Data Processing Agreement (DPA)

For purposes of this DPA:

“Customer” means the individual or organization that has entered into an agreement with Asiyst for the applicable Services.

“Personal Data” means information relating to an identified or identifiable individual, or equivalent information protected under applicable data-protection law.

“Processing” means any operation performed on Personal Data, including collection, access, storage, use, transmission, retrieval, modification, disclosure, or deletion.

“Controller” means the entity that determines the purposes and means of processing Personal Data, or the equivalent role under applicable law.

“Processor” means an entity that processes Personal Data on behalf of a Controller, or the equivalent role under applicable law.

“Subprocessor” means a third party engaged by Asiyst to process Personal Data on behalf of Asiyst in connection with providing the Services.

“Data Protection Laws” means applicable laws and regulations governing the processing and protection of Personal Data.

This DPA applies only to the extent Asiyst processes Personal Data on behalf of the Customer in connection with the applicable Services.

The Customer remains responsible for determining:

• What Personal Data is submitted to the Services.
• The purposes for which the Personal Data is processed.
• The lawful basis for processing.
• The notices provided to individuals.
• The instructions given to Asiyst.
• The Customer's compliance with applicable Data Protection Laws.

Where Asiyst processes information for its own independent business purposes, that processing may be governed by the Asiyst Privacy Policy rather than this DPA.

For Customer Personal Data covered by this DPA:

• The Customer generally acts as the Controller or equivalent role.
• Asiyst generally acts as the Processor or equivalent role.
• Asiyst will process Customer Personal Data on the Customer's documented instructions, subject to this DPA and applicable law.

The parties' roles may differ for particular processing activities where required by applicable law.

The Customer instructs Asiyst to process Personal Data as necessary to:

• Provide the Services.
• Maintain Customer accounts and projects.
• Process API, SDK, and CLI requests.
• Operate AI assistants and related functionality.
• Process configured knowledge sources.
• Store and retrieve Customer content.
• Provide technical support.
• Maintain security.
• Prevent abuse and fraud.
• Monitor and troubleshoot the Services.
• Comply with applicable legal obligations.
• Perform other processing expressly authorized by the Customer or applicable agreement.

Asiyst will not intentionally process Customer Personal Data for purposes unrelated to the Services except where permitted or required by applicable law.

Depending on the Services used by the Customer, processing may include:

• Collection.
• Storage.
• Organization.
• Retrieval.
• Analysis.
• Transmission.
• Transformation.
• AI processing.
• Indexing.
• Hosting.
• Backup.
• Deletion.
• Security monitoring.
• Technical support.

The precise processing activities depend on the Services and configurations selected by the Customer.

Depending on how the Customer uses the Services, Personal Data processed through Asiyst may include:

• Names.
• Email addresses.
• Account information.
• User identifiers.
• Contact information.
• IP addresses.
• Device information.
• Authentication-related information.
• Project information.
• User-generated content.
• Prompts.
• AI conversations.
• Uploaded files.
• Knowledge-source content.
• Website content.
• API request information.
• Technical logs.
• Usage information.
• Other information submitted or transmitted by the Customer.

The Customer determines what Personal Data is submitted to the Services.

Depending on the Customer's use of the Services, Personal Data may relate to:

• Customer employees.
• Contractors.
• Customers.
• Website visitors.
• End users.
• Users of Customer applications.
• Business contacts.
• Other individuals whose information the Customer submits or makes available through the Services.

Customers should avoid submitting sensitive or specially protected Personal Data unless the applicable Service expressly supports such processing and the Customer has determined that doing so is legally appropriate.

Where sensitive Personal Data is processed, the Customer is responsible for ensuring that the required legal basis, safeguards, notices, and contractual requirements are in place.

The Customer is responsible for establishing a lawful basis for processing Personal Data and, where required, providing appropriate privacy notices and obtaining required consents.

Asiyst does not determine the Customer's lawful basis for processing Customer Personal Data.

Asiyst will:

• Process Customer Personal Data according to applicable documented instructions.
• Implement reasonable security measures appropriate to the processing.
• Restrict access to authorized personnel and systems.
• Maintain appropriate confidentiality obligations.
• Provide reasonable assistance regarding applicable data-protection obligations.
• Use appropriate measures for handling security incidents.
• Take reasonable steps regarding deletion or return of Customer Personal Data as applicable.
• Manage Subprocessors according to the requirements described in this DPA.

Asiyst will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

Access to Customer Personal Data should be limited to personnel and service providers who require access for legitimate business, technical, security, support, or legal purposes.

Asiyst will maintain reasonable technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, alteration, or disclosure.

Depending on the Services, security measures may include:

• Access controls.
• Authentication controls.
• Credential management.
• Encryption or equivalent protective measures where appropriate.
• Network and infrastructure security.
• Monitoring and logging.
• Backup procedures.
• Security testing and maintenance.
• Incident response procedures.
• Personnel access controls.
• Data-minimization practices where appropriate.

No security system can guarantee absolute security.

The Customer is responsible for maintaining appropriate security controls within its own environment.

This includes:

• Protecting account credentials.
• Protecting API keys.
• Configuring appropriate permissions.
• Managing authorized users.
• Securing Customer applications.
• Reviewing integrations.
• Maintaining appropriate endpoint security.
• Determining what information should be submitted to the Services.

Asiyst may use Subprocessors to provide infrastructure, hosting, storage, authentication, AI processing, payments, communications, analytics, security, support, and other services.

Applicable Subprocessors may process Customer Personal Data only as necessary to provide their contracted services.

Information about applicable Subprocessors may be provided through the Asiyst Subprocessors Policy or other applicable documentation.

Asiyst may add or replace Subprocessors as its Services evolve.

Where required by applicable law or agreement, Asiyst may provide appropriate notice of material Subprocessor changes.

Where applicable law provides the Customer with a right to object to a Subprocessor, that right will be handled according to the applicable legal or contractual requirements.

Certain Asiyst functionality may rely on third-party AI providers.

Where applicable, Customer Personal Data may be transmitted to an AI provider to process a request or provide a configured AI feature.

The applicable processing depends on:

• The Asiyst feature used.
• Customer configuration.
• The AI provider selected.
• Applicable provider terms.
• The type of data submitted.

Customers should review the applicable provider and Asiyst documentation before submitting sensitive information.

Where Asiyst allows a Customer to connect its own AI provider account or API credentials, the Customer may have a direct contractual relationship with that provider.

The Customer is responsible for complying with the applicable provider's terms and data-processing requirements.

The Customer should review the provider's policies regarding retention, training, data use, security, and international transfers.

Customer Personal Data may be processed in countries other than the country in which the Customer or individuals are located.

Where international transfers are subject to Data Protection Laws, Asiyst will use applicable transfer mechanisms or safeguards as required by those laws and the relevant contractual arrangements.

The available transfer mechanism may depend on the jurisdictions involved and the applicable legal framework.

The Customer is generally responsible for responding to requests from individuals concerning their Personal Data.

Where Asiyst processes the relevant information on the Customer's behalf, Asiyst will provide reasonable assistance where required by applicable Data Protection Laws and the applicable Service.

Requests may include:

• Access.
• Correction.
• Deletion.
• Restriction.
• Objection.
• Portability.
• Other applicable data-subject rights.

Where technically and legally appropriate, Asiyst may assist the Customer by:

• Providing available account or data-management functionality.
• Searching relevant systems.
• Exporting available information.
• Deleting applicable information.
• Restricting applicable processing.

The Customer remains responsible for determining whether a request is valid and how it should be handled.

If Asiyst becomes aware of a security incident involving Customer Personal Data that requires notification under applicable law, Asiyst will take appropriate steps to investigate and respond.

Where required by applicable law or agreement, Asiyst will notify the Customer without undue delay after confirming a qualifying incident.

Notifications may include information reasonably available to Asiyst concerning:

• The nature of the incident.
• The affected systems or information.
• Measures taken to address the incident.
• Recommended mitigation steps.

Information may be provided progressively as the investigation develops.

The Customer remains responsible for determining whether it has an obligation to notify:

• Data-protection authorities.
• Affected individuals.
• Customers.
• Business partners.
• Other organizations.

Asiyst may provide reasonable information and assistance where required.

Asiyst will retain Customer Personal Data according to:

• The applicable Service configuration.
• Customer instructions.
• Contractual requirements.
• Operational requirements.
• Security requirements.
• Applicable Data Protection Laws.

Information may remain temporarily in backups or other systems after deletion from active systems.

Upon termination of the applicable Services, Asiyst will handle Customer Personal Data according to the applicable agreement and deletion procedures.

Where required and technically feasible, Asiyst may:

• Delete Customer Personal Data.
• Return Customer Personal Data.
• Provide export functionality.
• De-identify information where permitted.

Certain information may be retained where required by law or reasonably necessary for security, fraud prevention, legal claims, accounting, or other legitimate purposes.

Where required by applicable Data Protection Laws, Asiyst may provide reasonable information necessary to demonstrate compliance with applicable processor obligations.

Depending on the Customer's agreement and applicable law, this may include:

• Security documentation.
• Privacy documentation.
• Subprocessor information.
• Relevant policies.
• Reasonable compliance information.

Any audit or assessment rights are subject to reasonable security, confidentiality, operational, and access requirements.

Where an audit is legally required and cannot reasonably be satisfied through available documentation, the parties may agree on an appropriate audit process.

Audits must:

• Be reasonably scoped.
• Minimize disruption to Asiyst operations.
• Protect the confidentiality of Asiyst and other customers.
• Avoid exposing unrelated customer information.
• Comply with applicable security requirements.

The Customer may be responsible for reasonable costs associated with extraordinary audit requests where permitted by the applicable agreement.

Asiyst may disclose Customer Personal Data where required by applicable law, legal process, court order, or valid government request.

Where legally permitted and reasonably practicable, Asiyst may notify the Customer of such a request.

Asiyst may not always be permitted to provide notice.

If Asiyst is required by law to process Customer Personal Data in a manner inconsistent with the Customer's instructions, Asiyst may perform the legally required processing.

Where legally permitted, Asiyst may inform the Customer of the relevant legal requirement.

Customers should only submit Personal Data that is reasonably necessary for the intended use of the Services.

Asiyst may implement reasonable data-minimization practices within its systems where appropriate.

Customer Personal Data may be processed by AI systems where necessary to provide configured AI functionality.

Unless otherwise expressly stated in an applicable agreement or product documentation, Asiyst does not intend to use Customer content, prompts, conversations, or connected knowledge sources to train general-purpose Asiyst models.

Third-party AI providers may have separate data-use and training practices.

Where third-party processing is involved, the applicable provider's contractual terms and technical configuration may determine whether submitted information is retained or used for provider improvement.

Where permitted by applicable law, Asiyst may create aggregated or de-identified information from Service usage.

Such information may be used for purposes such as:

• Service analysis.
• Security.
• Performance monitoring.
• Product development.
• Capacity planning.
• Business analytics.

Information that has been properly de-identified is not treated as Personal Data to the extent permitted by applicable law.

If the Customer provides instructions that conflict with applicable law, Asiyst may be unable to follow those instructions.

The parties may need to clarify or modify the instruction before processing continues.

The Customer remains responsible for its own use of Personal Data and for complying with applicable privacy laws.

Nothing in this DPA transfers the Customer's legal responsibilities as Controller or equivalent role to Asiyst.

Any indemnification obligations are governed by the applicable Terms of Service, subscription agreement, order form, or other contractual agreement.

This DPA supplements the applicable Asiyst Terms of Service, subscription agreement, order form, enterprise agreement, or other applicable contract.

If there is a conflict between this DPA and another agreement concerning the processing of Personal Data, the parties should apply the hierarchy specified in the applicable agreement.

Where no hierarchy is specified, the provision specifically addressing data processing will generally govern the relevant processing issue to the extent of the conflict.

Asiyst may update this DPA when necessary to reflect changes in:

• Applicable law.
• Data-processing practices.
• Services.
• Security measures.
• Subprocessors.
• Regulatory requirements.

Material changes will be handled according to the applicable contractual requirements.

For questions regarding this DPA or data-processing matters, contact:

Asiyst Website: https://asiyst.com Email: support@asiyst.com