Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between:

1. Moyai Operations B.V., a besloten vennootschap registered with the Dutch Chamber of Commerce (KvK) under number 96031034, with its registered office at Herengracht 471, 1017BS Amsterdam (“Moyai”); and
2. [Customer legal name], registered under number [number], with its registered office at [address] (“Customer”),

each a “Party” and together the “Parties”.

Background. Moyai provides an AI agent monitoring platform to Customer under the Agreement. In doing so, Moyai processes Personal Data on Customer’s behalf. This DPA sets out the Parties’ obligations under Article 28 of the GDPR. It also sets out the limited use Moyai may make of De-identified Data to improve its detection, as its own controller.

1. Definitions

1.1 Terms such as “controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing”, “special categories of personal data” and “supervisory authority” have the meaning given in the GDPR.

1.2 In this DPA:

• “Agreement” means the Moyai Terms of Service, together with any order form, between Moyai and Customer under which Moyai provides the Service.
• “Customer Personal Data” means Personal Data that Customer or its users submit to the Service, including Personal Data contained in agent traces, logs, prompts, outputs, tool calls and related telemetry, and that Moyai processes on Customer’s behalf.
• “Data Protection Law” means the GDPR, the Dutch GDPR Implementation Act (Uitvoeringswet AVG), and any other EU or EU Member State law on the protection of Personal Data that applies to the processing under this DPA, as well as the UK GDPR and Swiss Federal Act on Data Protection where they apply.
• “De-identified Data” means Customer Personal Data from which Moyai has removed or masked direct identifiers (such as names, email addresses, phone numbers, account identifiers and IP addresses) and secrets (such as API keys, tokens and credentials), so that it can no longer be attributed to a specific data subject without additional information.
• “Detection Improvement” means developing, training, testing, evaluating and improving Moyai’s anomaly detection, root cause analysis and related models, rules and benchmarks.
• “GDPR” means Regulation (EU) 2016/679.
• “Personal Data” means personal data as defined in the GDPR.
• “SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• “Service” means the Moyai AI agent monitoring platform and related services provided under the Agreement.
• “Sub-processor” means any third party engaged by Moyai that processes Customer Personal Data.

1.3 Capitalised terms not defined in this DPA have the meaning given in the Agreement.

2. Scope and roles

2.1 Customer is the controller of Customer Personal Data, or a processor acting on behalf of its own clients. Moyai is a processor (or, where Customer is a processor, a sub-processor) of Customer Personal Data, except as set out in Clause 4.

2.2 The subject matter, nature, purpose and duration of the processing, and the categories of data subjects and Personal Data, are described in Annex 1.

2.3 Customer is responsible for the lawfulness of the Customer Personal Data it submits to the Service, including having a lawful basis for the processing and giving data subjects the information that Data Protection Law requires. Customer will not submit special categories of personal data, or Personal Data relating to criminal convictions, unless the Parties have agreed this in writing.

3. Processing on instructions

3.1 Moyai processes Customer Personal Data only on Customer’s documented instructions, including with regard to transfers to third countries, unless EU or Member State law requires otherwise. In that case Moyai will inform Customer of that legal requirement before processing, unless the law prohibits this.

3.2 Customer instructs Moyai to process Customer Personal Data (a) to provide, maintain and support the Service under the Agreement, (b) as initiated by Customer’s users through the Service, (c) to create De-identified Data under Clause 4, and (d) as otherwise agreed in writing between the Parties.

3.3 Moyai will immediately inform Customer if, in its opinion, an instruction infringes Data Protection Law. Moyai may suspend following that instruction until Customer confirms or changes it.

4. Moyai’s own use: Detection Improvement

4.1 Authorisation. Customer authorises Moyai to (a) create De-identified Data from Customer Personal Data, and (b) use De-identified Data for Detection Improvement, which benefits all Moyai customers, including Customer.

4.2 Roles. Moyai creates De-identified Data as Customer’s processor. Moyai’s later use of De-identified Data for Detection Improvement is for its own purposes. For that use, Moyai is an independent controller, to the extent De-identified Data is still Personal Data. Moyai is solely responsible for complying with Data Protection Law for that use, including having a lawful basis and informing data subjects through its privacy policy.

4.3 Safeguards. For Detection Improvement, Moyai will:

1. use only De-identified Data, never Customer Personal Data in identifiable form;
2. take reasonable steps to exclude special categories of personal data and data about children;
3. not attempt to re-identify any data subject, or profile or make decisions about any individual;
4. not disclose De-identified Data, or other confidential information of Customer, to any other customer or third party, other than Sub-processors acting for Moyai;
5. design its models, rules and outputs so that they do not reproduce Customer Personal Data or Customer’s trace content;
6. not allow any Sub-processor, including AI model providers, to use Customer Personal Data or De-identified Data to train their own models;
7. limit access to personnel who work on Detection Improvement and are bound by confidentiality;
8. keep De-identified Data for no longer than 6 months, unless it has been anonymised; and
9. apply the measures in Annex 2 to De-identified Data.

4.4 Anonymised data. Data that has been anonymised so that it is no longer Personal Data, such as aggregated statistics and detection patterns, is outside the scope of this DPA. Moyai may keep and use it after this DPA ends.

4.5 Opt-out. Customer may opt out of Detection Improvement at any time by written notice to Moyai. Within 30 days of the opt-out, Moyai will stop creating De-identified Data from Customer Personal Data and will exclude it from future Detection Improvement. Models and rules developed before the opt-out are not affected.

4.6 Customer confirmation. Customer confirms that it has a lawful basis to disclose Customer Personal Data to Moyai for the uses in this Clause 4, and that it has informed data subjects about this use where Data Protection Law requires.

5. Confidentiality

5.1 Moyai ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality obligations, or is under an appropriate legal duty of confidentiality.

5.2 Moyai gives access to Customer Personal Data only to personnel who need it to perform the Service, Clause 4 or Moyai’s obligations under the Agreement.

6. Security

6.1 Moyai implements and maintains appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the GDPR. These include, at a minimum, the measures in Annex 2.

6.2 Moyai may update these measures over time, provided the overall level of security is not reduced.

6.3 Customer is responsible for its own secure use of the Service, including protecting account credentials, configuring access for its users, and deciding what data its agents send to the Service.

7. Sub-processors

7.1 Customer gives Moyai general authorisation to engage Sub-processors. The Sub-processors in use on the date of this DPA are listed at moyai.ai/privacy.

7.2 Moyai will notify Customer at least 30 days before adding or replacing a Sub-processor by updating the list Customer can subscribe to. Customer may object on reasonable data protection grounds within that period. The Parties will then discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Service by written notice, and receive a pro-rata refund of any prepaid fees for the remaining term. This is Customer’s sole remedy for the objection.

7.3 Moyai imposes on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures, to the extent commercially possible.

7.4 Moyai remains fully liable to Customer for the performance of each Sub-processor’s obligations.

8. Assistance

8.1 Data subject requests. Taking into account the nature of the processing, Moyai will assist Customer with appropriate technical and organisational measures to respond to requests from data subjects exercising their rights. If Moyai receives such a request directly, it will forward it to Customer without undue delay and will not respond itself, except to confirm that the request relates to Customer, unless Customer instructs otherwise.

8.2 Other assistance. Moyai will provide reasonable assistance to Customer with data protection impact assessments, prior consultations with supervisory authorities, and Customer’s obligations under Articles 32 to 36 of the GDPR, taking into account the information available to Moyai.

8.3 Moyai may charge reasonable costs for assistance that goes beyond what the Service normally provides, unless the assistance is needed because of Moyai’s breach of this DPA.

9. Personal data breaches

9.1 Moyai will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Moyai will provide further information as it becomes available.

9.3 Moyai will promptly take reasonable steps to contain, investigate and mitigate the breach, and will cooperate with Customer so it can meet its own notification obligations. A notice under this Clause is not an admission of fault or liability.

10. Audits

10.1 Moyai will make available to Customer the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and this DPA. This includes responses to a written security questionnaire once a year and, when available, summaries of third-party audit reports or certifications.

10.2 If that information is not sufficient to demonstrate compliance, or if a supervisory authority requires it, Customer may audit Moyai’s compliance, itself or through an independent auditor bound by confidentiality, no more than once a year. Customer will give at least 60 days’ written notice, agree the scope with Moyai in advance, and minimise disruption to Moyai’s business. Customer bears its own costs.

10.3 Audits will not give access to other customers’ data, or to information that would compromise Moyai’s security or trade secrets.

11. Return and deletion

11.1 During the term, Customer can export and delete Customer Personal Data on request.

11.2 Within 30 days after the Agreement ends, Moyai will delete Customer Personal Data, unless EU or Member State law requires Moyai to keep it. Before the end date, Customer may ask Moyai to return Customer Personal Data in a commonly used format. Backups are deleted in the normal backup cycle, within 90 days, and stay protected under this DPA until then.

11.3 De-identified Data is handled as set out in Clause 4 kept for its remaining retention period under Clause 4.3. Anonymised data under Clause 4.4 is not affected.

12. Liability

12.1 Each Party’s liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement.

12.2 Nothing in this DPA limits either Party’s liability to data subjects under Article 82 of the GDPR, or any liability that cannot be limited under applicable law.

13. Term and precedence

13.1 This DPA takes effect on the date it is signed and remains in force for as long as Moyai processes Customer Personal Data or De-identified Data.

13.2 If this DPA conflicts with the Agreement, this DPA prevails with regard to the processing of Personal Data. If this DPA conflicts with the SCCs, the SCCs prevail.

13.3 Moyai may update this DPA where needed to comply with changes in Data Protection Law or guidance from a supervisory authority. Moyai will notify Customer of any material change at least 15 days in advance.

14. Governing law and jurisdiction

14.1 This DPA is governed by the laws of the Netherlands.

14.2 Any dispute arising from or in connection with this DPA will be submitted exclusively to the competent court in Amsterdam, the Netherlands, unless the SCCs require otherwise.

Annex 1: Details of processing

Item	Description
Controller	Customer [or Customer’s client, where Customer acts as processor]
Processor	Moyai (and independent controller for Detection Improvement under Clause 4)
Contact persons	Customer: [name, position, email]. Moyai: [name, position, [email protected]]
Subject matter	Monitoring Customer’s AI agents through the Service
Categories of data subjects	End users who interact with Customer’s AI agents; Customer’s employees and contractors who build, operate or use those agents; any other individuals whose data appears in agent inputs, outputs, tool calls or retrieved content
Categories of Personal Data	Agent traces, spans and logs, including prompts, user messages, agent outputs, tool call inputs and outputs, retrieved documents, and metadata (timestamps, session and user identifiers, IP addresses), and any Personal Data these contain. Customer decides what its agents send. Account data of Customer’s users of the Service (name, work email, role).
Special categories	Not intended (Clause 2.3). If received incidentally: redaction before Detection Improvement, restricted access and encryption (Annex 2)
Nature of processing	Collection, storage, analysis (including by AI models), anomaly detection, root cause analysis, display to Customer, de-identification and deletion
Purposes	(1) Providing the Service: monitoring Customer’s AI agents, detecting and flagging behavioural anomalies, and providing root cause analysis. (2) Creating De-identified Data for Detection Improvement under Clause 4.
Frequency	Continuous, for as long as Customer sends telemetry to the Service
Duration and retention	Term of the Agreement plus the deletion period in Clause 12.
Competent supervisory authority	Autoriteit Persoonsgegevens (Dutch Data Protection Authority)

Annex 2: Technical and organisational measures

Measure	Description
Encryption	Data encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent provider-managed encryption)
Access control	Role-based access, least privilege, unique accounts, multi-factor authentication for all staff access to production systems and admin tools
Customer isolation	Logical separation of each customer’s data in the Service
Logging and monitoring	Logging of access to production systems and Customer Personal Data; alerts on suspicious activity
Data minimisation	Configurable redaction of Personal Data and secrets at ingestion [if available]; de-identification before Detection Improvement
Separation of improvement data	De-identified Data stored separately from production customer environments, with its own access controls
Retention and deletion	Trace data kept for the configured retention period, then deleted; deletion after termination under Clause 12
Personnel	Confidentiality obligations for all staff and contractors; security awareness training at onboarding and yearly
Vulnerability management	Dependency scanning, timely patching of critical vulnerabilities
Secure development	Code review for all production changes; separate development and production environments; no production data in development without de-identification
Availability and resilience	Hosted with AWS in eu-west-1; regular backups; documented recovery procedure
Incident response	Documented incident response process; Customer notified under Clause 10
Sub-processor management	Security review of Sub-processors before engagement; written data processing terms with each
Data subject requests	Tools and support to help Customer find, export and delete Customer Personal Data

Signatures

	Moyai	Customer
Company	Moyai Operations B.V.	[Customer legal name]
Signature
Name
Title
Date