Data Processing Addendum

1. Scope and hierarchy

This DPA applies when Aixy processes personal data on behalf of the Controller in connection with the Aixy gateway service. If this DPA conflicts with the service agreement on personal-data protection, this DPA prevails.

2. Documented instructions

Aixy will process customer personal data only to provide, secure and support the contracted service in accordance with the Controller's documented instructions, including its configuration, requests, selected model and MCP providers, telemetry destinations, and the service agreement.

If Union or Member State law requires other processing, Aixy will inform the Controller of that legal requirement before processing unless the law prohibits the information on important grounds of public interest. Aixy will immediately inform the Controller if, in its opinion, an instruction infringes applicable data-protection law.

3. Confidentiality and security

Aixy will ensure that authorized personnel are bound by confidentiality and will maintain measures appropriate to the processing risk. The current measures are described in the Technical and Organizational Measures.

4. Subprocessors

The Controller gives general authorization for the verified active subprocessors listed on the subprocessor page. Aixy will impose the same data-protection obligations required by Article 28, by contract or another binding act, and remains responsible for its subprocessor obligations under applicable law.

Aixy will give at least 30 days' advance notice before a new subprocessor begins processing customer personal data. The Controller may make a reasoned data-protection objection during that period. The parties will work in good faith on a reasonable alternative; if none is available, the Controller may terminate the affected service under the service agreement.

5. Data-subject requests

Taking into account the nature of the processing, Aixy will provide reasonable assistance for access, rectification, erasure, restriction, portability, objection and automated-decision requests. If Aixy receives a request relating to customer-controlled data, it will refer the requester to the Controller unless authorized to respond.

6. Security incidents

Aixy will notify the Controller without undue delay after confirming a personal-data breach affecting customer personal data and will provide available information reasonably needed for the Controller's assessment and notification obligations. Notification does not admit fault or liability.

7. Assistance and accountability

Aixy will provide information reasonably necessary to demonstrate compliance with Article 28 and assist with security, breach, DPIA and supervisory-authority obligations, taking into account the processing and information available to Aixy.

Aixy will make available the information necessary to demonstrate Article 28 compliance and allow and contribute to reasonable inspections or audits by the Controller or its mandated auditor. Audits should first use current documentation and evidence. On-site or bespoke audits require reasonable advance notice, confidentiality and scope controls, and may require reimbursement of disproportionate costs, except where the audit follows a material Aixy breach/noncompliance or law or a regulator requires otherwise.

8. Return and deletion

At the Controller's choice and subject to applicable law, Aixy will return or delete customer personal data after service termination and delete existing copies unless law requires storage. Unless an order form records a different instruction, owner-requested organization termination stops access immediately and schedules live tenant purge after 90 days; rotating database backups expire seven days after creation. A specific legal, billing, dispute, security or privacy-request hold may delay only the data covered by the hold. Aixy will provide available completion evidence on request.

9. International transfers

Aixy will not transfer customer personal data outside the EEA except on documented instructions and using a valid Chapter V mechanism. Where required, the parties will incorporate the applicable European Commission Standard Contractual Clauses and document transfer-impact and supplementary-measure assessments.

Annex A — Processing details

Subject matter

Managed routing, governance, security, observability and support for customer LLM requests.

Duration

The service term plus the agreed deletion and backup-expiry period.

Nature

Receive, inspect under configured controls, route, transmit, meter, secure, troubleshoot and store bounded metadata; when explicitly enabled, store encrypted prompt/response content or encrypted MCP connection credentials and forward allowed tool calls.

Purpose

Provide and secure the service on the Controller's instructions.

Data subjects

Controller users, employees, contractors, customers and other people whose data the Controller submits.

Data

Account identifiers, business contact data, workload and MCP call metadata, IP and bounded user-agent security data, encrypted connection credentials, prompts, responses and any personal data included by the Controller.

Special categories

Not intentionally required. The Controller must not submit special-category or criminal-offence data unless explicitly agreed and appropriately safeguarded.

Contact and signature block

Processor

AIXY GATEWAY, S.R.L. UNIPERSONAL

Spanish tax number

B05579420

Registered office

Calle Islas Baleares, 14, escalera 1, piso 2, puerta A, 10001 Cáceres, Cáceres, Spain

Privacy contact

[email protected]

Before execution, complete the Controller's legal details, governing agreement, effective date, deletion choice, any required SCC modules/annexes and both authorized signatories.