Data Processing Addendum

1. Roles and scope

The customer is the controller and Stalwart the processor of the personal data in the customer's content (Annex I). Stalwart is a separate controller of the account data it needs to run the service: the names and addresses of the people who sign in, billing records, and security logs, as its privacy notice describes.

2. Instructions

Stalwart processes customer personal data only on the customer's documented instructions, which are the Terms, this addendum and the customer's use and configuration of the service, unless the law requires otherwise, in which case Stalwart will tell the customer first unless the law forbids it. Stalwart will tell the customer promptly if, in its opinion, an instruction infringes data protection law.

Stalwart does not sell customer personal data, use it to train models, or use it for any purpose of its own.

3. Confidentiality and security

Everyone at Stalwart who can access customer personal data is bound by confidentiality. Stalwart implements the technical and organisational measures in Annex II and keeps them appropriate to the risk.

4. Sub-processors

The customer authorises Stalwart to use the sub-processors listed in Annex III. Stalwart imposes data protection obligations on each that are no less protective than this addendum and remains responsible for their performance.

Stalwart will give at least thirty days' notice by email to owners before adding or replacing a sub-processor. The customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the customer may close its account and receive a refund of fees prepaid for the period after the change.

5. Assistance

Taking into account the nature of the processing, Stalwart will help the customer respond to requests from data subjects and meet its obligations on security, breach notification, data protection impact assessments and prior consultation. Stalwart will pass on any request it receives directly from a data subject without answering it, unless the customer authorises it to.

6. Personal data breaches

Stalwart will notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data. The notice will describe the breach, the data and people concerned, the likely consequences and the measures taken or proposed, with further information as it becomes available.

7. Deletion and return

The customer can export and delete its content through the service at any time. When an account is closed, Stalwart deletes customer personal data within the retention window stated in the documentation, and from backups as they expire, unless the law requires it to be kept.

8. Audits

Stalwart will make available the information reasonably necessary to demonstrate compliance with this addendum. Once a year, or after a personal data breach, the customer may audit that compliance, itself or through an independent auditor bound by confidentiality, on at least thirty days' written notice, during business hours and without disrupting the service. The customer bears its own costs.

9. International transfers

Stalwart is established in the United Kingdom and hosts the service in the European Union. Where a transfer of customer personal data from the EEA, the UK or Brazil to a country without an adequacy decision takes place, the parties agree that it is governed by, as applicable: the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two where the customer is a controller and Module Three where it is a processor); the UK International Data Transfer Addendum to them issued by the Information Commissioner; and the standard contractual clauses approved by Brazil's ANPD. These are incorporated by reference with the details in the Annexes, and they prevail if they conflict with this addendum.

10. Duration and liability

This addendum lasts as long as Stalwart processes customer personal data. Each party's liability under it is subject to the limits in the Terms, except where data protection law does not allow a limit.

Annex I: Description of the processing

Subject matter and duration: providing Stalwart Agents for the term of the agreement.

Nature and purpose: verifying the customer's rules, policies, catalogues and agent graphs; keeping the definitions, feedback and verification requests the customer submits; all to provide the service to the customer. The customer's agents' conversations, the tool calls they make and the documents they answer from are processed on the customer's own systems by the software it runs there, and are not processed by Stalwart.

Categories of data subjects: the customer's end users and staff, only to the extent the customer's feedback includes them, or its other submissions do despite the Terms.

Categories of personal data: the service is designed not to receive personal data in the customer's content. The Terms forbid sending it to the service in anything that reaches Stalwart's servers, and make the customer solely responsible for any that does; the client packages and the console refuse common kinds before sending, as an aid and not a guarantee. A feedback record holds the words of the turn a user rated, screened in this way. The service is not designed for special category data; the customer should not submit it.

Frequency: continuous, as the customer uses the service. Retention: as the customer configures and as the documentation states, and until the account is closed.

Annex II: Technical and organisational measures

Encryption in transit with TLS on every connection; backups encrypted before they leave the host, with the key held off it.

Access to production limited to named engineers, with keys and two-factor authentication; API keys stored only as salted hashes; sessions bound to random tokens stored only as hashes.

Tenant isolation enforced on every query; least-privilege service accounts; network exposure limited to the edge proxy.

Logging with secrets redacted; dependency and image updates through a reviewed pipeline; continuous backups with tested restores.

Data minimisation by design: conversations, tool calls and the documents agents answer from stay on the customer's systems, where the local runtime runs and reports counts only; text sent to the service is scanned for common kinds of personal data before it leaves the customer; prompts for policy generation travel through ephemeral storage and are not kept.

Annex III: Sub-processors

Scaleway SAS (France): hosting of the API, the console and their databases, in Paris.

Backblaze, Inc. (United States): encrypted off-site backups, stored in its EU Central region (Amsterdam).

Zoho Corporation (United States), through ZeptoMail: sending the service's emails, which carry the recipient's address.

Stripe Payments UK, Ltd. and its affiliates: billing and payments for paid plans.