Data Processing Agreement

Data Processing Agreement (DPA)

Data Processing Agreement for CivAI AI services

Last updated: September 2026

Version: 1.1

1. Parties

This Data Processing Agreement ("DPA") is entered into between the customer organization ("Controller") and CivAI B.V., located at Hoge Zand 39, 2512 EL The Hague, registered with the Chamber of Commerce under number 98956221 ("Processor").

2. Subject and Duration

The Processor processes personal data on behalf of the Controller in connection with the provision of AI services (GovGPT, EduGPT, OrgGPT, and/or Veilige AI Hosting). This DPA applies for the duration of the service agreement between the parties.

3. Nature and Purpose of Processing

Personal data is processed for the purpose of providing AI-assisted services, including but not limited to: text generation, document analysis, question answering, and information retrieval. Processing occurs exclusively based on the documented instructions of the Controller.

4. Categories of Data Subjects and Personal Data

Data subjects

Employees and staff of the Controller

End users of the services

Citizens, students, or clients whose data may be entered into the services

Categories of personal data

Account data (name, email, role, organization)

Usage data (prompts, queries, generated outputs)

Technical data (IP address, log data)

Any personal data entered into the AI services by end users

5. Obligations of the Processor

Process personal data only on documented instructions from the Controller.

Ensure that persons authorized to process personal data have committed to confidentiality.

Implement appropriate technical and organizational security measures (Article 32 GDPR).

Assist the Controller in fulfilling data subject rights requests.

Notify the Controller of any data breach without undue delay and no later than 24 hours after discovery (see section 8).

Delete or return all personal data within a maximum of 60 days after termination of services, at the choice of the Controller (see section 9).

Make available all information necessary to demonstrate compliance.

Customer data is never used for model training.

6. Sub-processors

The Processor shall not engage another processor (sub-processor) without prior specific or general written authorization of the Controller. A current list of sub-processors is available at civai.eu/subprocessors.

The Controller will be informed of any intended changes concerning the addition or replacement of sub-processors, with the opportunity to object.

7. International Transfers

All personal data is stored within the European Economic Area (EEA); processing takes place within the EEA or, with the optional Azure route, within the EU Data Zone (EU member states, Norway and Switzerland). CivAI does not transfer personal data to countries outside the EEA unless appropriate safeguards are in place as required by Chapter V of the GDPR, and only with prior notification to the Controller.

8. Personal Data Breaches and Security Incidents

The Processor reports a personal data breach to the Controller without undue delay and no later than 24 hours after discovery, unless demonstrably impossible, and subsequently provides additional information as it becomes available. This leaves the Controller sufficient time to notify the Dutch Data Protection Authority within the statutory 72-hour period.

Each notification contains, insofar as known, the information requested in the data breach notification form of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): the nature of the incident, the (potential) consequences, the categories of personal data and data subjects involved, the measures taken and proposed, and a contact point for follow-up. The Processor maintains a register of all data breaches and assists the Controller in meeting its notification obligations towards the supervisory authority and data subjects. The Processor does not itself notify the Dutch Data Protection Authority or data subjects, unless required by law or requested in writing by the Controller.

Contact point for data breaches: privacy@civai.eu, tel. +31 6 21991666.

9. Retention and Deletion

Upon termination of the services, the Processor will, at the choice of the Controller, return and then delete personal data, or delete it directly, within a maximum of 60 days, unless a statutory retention obligation applies. The Processor facilitates data export in common formats.

The retention periods below prevail for these specific data categories; for all other personal data, the general deletion period above (a maximum of 60 days after termination) applies.

Account data: during the term and up to 90 days thereafter.

Prompts and content: 90 days by default, unless agreed otherwise in consultation with the customer or configured differently at client level.

Audit and security logs: 90 days by default, unless agreed otherwise in consultation with the customer.

Support tickets: up to 24 months after resolution.

During the term, customer data is never used for model training and is stored exclusively within the European Economic Area.

10. Security Measures

Encryption in transit (TLS 1.2+) and at rest (AES-256).

Role-based access control and multi-factor authentication.

Regular security audits and penetration testing.

Automated backup and disaster recovery procedures.

Logging and monitoring of access to personal data.

Tenant isolation between different client organizations.

11. Audits

The Controller has the right to conduct audits, including inspections, to verify compliance with this DPA. The Processor shall cooperate with such audits. The costs of audits initiated by the Controller shall be borne by the Controller, unless the audit reveals non-compliance by the Processor.

12. Liability

The liability of the Processor under this DPA is subject to the limitations set forth in the underlying service agreement between the parties.

Request a signed DPA

To receive a signed Data Processing Agreement tailored to your organization, please contact us at info@civai.eu.