DRAFT — pending legal review. This Data Processing Addendum is a working draft provided for transparency and procurement review. It has not yet been finalised by counsel and is not yet binding. The executed version incorporated into your agreement governs. Email [email protected] for the current signable copy or to raise redlines.

1. Roles & scope

This Addendum forms part of the agreement between Brahmalabs ("Processor") and the customer ("Controller") and applies where Brahmalabs Processes Personal Data on the Controller's behalf in providing the platform. For our SaaS offering, Brahmalabs acts as Processor; the Controller determines the purposes and means of Processing. For self-hosted / on-premises deployments where Personal Data never leaves the Controller's own infrastructure and Brahmalabs has no access to it, Brahmalabs is not a Processor of that data, and this Addendum applies only to any support, telemetry, or license data the Controller chooses to share.

Terms not defined here (Personal Data, Processing, Controller, Processor, Sub-processor, Data Subject, Supervisory Authority) have the meaning given in the GDPR.

2. Subject matter & details of Processing

Subject matter: provision of the Brahmalabs agentic-workflow platform.
Duration: for the term of the agreement, plus the deletion/return period in Section 9.
Nature & purpose: hosting, executing, and governing the Controller's agentic workflows and storing their inputs, outputs, and artifacts.
Types of Personal Data: as determined by the Controller's own data and prompts — may include identifiers, contact details, and any content the Controller submits to workflows.
Categories of Data Subjects: as determined by the Controller — typically the Controller's users, customers, and contacts.

3. Processor obligations (GDPR Art. 28(3))

Brahmalabs shall:

Documented instructions. Process Personal Data only on the Controller's documented instructions, including for international transfers, unless required by law (in which case we notify the Controller unless prohibited).
Confidentiality. Ensure persons authorised to Process Personal Data are bound by confidentiality.
Security. Implement appropriate technical and organisational measures under Art. 32 (see Section 6).
Sub-processors. Engage Sub-processors only under Section 7.
Data-subject requests. Assist the Controller, by appropriate measures, to respond to requests to exercise Data-Subject rights (access, rectification, erasure, restriction, portability, objection).
Assistance. Assist the Controller with obligations under Art. 32–36 (security, breach notification, DPIAs, prior consultation), considering the nature of Processing and information available to us.
Deletion / return. At the Controller's choice, delete or return Personal Data at the end of the services per Section 9.
Audit. Make available information necessary to demonstrate compliance and allow for and contribute to audits per Section 8.

4. Personal-data breach

Brahmalabs shall notify the Controller without undue delay after becoming aware of a Personal-Data Breach affecting the Controller's Personal Data, and provide information reasonably available to assist the Controller's own notification obligations under Art. 33–34. Our append-only audit log and live tracing support timely investigation.

5. Sub-processors

The Controller grants general authorisation for Brahmalabs to engage Sub-processors. Our current Sub-processors are listed at brahmalabs.io/legal/subprocessors. We impose data-protection obligations on each Sub-processor no less protective than this Addendum and remain liable for their performance. We will give advance notice of new Sub-processors and a reasonable period to object on legitimate data-protection grounds.

6. Security measures (Art. 32)

Isolation: per-tenant data segregation; sandboxed, least-privilege agent runtime.
Secrets: credentials held in an encrypted vault; scoped, short-lived references injected at call time — never persisted in prompts.
Access control: single sign-on, role-based permissions enforced server-side, human-in-the-loop approval gates.
Auditability: append-only audit log; per-run tracing exportable to the Controller's SIEM.
Encryption: in transit and at rest.
Programme: SOC 2 in progress; measures reviewed and updated over time.

7. International transfers

Where Processing involves transfer of Personal Data outside the EEA, UK, or Switzerland to a country without an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (Module Two: Controller-to-Processor), and the UK International Data Transfer Addendum / Swiss amendments as applicable, together with a transfer-impact assessment. These are appended to and form part of this Addendum.

8. Audits

Brahmalabs will make available compliance documentation (including the SOC 2 report once available) and respond to reasonable security questionnaires. On reasonable notice, no more than once per year (or following a Breach), the Controller may audit Brahmalabs' compliance, subject to confidentiality and minimal disruption.

9. Deletion & return

On termination, at the Controller's choice, Brahmalabs will delete or return all Personal Data and delete existing copies, unless retention is required by law. Backup copies are deleted on their ordinary cycle.

10. California (CCPA/CPRA)

For Personal Information subject to the CCPA/CPRA, Brahmalabs acts as a "service provider" / "contractor": we process such information only to provide the services and on the Controller's documented instructions; we do not sell or share it, retain, use, or disclose it for any other purpose, or combine it with data from other sources except as permitted by the CCPA.

11. General

This Addendum prevails over conflicting terms of the agreement with respect to Processing of Personal Data. If any provision is invalid, the remainder stays in effect. Liability is subject to the limitations in the agreement.

Questions or to execute a signed copy: [email protected].