# Data Processing Agreement (DPA)

## Summary

This Data Processing Agreement ("DPA") forms part of the customer agreement governing Breyta services. It applies when Breyta AS processes personal data on behalf of a business customer as processor.

- The customer acts as controller; Breyta acts as processor for Customer Personal Data.
- Breyta processes data only on documented instructions and to deliver the Service.
- Breyta does not train its own models on Customer Content. Customer-selected BYOK or third-party AI providers are governed by customer agreements with those providers.
- Customer Content is deleted from active systems within 90 days after termination, unless legal or contractual requirements or backup cycles require otherwise.
- As of February 26, 2026, inline step-result payload limits are a 256 KB inline threshold and a 1 MB per-step result cap. Larger outputs can be stored as persisted blob artifacts by reference, subject to runtime and service constraints.
- Cross-border transfers are protected by lawful transfer mechanisms where required.

## 1. Parties and Order of Precedence

This DPA is between Breyta AS (organization number 927 668 734), Løkenlia 9, 1352 Kolsås, Norway ("Processor"), and the customer entity entering the applicable services agreement with Breyta ("Controller").

This DPA supplements the applicable Terms of Service, order form, or master agreement ("Agreement"). If there is conflict on data protection matters, this DPA controls.

## 2. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in Applicable Data Protection Law.

"Applicable Data Protection Law" means applicable privacy and data protection laws, including GDPR and related EEA and UK implementing laws, as applicable to the processing under this DPA.

## 3. Scope and Processing Instructions

Breyta processes personal data only on Controller's documented instructions, including instructions in the Agreement, this DPA, product configuration, API calls, and support requests.

Instructions provided through authorized workspace users are deemed Controller instructions. Such users act on behalf of Controller and are not independent controllers vis-a-vis Breyta for processing under this DPA.

The subject matter, duration, nature, purpose, personal data categories, and data subject categories are described in Annex 1 of this DPA.

To maintain service reliability, Breyta enforces technical payload limits. As of February 26, 2026, inline step-result payload limits are a 256 KB inline threshold and a 1 MB per-step result cap. These limits apply to inline step results; persisted blob artifacts may exceed inline limits and are stored by reference, subject to runtime and service constraints.

Breyta will inform Controller without undue delay if, in Breyta's reasonable opinion, an instruction violates Applicable Data Protection Law, unless law prohibits notice.

## 4. Controller Obligations

- Controller is responsible for lawful basis, transparency notices, and data subject rights.
- Controller is responsible for the accuracy, quality, and legality of personal data submitted.
- Controller is responsible for user role management and permissions within its workspace.
- Controller is responsible for its own integrations and third-party providers selected in connection with the Service.
- Controller must not instruct Breyta to process personal data in violation of law.

## 5. Processor Obligations

- Process personal data only to provide, secure, support, and operate the Service.
- Ensure personnel with access are bound by confidentiality obligations.
- Implement and maintain technical and organizational measures under Annex 2.
- Keep records of processing activities where required by law.
- Promptly notify Controller if unable to comply with this DPA.

## 6. Confidentiality and Security

Breyta will implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and unauthorized access.

Breyta enforces need-to-know access controls and confidentiality obligations for personnel authorized to access personal data.

## 7. BYOK and Third-Party AI Providers

Breyta does not train its own models on Customer Content. Breyta's core service does not require use of Breyta-hosted LLM inference.

Where Controller enables BYOK or other third-party AI providers, processing by those providers is governed by Controller's direct terms with those providers. Controller is responsible for provider selection and configuration, including retention and training settings. This includes provider choices made by Controller's authorized workspace users.

## 8. Subprocessors

Controller grants general authorization for Breyta to engage subprocessors for hosting, operations, support, and related service delivery functions.

Breyta will ensure each subprocessor is bound by data protection obligations that are no less protective than this DPA, and Breyta remains responsible for subprocessors' processing to the extent required by Applicable Data Protection Law.

Breyta will provide subprocessor information and material updates through appropriate channels, and will consider reasonable objections where required by law. The current subprocessor list is available at [/subprocessors](/content/subprocessors/index.html).

Where feasible, Breyta will provide at least 15 days' notice before appointing a new subprocessor that materially impacts processing under this DPA. Controller may object in writing within that period on reasonable data protection grounds. The parties will work in good faith to address the objection; if unresolved, Controller may stop using the affected functionality or terminate the affected Service in accordance with the Agreement.

## 9. International Transfers

If Breyta transfers personal data to a country without an adequacy decision, Breyta will use lawful transfer safeguards such as the EU Standard Contractual Clauses, UK addendum mechanisms, or other valid transfer tools as applicable.

Upon reasonable request, Breyta will provide information on transfer safeguards relevant to processing under this DPA.

Breyta's current subprocessor transfer mechanisms are disclosed on the [/subprocessors](/content/subprocessors/index.html) page, including safeguards used for restricted cross-border transfers.

## 10. Assistance and Data Subject Rights

Taking into account the nature of processing, Breyta will assist Controller with appropriate technical and organizational measures to respond to data subject requests.

Breyta will also provide reasonable assistance for data protection impact assessments and supervisory authority consultations, where required and proportionate.

## 11. Personal Data Breach Notification

Breyta will notify Controller without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA.

Breyta will provide information reasonably available to support Controller's legal notification and remediation obligations and will take reasonable steps to contain, investigate, remediate, and mitigate the incident.

## 12. Audits and Compliance Information

Breyta will make available information reasonably necessary to demonstrate compliance with this DPA.

Controller may request an audit or inspection no more than annually, and additionally following a verified security incident or lawful supervisory request, with reasonable notice, confidentiality safeguards, and minimal operational disruption.

## 13. Deletion and Return

Upon termination or expiry of the Agreement, Breyta will delete or return personal data in accordance with Controller's documented instructions and product capabilities.

Unless legal obligations, contractual commitments, or backup cycles require otherwise, Customer Content is deleted from active systems within 90 days after termination.

For transparency, Breyta's standard retention windows also include: security and operational logs typically up to 180 days; support records typically up to 24 months; and billing/invoice records for up to 7 years where required by applicable accounting, tax, or legal obligations.

Upon reasonable request, Breyta can provide confirmation of deletion from active systems, subject to technical limitations and legal confidentiality obligations.

## 14. Term and Updates

This DPA remains effective while Breyta processes personal data on Controller's behalf under the Agreement.

Breyta may update this DPA as needed to reflect legal, regulatory, or operational changes. Material changes will be communicated with an updated effective date.

## 15. Liability

Each party's liability under this DPA is subject to the liability framework in the Agreement, except where Applicable Data Protection Law requires otherwise.

## 16. Governing Law

This DPA is governed by the laws of Norway and subject to the dispute framework in the Agreement, without prejudice to mandatory rights under Applicable Data Protection Law.

## 17. Annex 1 - Processing Details

- Subject matter: workflow automation, API operations, CLI-related account operations, support.
- Duration: for the term of the Agreement and limited post-termination retention as allowed.
- Nature and purpose: hosting, processing, storage, transmission, support, security, and diagnostics needed to provide the Service.
- Categories of personal data: account identifiers, contact data, workflow payload data, step execution and usage metadata, logs, support records, and billing-related business contact data.
- Technical payload limits (as of February 26, 2026): step-result payloads up to 256 KB inline and up to 1 MB per step result for inline step results. Larger outputs may be stored as persisted blob artifacts by reference (or rejected if they exceed applicable endpoint/runtime limits).
- Categories of data subjects: Controller's end users, employees, contractors, customers, prospects, and other persons represented in Controller-submitted data.

## 18. Annex 2 - Security Measures (Summary)

- Encryption in transit and at rest where appropriate.
- Access controls, least-privilege practices, and authentication safeguards.
- Security logging, monitoring, and incident response procedures.
- Secure development and vulnerability management practices.
- Backup, resilience, and business continuity controls.
- Confidentiality obligations and role-based internal access controls.

## 19. Contact

Privacy and DPA questions: hello@breyta.ai

Effective date: February 26, 2026

Last updated: February 26, 2026