Data processing agreement.

Last updated: 14 September 2026

This Data Processing Agreement (“DPA”) is annexed to and forms an integral part of the Engagement Letter between Ai-Mind BV, trading as Data Panda, Poortakkerstraat 93, 9051 Ghent, Belgium, CBE number BE 1040.220.674, acting as Processor, and the client named in the Engagement Letter, acting as Controller.

Terms defined in Regulation (EU) 2016/679 (“GDPR”) have the same meaning here. “Personal Data” means the personal data described in Annex 1 that the Processor processes on behalf of the Controller.

1. Roles and subject matter

The Controller determines the purposes and means of the processing of the Personal Data. The Processor processes the Personal Data only on the Controller’s behalf, for the purposes of performing the Services, and in accordance with this DPA.

Where the Processor determines the purposes and means of a processing operation itself, for example the processing of the Controller’s business contact details for relationship management, invoicing, and legal compliance, it acts as a controller for that operation and this DPA does not apply to it.

The subject matter, duration, nature and purpose of the processing, the types of Personal Data, and the categories of data subjects are set out in Annex 1.

2. Instructions

The Processor processes the Personal Data only on documented instructions from the Controller, including on transfers to a third country, unless required to do otherwise by Union or Member State law to which it is subject. In that case the Processor informs the Controller of that legal requirement before processing, unless the law prohibits it on important grounds of public interest.

The Engagement Letter, this DPA, and the configuration of the systems agreed with the Controller together constitute the Controller’s initial documented instructions. Further instructions are given in writing to the contact in section 12.

The Controller warrants that it has a lawful basis for the processing it instructs, that it has given data subjects the information required by Articles 13 and 14 GDPR, and that its instructions comply with the GDPR and with other applicable law. The Controller is responsible for the accuracy, quality, and legality of the Personal Data it provides or has provided to the Processor.

The Processor informs the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law. The Processor may suspend the affected processing until the instruction is confirmed, amended, or withdrawn.

3. Confidentiality

The Processor ensures that persons authorised to process the Personal Data are bound by an appropriate obligation of confidentiality, whether contractual or statutory, and that access is limited to those who need it to perform the Services.

The Processor uses employees and self-employed team members who are integrated into its organisation and act under its direct authority within the meaning of Articles 4(10), 29 and 32(4) GDPR. They process Personal Data only on its instructions and are authorised persons, not sub-processors. Their appointment or replacement requires no individual notification or authorisation by the Controller. The Processor remains responsible for their acts and omissions. Where a service provider does not act, or ceases to act, under that direct authority, section 5 applies before processing is entrusted to it or continued.

Before access is granted, authorised persons are bound by confidentiality and instructed on the permitted processing, the measures in Annex 2, and reporting suspected personal data breaches without undue delay. These obligations may be covered by an existing employment or contractor agreement and internal instructions; a separate agreement per engagement is not required. Access is limited to what the work requires and is revoked when no longer needed.

4. Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to data subjects, the Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR.

The measures in place at the date of this DPA are described in Annex 2. The Processor may update them, provided the level of security is not reduced.

5. Sub-processors

The Controller gives the Processor general written authorisation to engage sub-processors. Annex 3 identifies the authorised providers and their roles; they may be used insofar as needed for the agreed Services.

The Processor informs the Controller in writing at least 14 calendar days before adding or replacing a sub-processor, allowing a longer reasonable period where the nature or complexity of the processing requires it. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the affected part of the Services without penalty, and owes fees for Services performed up to that point.

The Processor imposes on each sub-processor, by contract, data protection obligations that are no less protective than those in this DPA, and remains fully liable to the Controller for the performance of the sub-processor’s obligations.

Where the Controller’s own platform accounts are used, for example the Controller’s Microsoft tenant or its accounts with a source or target system, the provider of that platform is the Controller’s own processor and not a sub-processor of the Processor.

6. Assistance with data subject rights

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller’s obligation to respond to requests to exercise data subject rights under Chapter III GDPR.

If a data subject contacts the Processor directly about Personal Data processed for the Controller, the Processor does not respond on the substance and forwards the request to the Controller without undue delay.

7. Assistance with security, breaches, and impact assessments

The Processor assists the Controller in ensuring compliance with the obligations in Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it.

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Personal Data, so that the Controller can meet its own deadline under Article 33 GDPR. The notification describes, as far as known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not available at the time is provided in phases as it becomes available. The Processor does not notify the supervisory authority or data subjects on the Controller’s behalf unless the Controller instructs it to.

Unless included in the agreed fees, reasonable assistance under sections 6 and 7 is charged for the actual time spent at the rate agreed for the Services. The Processor informs the Controller of expected costs where practicable. It does not charge for its own mandatory breach notification or for work needed to remedy its own failure to comply with this DPA. A discussion about costs does not delay or prevent mandatory assistance or notifications.

8. Return and deletion

On termination of the Services, at the Controller’s choice, the Processor deletes or returns the Personal Data and deletes existing copies, unless Union or Member State law requires storage.

The Controller makes that choice in writing within 30 days of termination. Absent a choice, the Processor deletes the Personal Data after that period. Deletion takes place within 30 days, subject to routine backup cycles, in which case the data remains protected by this DPA until the backup expires.

9. Audits and information

The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Controller or by an auditor it mandates.

The parties first use existing documentation and remote review where these suffice to verify compliance. Necessary audits and inspections remain available to the Controller, which determines whether further verification is needed. Routine audits are coordinated on reasonable advance notice, during business hours and under confidentiality, with reasonable efforts to avoid unnecessary duplication and disruption. Urgent checks, substantiated indications of non-compliance and supervisory authority requirements are not subject to those scheduling restrictions.

Unless included in the agreed fees, the Controller bears its own audit costs and pays for the Processor’s reasonable audit assistance based on actual time spent at the rate agreed for the Services. Fees must not be disproportionate or deter the exercise of audit rights. The Processor bears its own costs of remedying any non-compliance for which it is responsible. A discussion about costs does not prevent a necessary audit.

10. International transfers

Acceptance of this DPA constitutes the Controller’s documented instruction for processing within the EEA, the use of the sub-processors and processing locations described in Annex 3, and remote access from outside the EEA by personnel acting under the Processor’s direct authority for development, testing and support within the Services. Any restrictions in the Engagement Letter or an agreed email prevail. These standard arrangements do not require a separate approval or a list of individual team members for each engagement. Processing outside the agreed instructions requires further written instructions, which may be given by email. Additions or replacements of sub-processors follow section 5.

Where a transfer takes place, it is covered by an adequacy decision under Article 45 GDPR, or by the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, together with any supplementary measures required following a transfer impact assessment.

Remote access from outside the EEA may constitute a transfer even if no data is copied. Where it does, the safeguards in the preceding paragraph must be in place before access begins, including the applicable module and completed annexes where Standard Contractual Clauses are used. Where access by personnel acting under the Processor’s direct authority does not constitute a transfer, the Processor addresses the risks associated with that access through the appropriate security measures required by Article 32 GDPR and Annex 2. No separate transfer agreement with each team member is required solely because of their location where the access does not constitute a transfer.

Before a sub-processor outside the EEA is engaged or given access to Personal Data, the Processor gives the Controller written notice under section 5. The notice identifies the sub-processor, country, processing purpose, transfer safeguard and, where applicable, the transfer impact assessment and supplementary measures. The Processor does not begin that processing before the section 5 authorisation procedure is complete. Countries in which the Processor’s own personnel work are not listed in this standard DPA.

11. Liability

The liability of each party under this DPA is subject to the limitations and exclusions in the General Terms, to the extent permitted by law. Nothing in this DPA limits a data subject’s rights under the GDPR or the liability of either party towards a supervisory authority.

12. Contacts

Data protection contact at the Processor: privacy@datapanda.eu. Data protection contact at the Controller: as stated in the Engagement Letter.

The Processor has not appointed a Data Protection Officer, as it is not required to do so under Article 37(1) GDPR: its core activities do not consist of regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of data. The contact above handles data protection correspondence. The Controller’s Data Protection Officer, if it has one, is stated in Annex 1.

13. Duration, precedence, and law

This DPA takes effect on the effective date of the Engagement Letter and lasts as long as the Processor processes Personal Data on the Controller’s behalf.

The version of this DPA that applies to an engagement is the version supplied as an annex to the Engagement Letter before the Agreement is entered into and accepted by the Controller when entering into it, including by email or by requesting that the Services start. Each version is identified by the date shown at the top of the document. The Processor may change the version published on its website, and those changes take effect for an existing engagement only by written agreement between the parties. Changes to sub-processors follow the procedure in section 5.

In the event of a conflict between this DPA and the General Terms or the Engagement Letter, this DPA prevails on matters concerning the processing of personal data. Where the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.

This DPA is governed by Belgian law and the jurisdiction clause of the General Terms applies.

Annex 1: Details of the processing

This Annex and the Engagement Letter together describe the processing for the engagement. The standard description below applies where it matches the Services. Any necessary additions or deviations, including other purposes, data categories or restrictions, are recorded in the Engagement Letter or an agreed email before the relevant processing begins. The standard text and provider details need not be copied into a new annex for every engagement.

Item	Detail
Subject matter	Design, build, and operation of data integrations, data platforms, reporting, and automations on the Controller’s systems, as described in the Engagement Letter.
Duration	The term of the Engagement Letter, plus the deletion period in section 8.
Nature and purpose	Reading personal data from a source system, transforming and mapping it, writing it to a target system or a data platform, building reports and automations on it, and monitoring, troubleshooting, and supporting those flows.
Categories of data subjects	The Controller’s customers and suppliers and their contact persons; the Controller’s own staff who use the systems or whose data is in scope of the reporting.
Types of personal data	Name, business contact details, customer, supplier and account identifiers, order, subscription and invoice data, payment status and reconciliation data, staff master data such as function, department and working time where HR or planning data is in scope, and system log data including user identifiers and IP addresses.
Special categories	None. The Controller does not instruct the Processor to process data under Article 9 or Article 10 GDPR.
Frequency	Continuous or scheduled, as configured.
Applicable sub-processors	The providers identified in Annex 3 are authorised insofar as needed to perform the agreed Services, subject to any restrictions in the Engagement Letter or an agreed email. The Processor keeps the identity and relevant processing details of the sub-processors actually used, including further sub-processors, available to the Controller and communicates changes under section 5. The same provider details need not be repeated here.
Transfers and access from outside the EEA	The standard arrangements and safeguards in section 10 and Annex 3 apply, including remote access from outside the EEA for development, testing and support by personnel under the Processor’s direct authority. Only deviations or restrictions need to be recorded in the Engagement Letter or an agreed email. Individual team members need not be named. Before a sub-processor outside the EEA is engaged or given access, the Processor provides the Controller the written notice and completes the authorisation procedure described in sections 5 and 10. The Processor makes the information required to demonstrate compliance with this DPA and the GDPR available to the Controller.
Data Protection Officer	Not appointed by the Processor. Controller: as stated in the Engagement Letter.

Annex 2: Technical and organisational measures

Access control. Access to Controller systems and data is limited to the people working on the engagement, on a need-to-know basis, and is revoked when the engagement or the person’s involvement ends. Multi-factor authentication is enforced on the Processor’s accounts and on the platform accounts used to deliver the Services. Credentials for Controller systems are held in a shared password manager, and are never stored in code, in documents, or in chat. Where a platform supports it, access runs through the Controller’s own accounts and permission model, so the Controller can see and revoke it.

Data handling. Personal Data is processed within the Controller’s platforms and the services authorised under this DPA, only as needed for the agreed Services. Local copies are avoided. Where one is unavoidable to diagnose a fault, it is kept to the minimum, held on an encrypted device, and deleted once the issue is closed. Personal Data sent to the Processor during an engagement, such as a data sample or a log file, is held in the Processor’s Microsoft 365 environment, listed in Annex 3; it is retained only as long as the issue requires, is never copied to personal accounts or unmanaged devices, and is deleted once the issue is closed. Data in transit is encrypted with TLS, and data at rest is encrypted by the platforms used. Development and testing use anonymised, pseudonymised, or synthetic data wherever the work allows.

Devices. Devices used to reach Controller systems or data have full-disk encryption, automatic screen lock, a supported and updated operating system, endpoint protection and an unshared work account. These requirements also apply to personal equipment used for the Services and may be covered by the Processor’s general security instructions. Local storage is limited to the exceptional diagnostic copies described above. Access runs through named accounts, with multi-factor authentication and permissions limited to the work; relevant access is logged where supported by the platform, with additional measures where required by the risk.

People and process. Everyone with access is bound by the confidentiality and processing instructions in section 3 and receives guidance appropriate to their role. Existing contracts, onboarding instructions and account records may be used to demonstrate these measures. Personal data breaches are escalated internally without undue delay and reported to the Controller as set out in section 7. Source code and configuration are held in private version-controlled repositories with access limited to the engagement team.

Resilience. The Processor relies on the availability, backup, and restoration capabilities of the platforms named in Annex 3, and never holds the only copy of the Controller’s production data. The Controller remains responsible for backup and recovery of its own systems.

Annex 3: Sub-processors

The providers below are authorised under the general authorisation in section 5 insofar as needed for the agreed Services. Any engagement-specific restrictions prevail. Additions and replacements follow the notice and objection procedure in section 5; no separate signature is needed when that procedure has been followed and no objection remains unresolved.

Sub-processor	Entity	Role	Processing location	Transfer safeguard
Peliqan	Peliqan BV, Grauwpoort 1, 9000 Ghent, Belgium, CBE BE 0784.446.918	Integration platform on which the connectors are built and run	European Union where the engagement is configured for Peliqan’s EU region. Any other approved region is recorded in the Engagement Letter or an agreed email	Peliqan’s Data Processing Agreement, including the Standard Contractual Clauses for its own sub-processors outside the EEA
Microsoft	Microsoft Ireland Operations Ltd, Ireland	The Processor’s Microsoft 365 environment, where Personal Data sent during an engagement is received and held, and Azure or Fabric services where an engagement uses them	European Union and EFTA for services within the EU Data Boundary, subject to the limited transfers documented in Microsoft’s terms	Microsoft Products and Services Data Protection Addendum, including the Standard Contractual Clauses it incorporates
Anthropic	Anthropic Ireland, Limited	Claude and Claude Code, used as development and analysis tools on engagement work under Anthropic’s commercial terms. Customer content is not used to train models	United States for storage. Model inference runs on Anthropic’s global infrastructure by default and can be restricted to the United States; where the Controller requires that restriction, it is recorded in the Engagement Letter or an agreed email	Anthropic’s Data Processing Addendum, including the Standard Contractual Clauses it incorporates
OpenAI	OpenAI Ireland Limited	ChatGPT Business and the OpenAI API, used as development and analysis tools on engagement work. Content is not used to train models: the Processor uses business or enterprise plans only and keeps model training switched off	United States by default. Where the engagement is configured for OpenAI’s European data residency, content at rest is stored in Europe. Any other configuration is recorded in the Engagement Letter or an agreed email	OpenAI’s Data Processing Addendum, including the Standard Contractual Clauses it incorporates

Team members acting under the Processor’s direct authority as described in section 3 are not listed as sub-processors. A service provider that does not meet, or ceases to meet, those conditions is identified and authorised under section 5 before processing is entrusted to it or continued. Section 10 governs access from outside the EEA in either case.

Microsoft 365 Copilot runs inside the Microsoft 365 environment listed above and is not a separate entry. No tool outside the Processor’s approved list may be used on Personal Data.

Microsoft appears above only for Personal Data processed on the Controller’s behalf. Where the Processor uses the same tools for its own purposes, such as correspondence with the Controller’s staff and invoicing records, that processing falls under section 1 and under the Processor’s privacy policy.

The providers of the Processor’s website analytics, newsletter, and content delivery are not sub-processors under this DPA, because they do not process the Personal Data. They are listed in the privacy policy.