Data processing agreement (template)

This template governs the processing of personal data by A2A Check (processor, Mesut Yilmaz, Hauptstraße 202, 44649 Herne, Germany) on behalf of your company (controller) under Art. 28 GDPR. It is only needed if the files you submit may contain personal data. To conclude it, send your company name, address and an authorised signatory to [email protected]; we return the completed and countersigned version.

The subject matter is the review of the configuration of your AI agents through the service at api.a2a-check.com. Processing covers: storing the submission, automated rule checks, creating and providing the list of findings, and deletion after the retention period or on your request. Nothing is passed to AI model APIs and no models are trained.

Data types: e-mail addresses of account owners and members, names of agents and connections, personal details contained in submitted configuration files (for example names or e-mail addresses in instructions), IP address, and date and time of requests. Data subjects: employees and contractors of the controller and persons whose details appear in the files. The service rejects credentials it detects and redacts personal details it detects before storage. Special categories of personal data (Art. 9 GDPR) must not be submitted.

The agreement applies as long as you use the service. Submissions are deleted 30 days after receipt for a free account and 90 days for a premium account. If you delete an agent or your account, we remove the data from production systems and from backups within 30 days. After the agreement ends we delete remaining data; no hand-over is planned because the lists of findings can be retrieved at any time.

We process the data only on your documented instructions; instructions are your use of the service and your requests to [email protected]. If we consider an instruction unlawful, we will tell you.

Persons with access are bound to confidentiality. Technical and organisational measures: operation on Google Cloud in regions within the EU, encryption in transit and at rest, separation of accounts, access keys stored only as verification values, rejection of detected credentials and redaction of detected personal details, restricted access rights, logging of security-relevant events, daily backups with rotation, automated tests and nightly monitoring of the service.

We use: Google Cloud EMEA Ltd., Dublin, Ireland (hosting, regions within the EU); Cloudflare Germany GmbH / Cloudflare, Inc. (delivery, domain and forwarding, abuse protection); Plus Five Five, Inc. (Resend; sending confirmation e-mails, EU servers). Agreements under Art. 28 GDPR exist with all of them; transfers to third countries rely on Art. 46 GDPR or an adequacy decision. We announce further or different sub-processors by e-mail at least 14 days in advance; you may object for good cause.

We assist you with requests from data subjects, data protection impact assessments and obligations under Art. 32 to 36 GDPR within reason. We report a personal data breach without undue delay. On request we provide the information needed to demonstrate compliance with Art. 28 GDPR and allow audits after reasonable notice, preferably as information or a questionnaire.

Liability is governed by Art. 82 GDPR and the terms of use. German law applies. In case of conflict, this agreement prevails for the processing of personal data.