AgentTwin
Sign inGet started

Data Processing Agreement

Draft for legal review. This document is not yet in effect. Until it is published without this notice, contact us before relying on it.

Last updated: November 6, 2026.

This Data Processing Agreement ("DPA") forms part of the Terms of Service or other agreement between AgentTwin ("Processor") and the customer ("Controller") when AgentTwin processes personal data on the customer's behalf.

1. Scope and roles

The customer is the controller and AgentTwin is the processor of personal data contained in Customer Content and workspace account data. AgentTwin processes it only to provide, secure and support the Service and only on the customer's documented instructions, including these terms and the customer's configuration of the Service.

2. Details of processing

  • Subject matter and duration: providing the Service for the term of the agreement.
  • Categories of data subjects: the customer's workspace members and any individuals whose data the customer places in test scenarios or results.
  • Categories of personal data: names, email addresses, sign-in identifiers, audit records, and personal data the customer chooses to include in Customer Content.
  • Special categories: none intended. The customer should use synthetic test data.

3. Processor obligations

AgentTwin will:

  • keep personal data confidential and ensure people with access are bound to confidentiality;
  • apply the technical and organizational measures described on the security page;
  • use only the subprocessors listed, give notice before adding one, and let the customer object on reasonable grounds;
  • help the customer respond to data subject requests and with security, breach notification and data protection impact assessments, taking into account the nature of the processing;
  • notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data;
  • delete or return personal data at the end of the Service, except backups that expire on their own schedule (14 days) and data the law requires keeping;
  • make available the information needed to demonstrate compliance with this DPA and allow reasonable audits, normally satisfied by written answers and available reports.

4. International transfers

Some subprocessors are located in the United States. Where personal data from the EEA, UK or Switzerland is transferred, the parties rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), which are incorporated by reference.

5. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.

To sign a countersigned copy for your records, contact us.