Data Processing Agreement

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the customer using Squillify ("Customer") and Etalyon Sàrl-S, operating Squillify ("Squillify"), and applies where Squillify processes personal data on behalf of the Customer in connection with the Squillify platform.

This DPA is a draft and is not effective until accepted by Squillify and the Customer or incorporated into binding Terms of Service, an order form, or another written agreement.

1. Purpose and relationship with the Terms

This DPA sets out the terms under which Squillify processes personal data on behalf of the Customer when providing the Squillify platform, APIs, dashboard, microskill execution environment, telemetry, billing, support, and related services.

This DPA supplements the Terms of Service and any applicable order form or subscription agreement. If there is a conflict between this DPA and the Terms of Service regarding the processing of personal data on behalf of the Customer, this DPA controls for that processing.

2. Definitions

For the purposes of this DPA:

• Applicable Data Protection Law means the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Luxembourg law of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection regime, and any other data protection law applicable to the processing.
• Customer Personal Data means personal data processed by Squillify on behalf of the Customer in connection with the Services.
• Controller, processor, data subject, personal data, processing, personal data breach, and sub-processor have the meanings given to them under Applicable Data Protection Law.
• Services means the Squillify platform, APIs, dashboard, microskill execution infrastructure, support, billing, and related services provided to the Customer.
• Sub-processor means any third party engaged by Squillify to process Customer Personal Data on behalf of Squillify.

3. Roles of the parties

3.1 Customer as controller

For Customer Personal Data submitted to Squillify by the Customer, its users, its applications, its agents, its API keys, or its integrations, the Customer acts as controller unless otherwise expressly agreed in writing.

The Customer determines:

• whether personal data may be submitted to Squillify;
• the categories of personal data submitted;
• the lawful basis for processing;
• the purposes for which the Customer uses Squillify;
• the access rights granted to tenant users, members, agents, applications, and API keys;
• whether submitted data is confidential, regulated, sensitive, or subject to sector-specific restrictions.

3.2 Squillify as processor

Squillify acts as processor when it processes Customer Personal Data on behalf of the Customer and on the Customer's documented instructions.

The Customer's documented instructions include:

• this DPA;
• the Terms of Service;
• the Customer's configuration of the Services;
• API requests submitted by or on behalf of the Customer;
• tenant, user, API key, scope, quota, file handling, and billing settings;
• written instructions accepted by Squillify.

3.3 Squillify as independent controller

Squillify may act as an independent controller for limited processing that Squillify determines itself, including account administration, billing administration, fraud prevention, platform security, legal compliance, abuse prevention, and business records. Such processing is described in the Privacy Policy and is not governed by this DPA except where expressly stated.

4. Description of the processing

The subject matter, duration, nature, purpose, categories of data subjects, and categories of personal data are described in Annex 1.

Squillify processes Customer Personal Data only to provide, secure, monitor, maintain, and support the Services in accordance with this DPA and the Customer's documented instructions. Squillify does not use Customer Personal Data for independent product improvement unless that processing is separately identified in the Privacy Policy with an applicable role and legal basis.

5. Customer obligations

The Customer is responsible for ensuring that:

• it has a valid legal basis for submitting Customer Personal Data to Squillify;
• it has provided any required notices to data subjects;
• it has obtained any required consents or authorisations;
• its use of Squillify complies with Applicable Data Protection Law;
• its users, agents, applications, integrations, and API keys submit only data that the Customer is permitted to process through Squillify;
• it does not submit prohibited, unlawful, or unauthorised data;
• it uses available controls, including API key scoping, tenant access controls, rate limits, quotas, and skill access settings, appropriately.

Squillify does not determine whether Customer-submitted payloads contain personal data, sensitive data, regulated data, confidential data, or third-party data. The Customer remains responsible for making that determination before submitting data to Squillify.

6. Processing instructions

Squillify will process Customer Personal Data only on documented instructions from the Customer, unless required to do so by Union or Member State law applicable to Squillify.

If Squillify is required by law to process Customer Personal Data other than on the Customer's instructions, Squillify will inform the Customer before processing, unless the law prohibits such notice on important grounds of public interest.

Squillify will inform the Customer if, in Squillify's opinion, an instruction infringes Applicable Data Protection Law.

7. Confidentiality

Squillify will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations, whether contractual, statutory, or professional.

Access to Customer Personal Data is limited to personnel and service providers who require access for the provision, security, support, maintenance, billing, abuse prevention, or legal operation of the Services.

8. Security measures

Squillify will implement appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

The security measures include, as applicable:

• encryption in transit;
• encryption at rest where supported by the relevant infrastructure;
• tenant isolation controls;
• authentication and authorisation controls;
• API key protection and scoping controls;
• rate limiting and abuse prevention controls;
• access logging and operational monitoring;
• logging redaction practices designed to avoid raw payload capture;
• temporary file retention and deletion controls;
• access control for production systems;
• dependency and vulnerability management;
• incident response procedures;
• backup and recovery controls appropriate to the Services.

Additional security measures are described in Annex 2 and in the Security Policy.

9. Personal data breach

Squillify will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

The notification will, where reasonably available, include:

• the nature of the personal data breach;
• the categories and approximate number of data subjects affected;
• the categories and approximate number of records affected;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach;
• relevant contact information for follow-up.

Squillify will provide reasonable cooperation to help the Customer meet its own breach notification obligations under Applicable Data Protection Law.

The Customer remains responsible for determining whether notification to a supervisory authority or data subjects is required, unless Squillify is legally required to notify independently in its own capacity.

10. Assistance with data subject rights

Taking into account the nature of the processing and the information available to Squillify, Squillify will provide reasonable assistance to help the Customer respond to requests from data subjects exercising their rights under Applicable Data Protection Law.

Where a data subject contacts Squillify directly regarding Customer Personal Data, Squillify may direct the data subject to the Customer unless required by law to respond otherwise.

No self-service rights interface is currently provided. Requests may be submitted to [email protected]. Squillify will promptly forward or otherwise support the request in accordance with the Customer's documented instructions and Applicable Data Protection Law.

Because Squillify is designed not to permanently store raw submitted microskill payloads, Squillify may be technically unable to access, retrieve, correct, export, or delete raw payload content after execution or after expiry of temporary file retention periods.

11. Assistance with compliance obligations

Taking into account the nature of the processing and the information available to Squillify, Squillify will provide reasonable assistance to the Customer for:

• security obligations under Article 32 GDPR;
• personal data breach obligations under Articles 33 and 34 GDPR;
• data protection impact assessments under Article 35 GDPR;
• prior consultation with a supervisory authority under Article 36 GDPR, where applicable.

Such assistance may be subject to reasonable limits and, where appropriate, additional fees if the request requires material effort beyond standard support.

12. Sub-processors

12.1 General authorisation

The Customer gives Squillify general authorisation to engage sub-processors for the provision of the Services, subject to this section.

12.2 Sub-processor list

Squillify will maintain a public or customer-accessible list of sub-processors, including their purpose and role. The Sub-processors page forms part of the transparency materials for this DPA.

12.3 Changes to sub-processors

Squillify will provide notice of material changes to sub-processors through the Sub-processors page, email, dashboard notice, or another reasonable method.

The Customer may object to a new sub-processor on reasonable data protection grounds within the period stated in the notice or, if no period is stated, within 30 days after notice.

If the Customer objects, Squillify will use reasonable efforts to resolve the objection. If the objection cannot be resolved, the Customer may terminate the affected Services in accordance with the Terms of Service.

12.4 Flow-down obligations

Squillify will impose the same data protection obligations on each sub-processor as are set out in this DPA, to the extent applicable to the processing entrusted to that sub-processor, including sufficient guarantees to implement appropriate technical and organisational measures.

Squillify remains responsible to the Customer for the performance of its sub-processors' data protection obligations.

13. International transfers

Squillify will not transfer Customer Personal Data outside the European Economic Area unless such transfer complies with Applicable Data Protection Law.

Where Customer Personal Data is transferred to a country or recipient not covered by an adequacy decision, Squillify will use an appropriate transfer mechanism, such as Standard Contractual Clauses approved by the European Commission, together with any supplementary measures required by Applicable Data Protection Law.

Specific international transfer mechanisms, regions, and provider-level safeguards must be confirmed in the Sub-processors page before this DPA becomes active.

14. Return and deletion

At the Customer's choice, Squillify will delete or return all Customer Personal Data after the end of the provision of Services relating to processing and delete existing copies, unless Union or Member State law requires storage of the personal data. The Customer must communicate its choice through the available account, subscription, or privacy channel before the applicable deletion process completes. Data already deleted under short retention cannot be returned.

Squillify's deletion obligations are subject to:

• legal retention obligations;
• accounting and tax record retention;
• security logs and abuse prevention records;
• backup retention cycles;
• dispute, fraud, and enforcement records;
• data that has already been deleted because of short-lived retention.

For microskill execution payloads, Squillify's default design is no permanent raw payload storage. Temporary files, where used, are deleted according to the File Handling Policy and Data Retention Policy.

15. Audit and information rights

Squillify will make available all information necessary to demonstrate compliance with the obligations applicable under Article 28 GDPR and will allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer.

Audits are subject to reasonable notice, confidentiality obligations, and safeguards for other customers, systems, trade secrets, and infrastructure, provided those conditions do not prevent or materially impair the Customer's statutory audit rights. Squillify will inform the Customer if, in its opinion, an audit instruction infringes Applicable Data Protection Law.

Squillify may satisfy audit requests by providing:

• security documentation;
• policies;
• technical and organisational measures;
• third-party certifications or audit reports, if available;
• written responses to reasonable security or privacy questionnaires.

The parties should use current documentation, independent reports, and remote review first where these provide the necessary assurance. An on-site inspection remains available where reasonably necessary to meet Applicable Data Protection Law. Squillify may charge a reasonable fee only for a manifestly unfounded, excessive, or repetitive request where charging is permitted by law and the fee reflects the demonstrable additional cost; legally required cooperation is not made conditional on payment.

16. Records and documentation

Squillify will maintain records of processing activities where required by Applicable Data Protection Law.

The Customer is responsible for maintaining its own records of processing activities concerning its use of Squillify.

17. Restricted and sensitive data

The Customer must not submit special categories of personal data, criminal offence data, regulated financial data, health data, children's data, government identifiers, authentication secrets, payment card data, or other high-risk data to Squillify unless:

• the Customer has confirmed that such processing is lawful;
• the Customer has configured Squillify appropriately;
• the relevant Squillify capability is suitable for that type of data;
• any required written agreement, security review, or special terms have been completed.

Squillify does not provide a general-purpose sensitive data classification service and does not guarantee detection or blocking of sensitive data submitted by the Customer.

18. No training on Customer payloads

Squillify does not use Customer-submitted raw microskill payloads to train artificial intelligence models.

Operational metadata may be used for security, billing, reliability, abuse prevention, debugging, capacity planning, and product analytics as described in the Privacy Policy, Telemetry and Analytics Policy, and Microskill Data Handling Policy.

If Squillify later offers AI-backed capabilities that process Customer Personal Data differently, those capabilities must be explicitly labelled and governed by appropriate terms.

19. No hidden external services

Squillify's default platform policy is that microskills do not send submitted payloads to hidden external services unless the skill is explicitly labelled as using an external service.

Where a skill uses an external service, Squillify will provide information about the provider and data handling implications in the relevant skill documentation or External Service Use Policy.

20. Liability and remedies

Liability under this DPA is governed by the liability provisions of the Terms of Service or applicable written agreement between the parties, unless Applicable Data Protection Law requires otherwise.

Nothing in this DPA limits rights, remedies, or obligations that cannot be limited under Applicable Data Protection Law.

21. Contact

For DPA requests, data protection questions, or sub-processor objections, contact:

• Legal: [email protected]
• Privacy: [email protected]
• Security: [email protected]

Annex 1: Details of processing

Annex 2: Technical and organisational measures

Annex 3: Sub-processors

Current and planned sub-processors are listed on the Sub-processors page.

Before this DPA becomes active, Squillify must confirm for each sub-processor:

• legal entity name;
• purpose;
• categories of data processed;
• processing region;
• transfer mechanism;
• privacy or DPA link;
• status;
• effective date or planned use date.

Annex 4: International transfer safeguards

Before this DPA becomes active, Squillify must confirm whether any Customer Personal Data is transferred outside the European Economic Area.

Where such transfer occurs, Squillify must identify the applicable transfer mechanism, such as:

• adequacy decision;
• Standard Contractual Clauses;
• supplementary measures;
• provider DPA;
• EU-only processing configuration, where available.

No active version of this DPA should contain unconfirmed international transfer mechanisms.