enables and cooperates with audits, including inspections by the Client or an auditor authorised by it.

8.2. Where reasonable, regular audits are first carried out on the basis of available documentation, generally once a year, with fourteen days’ notice and during business hours. These working arrangements do not limit a necessary additional or urgent audit following a breach, concrete indications of non-compliance, or a request or obligation from a supervisory authority. The parties limit unnecessary disruption and protect other clients’ data and trade secrets without making effective control impossible.

8.3. Each party bears its own ordinary audit costs. Additional support is charged only under reasonable arrangements agreed in advance; Article 6.3 continues to apply. The statutory powers of a supervisory authority are not limited.

Article 9 — Return, deletion and end

9.1. After the end, AIAgentCycle returns the personal data processed for the assignment at the Client’s choice and deletes remaining copies, or deletes the data, as standard within thirty calendar days. An obligation to retain data under Union or Member State law is an exception. The Client gives a workable instruction in time; AIAgentCycle coordinates the secure wind-down.

9.2. Annex 2 records in advance the deletion of backups and any technically necessary residual backup retention period at external services, with concrete maximum periods. The agreed residual backup retention period of no more than thirty days continues for standard maintenance backups. A different period requires an express, lawful prior arrangement; this page gives no general permission to retain data longer. Until deletion, remaining copies are restricted and protected and used only for necessary continuity or a legal obligation. After a restore, deletion instructions are applied again.

9.3. AIAgentCycle confirms execution on request. Its own controller administration follows the privacy statement and applicable statutory retention duties. This does not justify keeping all client files received under this agreement.

Article 10 — Liability and applicable arrangements

10.1. Article 15 of the B2B General Terms and Conditions applicable to the assignment governs mutual contractual liability, including its limits and exceptions, to the extent permitted by law. This agreement introduces no separate or accumulated damages, penalty or unlimited indemnity. Related claims from the assignment, maintenance and this agreement fall under the same applicable arrangement.

10.2. The statutory rights of data subjects, powers of supervisory authorities and obligations that may not be excluded or limited remain unaffected. This includes the applicable obligations under Articles 28(4) and 82 GDPR. This agreement does not impose automatic reimbursement of administrative fines imposed on the other party; liability and any recourse follow applicable law and valid contractual arrangements.

10.3. Remediation of AIAgentCycle’s own failure and necessary statutory cooperation remain due as agreed and legally required. The law and dispute arrangement of the main agreement apply, subject to mandatory law.