Data processing agreement

This agreement is between the customer that subscribes to Brainstack (the controller, "you") and MAJENTIA FORMACION Y DESARROLLO, S.L., tax ID B27683648, registered address Calle José Enrique Marrero Arquitecto, 21, 35017 Las Palmas de Gran Canaria (Las Palmas) (the processor, "we"). It applies automatically when you accept the terms of service and lasts as long as we process personal data for you. If you need a countersigned copy, email hola@brainstack.io. If anything in the terms conflicts with this agreement on personal data, this agreement prevails.

We process personal data only on your documented instructions. Your instructions are this agreement, the terms of service, and what you configure in Brainstack (sources connected, agents, permissions, approvals, retention). We will tell you immediately if we think an instruction breaks the GDPR or other data protection law. If the law requires us to process data otherwise, we will tell you first unless the law forbids it.

Everyone we authorise to process your personal data is bound by confidentiality and accesses it only as far as needed to provide or support the service. Access to a customer server by our staff is limited, logged and used only for support, security or operations.

We may update these measures as long as the overall level of protection does not decrease.

You give us general authorisation to use these sub-processors. We will tell you by email at least 30 days before adding or replacing one. You can object on reasonable data protection grounds within that period; if we cannot address the objection, you can end the affected service and we will refund any prepaid amount for the period not used. We impose the same data protection obligations on every sub-processor and remain responsible for them. Stripe processes billing data as an independent controller, not as our sub-processor for your data.

Brainstack runs on the customer's own subscription with Anthropic (Claude), OpenAI (ChatGPT) or Google (Gemini). The customer chooses and contracts that provider and is responsible for having appropriate terms, including a data processing agreement and transfer safeguards where needed. The same applies to the channels and tools the customer connects (for example Slack, Microsoft Teams, Telegram, Discord, Gmail, Outlook, Google Drive, Notion or HubSpot). We transmit data to them only as the customer instructs by connecting them and configuring its agents. They are not our sub-processors.

Customer servers are in Germany. We transfer personal data outside the European Economic Area only to the sub-processors listed above, under an adequacy decision (including the EU-US Data Privacy Framework for certified providers) or the standard contractual clauses (Commission Decision 2021/914), with supplementary measures where needed.

Taking into account the nature of the processing, we help you answer requests from data subjects (access, rectification, erasure, restriction, portability, objection), mainly through the export, edit and delete functions of Brainstack. If a data subject writes to us directly, we pass the request to you without undue delay and do not answer it ourselves unless you ask us to. We also give you the information you reasonably need for data protection impact assessments and prior consultations.

We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. The notice describes, as far as we know at that point, the nature of the breach, the categories and approximate number of people and records affected, likely consequences, and the measures taken or proposed. We add information as it becomes available and help you notify the authority and the people affected where required.

We make available the information reasonably needed to show compliance with Article 28 GDPR, and allow audits, including inspections, by you or an auditor you appoint who is bound to confidentiality. Audits need at least 30 days' notice, take place during business hours, at most once a year unless a breach or an authority requires otherwise, and at your cost. We do not hold SOC 2 or ISO 27001 certifications; we answer security questionnaires instead.

When the subscription ends, you have 30 days to export your data. After that we delete the personal data and the customer server, unless the law requires us to keep some of it, in which case we keep it blocked. Backups containing your data expire within 365 days. On request we confirm the deletion in writing.

Each party's liability under this agreement is subject to the limits in the terms of service, except where Article 82 GDPR or other mandatory law does not allow a limit. This agreement is governed by the same law and courts as the terms of service.