Data processing agreement

This DPA is entered into between the customer identified at signup (“Customer”) and legal entity to be supplied operating TheStakk (“TheStakk”).

The role split is the whole point of this document. For content submitted to the applications you are the controller and we are the processor; for your own account record we are an independent controller.

Agency chain. Where the Customer is an agency provisioning client workspaces: the agency is, towards its end client, controller or processor according to their own contract; TheStakk acts on the agency’s documented instructions as processor, or sub-processor where the agency is itself a processor. The agency warrants that it has the legal basis and the contractual chain — its own terms, privacy policy and, where required, its own DPA with its client — to lawfully instruct TheStakk. End clients are not parties to this DPA.

Processing covers the hosting, execution, metering and restitution of content submitted to the applications, for the duration of the account, for the sole purpose of providing the service described in the Terms.

• Categories of data. Any content the Customer or its users choose to submit — text, documents, media, connected-account data — execution results, and per-run technical metadata.
• Data subjects. The Customer’s staff, its clients and their staff, and any individuals referred to in submitted content.

TheStakk processes content only on the Customer’s documented instructions — the Terms, this DPA, and the actions taken in the product: running an application is an instruction — unless EU or French law requires otherwise, in which case TheStakk informs the Customer before processing unless that law forbids it.

TheStakk informs the Customer if, in its opinion, an instruction infringes the GDPR.

Persons authorised to process content are bound by confidentiality obligations, access content strictly on a need-to-know basis, and never outside the support scenario the Privacy Policy describes — explicit request, limited duration, logged.

Article 32. Measures in force, detailed in the Security Documentation and summarised here as binding commitments.

TheStakk maintains and improves these measures and does not reduce the overall level of protection during the term.

The Customer grants a general authorisation to engage sub-processors for hosting, model inference, payment processing and transactional email. The current list — name, role, location — is published and versioned at the sub-processors page.

TheStakk notifies customers before adding or replacing a sub-processor; the Customer may object in writing within 15 days on reasonable data protection grounds, and if no workaround is found may terminate the affected service without penalty. TheStakk imposes on every sub-processor data protection obligations equivalent to this DPA and remains fully liable for their performance.

Hosting and processing take place inside the European Union. providers and regions to be supplied — must match the Privacy Policy section 05.

Where a sub-processor processes data outside the EU, the transfer is covered by the European Commission’s Standard Contractual Clauses, and supplementary measures where required, referenced in the sub-processor list.

Taking into account the nature of processing, TheStakk assists the Customer:

• Data subject requests. The product’s export, correction and deletion capabilities are the first line; requests reaching TheStakk directly are forwarded to the Customer without undue delay.
• Security, breach notification, DPIAs and prior consultations — Articles 32 to 36 — by providing the information in its possession.

TheStakk notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s content, with the information Article 33(3) requires — nature, categories and approximate numbers, likely consequences, measures taken — supplemented as investigation progresses.

Notification to authorities and data subjects remains the controller’s decision and duty.

At any time during the term, the Customer can export its content and execution history in a machine-readable format, self-serve.

At the end of the service, TheStakk deletes content within the schedule set in the Privacy Policy section 06 windows to be confirmed there, except what French law requires keeping — invoicing records and the execution records backing them. Deletion covers backups on the rolling cycle described in the Privacy Policy.

TheStakk makes available the information necessary to demonstrate compliance: this DPA, the Security Documentation, the sub-processor list, and certifications or third-party audit summaries as they exist SOC2 / ISO status: none at this stage.

The Customer may audit once per twelve months, on 30 days’ written notice, during business hours, without access to other customers’ data, at its own cost, through written questionnaires first and on-site only where questionnaires are demonstrably insufficient.

Liability under this DPA follows the cap and exclusions of the Terms of Service, without prejudice to Article 82 GDPR.