--- title: "Data Processing Agreement · Agentrail" description: "Data Processing Agreement between a customer and Aeternus Inc. for personal data processed by the Agentrail Services, including anonymized Failure Insights." canonical: "https://www.agentrail.co/dpa" --- Legal # Data Processing Agreement Updated October 19, 2026 This agreement covers personal data in the Agentrail Services. It is between the customer named in the services agreement and Aeternus Inc. Fields in square brackets are completed in that agreement. The [subprocessors](https://www.agentrail.co/subprocessors) and the [security measures](https://www.agentrail.co/security) it refers to are published on this site. This Data Processing Agreement (“DPA”) forms part of the agreement for services (the “Principal Agreement”) between \[CUSTOMER NAME\] (the “Company”) and Aeternus Inc. (“Agentrail” or the “Processor”), together the “Parties”. If this DPA conflicts with the Principal Agreement, this DPA prevails. The Company acts as a Controller and engages Agentrail to provide the Services, which involve the Processing of Personal Data. The Parties enter into this DPA to set out their rights and obligations in compliance with Data Protection Laws. ## 1\. Definitions **1.1\. “Company Personal Data”** means Personal Data Processed by Agentrail on behalf of the Company under the Principal Agreement, including Personal Data contained in agent inputs, prompts, outputs, logs, traces and tool calls (“Agent Data”). **1.2\. “Data Protection Laws”** means all laws applicable to the Processing of Personal Data, including the GDPR, the UK GDPR and UK Data Protection Act 2018, the Swiss FADP, and US privacy laws such as the CCPA (as amended by the CPRA). **1.3\. “Anonymized Data”** means data that has been irreversibly processed so that it no longer relates to an identified or identifiable natural person or product, and cannot reasonably be re-identified, as “anonymous” or “deidentified” data is understood under Data Protection Laws. **1.4\. “Failure Insights”** means Anonymized Data describing how AI agents behave, including errors, failure points, failure patterns, root causes, and the fixes, corrections or remediations applied to them. **1.5\. “AI Research Partners”** means third-party developers of AI models and research laboratories with whom Agentrail shares Failure Insights under Section 3. **1.6\. “Services”** means the AI agent reliability, monitoring and related services Agentrail provides under the Principal Agreement. **1.7\. “Subprocessor”** means any third party engaged by Agentrail to Process Company Personal Data on behalf of the Company. **1.8.** “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach” and “Processing” have the meanings given in the GDPR. “Sell”, “share”, “deidentified” and “Service Provider” have the meanings given in the CCPA. ## 2\. Processing of Company Personal Data ### 2.1\. Company obligations The Company shall ensure that Company Personal Data is collected and provided to Agentrail in compliance with Data Protection Laws, and that it has given all notices and obtained all consents or other lawful bases required for Agentrail to Process it as described in this DPA, including under Section 3. ### 2.2\. Instructions The Company instructs Agentrail to Process Company Personal Data: - to provide, secure, support and improve the Services; and - to perform the anonymization and related activities described in Section 3. This DPA and the Principal Agreement are the Company’s complete documented instructions. ### 2.3\. Agentrail obligations Agentrail shall: - Process Company Personal Data only on the Company’s documented instructions, unless required otherwise by law, in which case it will inform the Company first unless the law prohibits this; - notify the Company if, in its reasonable opinion, an instruction infringes Data Protection Laws; - not sell or share Company Personal Data, or retain, use or disclose it outside the direct business relationship with the Company, except as permitted by this DPA; and - act as a Service Provider under the CCPA and comply with its restrictions. **2.4.** [Annex I](https://www.agentrail.co/dpa#annex) sets out the subject matter, nature, purpose and duration of the Processing and the categories of Personal Data and Data Subjects. ## 3\. Anonymized Data, Failure Insights and Sharing with AI Research Partners ### 3.1\. Authorization to anonymize The Company authorizes and instructs Agentrail to anonymize and deidentify Company Personal Data and Agent Data in order to create Anonymized Data. ### 3.2\. Extraction of Failure Insights The Company authorizes Agentrail to analyze Agent Data and Anonymized Data to identify, extract and compile Failure Insights, including agent failure points and the fixes applied to them. ### 3.3\. Sharing with AI Research Partners The Company agrees that Agentrail may disclose and license Anonymized Data and Failure Insights to AI Research Partners for the purposes of researching, evaluating, benchmarking, training and improving AI models and agent systems. ### 3.4\. Status and use Anonymized Data and Failure Insights are not Company Personal Data and are not subject to this DPA. Agentrail owns all rights in them and may use, retain and disclose them for any lawful purpose, during and after the term of the Principal Agreement. ### 3.5\. Safeguards Agentrail shall: - apply anonymization measures consistent with industry standards and Data Protection Laws, including removal or masking of names, contact details, IP addresses, account identifiers, credentials, API keys and other secrets; - not identify the Company or its end users as the source of any Anonymized Data or Failure Insights without the Company’s prior written consent; - not attempt, and publicly commit not to attempt, to re-identify any Anonymized Data, except to test its anonymization processes; - contractually prohibit each AI Research Partner from re-identifying, or attempting to re-identify, any individual or the Company; and - never disclose Company Personal Data that has not been anonymized to any AI Research Partner. ### 3.6\. Opt-out Notwithstanding Sections 2.2 and 3.1–3.4, the Company may opt out of the creation, use, disclosure and licensing of Anonymized Data and Failure Insights under this Section 3, for all or specified Company Personal Data and Agent Data, at any time by emailing [privacy@agentrail.co](mailto:privacy@agentrail.co). The Company may exercise this option on behalf of its end users. An end user may request an opt-out through the Company; if Agentrail receives such a request directly, it shall promptly forward it to the Company and assist the Company in implementing it. Agentrail shall acknowledge the Company’s notice and implement the opt-out without undue delay and in any event within ten (10) business days of receipt, and confirm implementation in writing. Once effective, the opt-out applies to previously collected and subsequently collected data within its scope, and Agentrail shall cease the activities under this Section 3 for that data. For Anonymized Data and Failure Insights created before the opt-out takes effect, Agentrail shall cease future use, disclosure and licensing to the extent the affected material can be located using existing provenance records without re-identifying any individual. The opt-out does not require re-identification, retrieval of material already disclosed, or reversal of completed model training, and does not limit any rights under Data Protection Laws. It does not affect Processing necessary to provide, secure or support the Services under the Company’s documented instructions. The Company may withdraw the opt-out by written notice to [privacy@agentrail.co](mailto:privacy@agentrail.co). ## 4\. Confidentiality and Security **4.1.** Agentrail shall ensure that personnel with access to Company Personal Data are bound by appropriate obligations of confidentiality. **4.2.** Taking into account the state of the art, costs of implementation and the risks to Data Subjects, Agentrail shall implement appropriate technical and organizational measures to protect Company Personal Data, including the measures referred to in Article 32 GDPR, such as encryption in transit and at rest, access controls and logging. Those measures are described on the [security page](https://www.agentrail.co/security). ## 5\. Subprocessors **5.1.** The Company grants Agentrail general authorization to engage Subprocessors, including those listed at [agentrail.co/subprocessors](https://www.agentrail.co/subprocessors). **5.2.** Agentrail shall impose on each Subprocessor written data protection obligations equivalent to this DPA, and remain liable to the Company for each Subprocessor’s performance. **5.3.** Agentrail shall give at least fourteen (14) days’ notice of any new Subprocessor. The Company may object on reasonable data protection grounds within seven (7) days of notice. If the Parties cannot resolve the objection within thirty (30) days, the Company may terminate the affected Services. ## 6\. Data Subject Requests, Breaches and Audits ### 6.1\. Data Subject requests Agentrail shall notify the Company of any request it receives from a Data Subject regarding Company Personal Data, shall not respond except on the Company’s instructions or as required by law, and shall provide reasonable assistance so the Company can respond. ### 6.2\. Assistance Agentrail shall provide reasonably requested information to help the Company carry out data protection impact assessments and consultations with supervisory authorities. Agentrail may charge a reasonable fee for assistance beyond the Services. ### 6.3\. Personal Data Breach Agentrail shall notify the Company without undue delay after becoming aware of a Personal Data Breach affecting Company Personal Data, provide the information the Company reasonably needs to meet its notification obligations, and take reasonable steps to contain and remediate it. ### 6.4\. Audits Agentrail shall make available information reasonably necessary to demonstrate compliance with this DPA and, at the Company’s cost and on reasonable notice, allow for audits by the Company or its appointed auditor, no more than once per year unless required by a supervisory authority or following a Personal Data Breach. ## 7\. Deletion, Transfers and General Terms ### 7.1\. Deletion On termination of the Services and at the Company’s request, Agentrail shall delete or return Company Personal Data, unless retention is required by law. This obligation does not apply to Anonymized Data or Failure Insights. ### 7.2\. International transfers The Company authorizes Agentrail and its Subprocessors to Process Company Personal Data in the United States and other countries where they operate. For transfers of Personal Data from the EEA, UK or Switzerland to a country without an adequacy decision, the Parties incorporate by reference Module 2 (controller to processor) of the EU Standard Contractual Clauses (Decision (EU) 2021/914), with the UK International Data Transfer Addendum and the Swiss FADP adaptations as applicable. Clause 9 Option 2 applies with the notice period in Section 5.3; Clauses 17 and 18 are governed by the laws and courts of Ireland. Annex I of this DPA completes the Annexes to the Standard Contractual Clauses, which prevail over this DPA in case of conflict. ### 7.3\. Liability Each Party’s liability under this DPA is subject to the limitations of liability in the Principal Agreement. ### 7.4\. Governing law This DPA is governed by the law and jurisdiction set out in the Principal Agreement, except as required by the Standard Contractual Clauses. ### 7.5\. Survival Section 3 survives termination or expiry of this DPA and the Principal Agreement. ## Signatures **\[CUSTOMER NAME\]** Signature Name \[REPRESENTATIVE NAME\] Title \[REPRESENTATIVE TITLE\] Date **Aeternus Inc.** Signature Name \[NAME\] Title \[TITLE\] Date ## Annex I: Details of Processing | Item | Details | | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Data exporter | The Company, \[CUSTOMER ADDRESS\]; contact: \[REPRESENTATIVE NAME\]; role: Controller | | Data importer | Aeternus Inc., 8 The Green, Ste A, Dover, Kent County, Delaware 19901, United States; contact: [privacy@agentrail.co](mailto:privacy@agentrail.co); role: Processor | | Subject matter | Provision of the Services to the Company | | Nature and purpose | Monitoring, logging, debugging and improving the reliability of AI agents; support, security and service improvement; anonymization and extraction of Failure Insights under Section 3 | | Data subjects | The Company’s end users, employees, contractors and other individuals whose data appears in Agent Data | | Categories of data | Names, contact details, account and user IDs, IP addresses, device and usage data, and any Personal Data contained in agent prompts, inputs, outputs, logs, traces and tool calls, as determined by the Company | | Sensitive data | None intended. The Company shall not submit special category data unless agreed in writing | | Frequency of transfer | Continuous | | Duration and retention | For the term of the Principal Agreement, then deleted or returned under Section 7.1 | | Competent supervisory authority | Determined under the GDPR by the data exporter’s establishment or representative in the EEA; for Swiss transfers, the FDPIC | | Security measures | As described in Section 4.2 and at [agentrail.co/security](https://www.agentrail.co/security). |