Data processing agreement

When you use Mandistry, you are the controller of the data you put into it and [Legal name B.V.] is your processor. Article 28 GDPR requires a data processing agreement (DPA, in Dutch: verwerkersovereenkomst) between us. The DPA is part of our terms of service and applies automatically to every plan.

What the DPA covers

• Subject and duration: hosting and running AI agents for the customer, for the term of the subscription.
• Data: whatever the customer puts into the service: account details of users, instructions, chats, tasks, files, memory, knowledge base and run logs.
• Data subjects: the customer's users, and any people whose data the customer or its agents process.
• Instructions: we only process on the customer's documented instructions, including the agents, tools and model providers the customer configures.
• Confidentiality: staff with access are bound by confidentiality.
• Security: appropriate measures as described on our security page.
• Sub-processors: listed below; we announce changes 30 days in advance and you may object.
• Data breaches: we notify the customer without undue delay, and within 48 hours after discovery.
• Assistance: we help with data subject requests and data protection impact assessments.
• End of contract: the customer can export its data; we delete it within 30 days, backups within 90 days.
• Audits: we provide the information needed to demonstrate compliance.

Sub-processors

Model providers you connect yourself (such as Anthropic, OpenAI or xAI) are not our sub-processors: you contract with them directly and decide what your agents send them.

Signed copy

Need a signed DPA for your records, or your own template? Mail [privacy@yourdomain.nl].