Data Processing Agreement

Published: 8 November 2026.

Terms · Privacy · Refunds · Consumer terms · Subscriptions · Data processing

This Data Processing Agreement ("DPA") under Art. 28(3) GDPR forms part of the Puraite Terms of Use for Organizations ("Terms") between the Customer (controller) and Puraite GmbH (processor). Capitalized terms not defined here have the meaning given in the Terms.

1. Subject matter and precedence

1.1 This DPA governs Puraite's processing of personal data on the Customer's behalf when it provides the Service. Annex II describes the processing.

1.2 It applies for as long as Puraite processes such data, including after the Terms end, until deletion under section 11.

1.3 If this DPA and the Terms conflict on data protection, this DPA prevails.

2. Roles

2.1 Where the Customer acts as controller, Puraite processes personal data in Customer Content and Member account data used within the Organization on its behalf as processor.

2.2 Puraite is controller, not processor, for:

a) billing data: the Billing Profile, Purchaser details, purchase, refund and dispute records;

b) data needed to run its own accounts and security: login credentials, authentication and security logs, and the audit log;

c) usage data under section 10.

The Puraite privacy policy describes this processing.

2.3 Payment providers, including Paddle as reseller and merchant of record, receive billing data only. They receive no Customer Content and are not sub-processors under this DPA. Paddle processes billing data as an independent controller under its own privacy policy.

3. Instructions

3.1 Puraite processes personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless EU or member state law requires otherwise. In that case Puraite informs the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

3.2 The Terms, this DPA, and the Customer's use and settings of the Service are the Customer's complete instructions at conclusion. Further instructions must be in text form.

3.3 Puraite informs the Customer without delay if it considers that an instruction infringes data protection law, and may suspend that instruction until the Customer confirms or changes it.

4. Confidentiality

Puraite ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5. Security of processing

5.1 Puraite takes the technical and organizational measures required by Art. 32 GDPR. They are described in Annex III.

5.2 Puraite may change the measures if the level of protection does not fall below that described in Annex III.

6. Sub-processors

6.1 The Customer gives Puraite general written authorization to engage sub-processors. The sub-processors engaged at conclusion are listed in Annex IV.

6.2 For additions or replacements of sub-processors that Puraite controls, it gives Org admins at least 30 days' advance notice by email and updates the Data Register. Customers may object on reasonable data-protection grounds during that period. For changes initiated further down a provider's processing chain, Puraite promptly relays the upstream notice, the effective date and the available information, and gives the Customer a meaningful opportunity to object before the change affects its data. Short upstream notice does not itself authorize processing or waive applicable notice and objection rights. Puraite escalates objections and, where needed, suspends or uses an already authorized alternative for affected processing while resolving them. If the objection cannot be resolved, the Customer may terminate the affected service before the change is applied to its data.

6.3 Puraite imposes on each sub-processor, by contract, the same data protection obligations as in this DPA, in particular sufficient guarantees for appropriate technical and organizational measures. Puraite remains liable to the Customer for its sub-processors' performance of those obligations.

7. Transfers outside the EU and EEA

7.1 Puraite's primary storage is in the European Union. AI processing is global by default; provider-side processing and storage can be outside the EU. An Organization's EU AI Processing Region uses verified EU AI routes without global fallback, as described in Terms 10.3. This is separate from the locations of support, telemetry and other copies; Annex IV must identify the actual recipients, routes and locations for the Organization.

7.2 Where a sub-processor processes personal data in a third country, or is established in one, Puraite ensures that a transfer mechanism under Chapter V GDPR applies, such as certification under the EU-US Data Privacy Framework or standard contractual clauses. Annex IV names the mechanism for each sub-processor.

8. Data subject rights

Taking into account the nature of the processing, Puraite assists the Customer by appropriate technical and organizational measures, as far as possible, in responding to requests from data subjects under Chapter III GDPR. Members can export and correct data in the Service. Puraite forwards to the Customer any request it receives directly that concerns Customer Content.

9. Security incidents and other assistance

9.1 Puraite notifies the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Customer's data. The notice contains the information available under Art. 33(3) GDPR and is supplemented as more becomes known.

9.2 Puraite assists the Customer, taking into account the nature of processing and the information available to Puraite, with its obligations under Art. 32 to 36 GDPR, including data protection impact assessments and prior consultation.

10. Usage data and statistics

10.1 Puraite records usage data about the Service: AI consumption per Member and project, run status, error reports and product analytics events. It uses this data as controller to operate, secure and bill the Service, to calculate cost estimates, and, in aggregated form that identifies neither the Customer nor any person, to improve the Service.

10.2 Usage data does not include Customer Content. Customer Content is processed to provide the Service, except for the limited, non-identifying internal-evaluation collection in Terms 10.5. That exception requires verified CC BY/CC0 source eligibility, excludes private/confidential research, provides academic admin opt-out and paid/trial opt-in, and is not a model-training or publication permission. It does not authorize independent reuse of personal data held as processor. Material that cannot meet those restrictions is excluded.

11. Deletion and return

11.1 When the Terms end or the Customer requests Organization deletion, Puraite makes the data available for export for 30 days, then deletes personal data from systems under Puraite's control within the following 30 days, unless EU or member state law requires storage. For switching, the retrieval period begins after the agreed transition ends; any extension under Terms 14 takes precedence, so deletion never cuts short transition or retrieval. Mandatory erasure rights remain unaffected. These periods concern Customer data processed on its behalf, not records retained separately under Puraite's controller duties as explained in the privacy notice.

11.2 Puraite's database backup copies expire within the same deletion window, with a maximum 30-day backup retention. AI providers may have different retention windows and limited exceptions, including abuse/safety records; the evidence and unresolved account-specific checks are in Annex IV. Puraite requests deletion through available provider controls and enforces applicable downstream obligations. A provider's policy alone is not a lawful exception to this DPA or Art. 28 GDPR. Where retention is claimed for a separate controller purpose or legal duty, its role, basis, scope and period must be substantiated and disclosed. Puraite remains responsible for its processor obligations and does not promise immediate deletion of every provider-held copy.

11.3 For eligible free academic Organizations archived solely for inactivity, permanent deletion is scheduled at 12 months from the inactivity start, not 90 days after archival. Terms 7.6 governs advance warnings, reactivation/export and paid-license/usable-credit exemptions. An explicit Organization deletion request or contract termination instead follows 11.1. Backups follow 11.2.

11.4 Puraite confirms the deletion status in text form on request, distinguishing completion on its systems from provider-held copies and any substantiated retained categories.

12. Information and audits

12.1 Puraite makes available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, including the Data Register in the Service and, where available, certificates of its sub-processors.

12.2 Puraite allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates who is bound to confidentiality. The Customer announces an inspection at least 30 days in advance, except after a personal data breach, and carries it out during business hours without disrupting operations. Puraite may charge its reasonable costs for inspections beyond one per year, unless the inspection finds a breach by Puraite.

13. Liability

The liability provisions of the Terms (section 15) apply to this DPA. Art. 82 GDPR remains unaffected.

14. Term

This DPA takes effect when the Terms take effect and ends when Puraite no longer processes personal data on the Customer's behalf.

Annex I: Parties and contacts

Annex II: Description of the processing

Annex III: Technical and organizational measures

The measures are described in the Data Register in the Service, section "DPA – TOMs (Annex III)": encryption, access control, backups, network, monitoring and physical access. The version in force is the one shown there; Puraite records the date of each change ("Last updated").

Annex IV: Sub-processors

As listed in the Data Register in the Service, section "Subprocessor List (Annex IV)", last updated 2026-11-03:

Provider retention

Provider retention depends on the selected service, processing route and applicable exceptions. The provider information recorded on 3 November 2026 describes Gemini Developer API abuse logs of 55 days and uploaded files of 48 hours. For Anthropic's direct API, it describes ordinary 30-day retention and potentially two-year retention of flagged inputs/outputs, with longer retention of safety classifications and other exceptions. These figures are dated provider information, not guaranteed maximums for every route or account.

The Organization-specific annex identifies the applicable processing routes, retention periods and known exceptions. For provider documentation or questions about the applicable route, contact privacy@puraite.com.