Data Processing Agreement

1.When it applies

When you use Caudals to test your AI system, your documents, your questions and your system's answers can contain personal data, such as names in support conversations. For that data you are the controller and Caudals is your processor, under article 28 of the General Data Protection Regulation (GDPR) and the Spanish Data Protection Act (LOPDGDD).

The data processing agreement forms part of our Terms of Service, so it applies to every workspace without a signature. If your procurement process needs a signed copy, download the template below, complete your company's details and send it to [email protected]. We will countersign it.

See also: Terms of Service

2.What it covers

• Subject matter: hosting and processing your content to test your AI systems and produce reports, for as long as you use the Service.
• Nature and purpose: storing your content, reading documents and websites, sending questions to your system, recording and grading its answers, writing reports and, when you order it, expert review.
• Personal data: whatever your documents, websites and your system's answers contain, typically names, contact details and the content of conversations, plus the names and email addresses of your workspace members.
• Data subjects: your customers and users, your staff, and other people mentioned in your material.

3.What we commit to

• Process the data only on your documented instructions, which are this agreement and your use of the Service, and tell you if an instruction appears to break data protection law.
• Make sure everyone who processes it, including the freelance experts we engage, is bound by confidentiality.
• Apply the security measures described on our security page.
• Help you answer requests from data subjects and, where relevant, with impact assessments and consultations with supervisory authorities.
• Notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
• Delete your data when you delete your workspace or our contract ends, or return it to you first if you ask, unless the law requires us to keep it.
• Give you the information needed to show that we meet these obligations, and allow audits, including inspections, by you or an auditor you appoint, with reasonable notice.

See also: Security

4.Sub-processors

You authorize us to use the sub-processors listed on our sub-processors page. Each of them is bound by data protection terms equivalent to these. We announce a new sub-processor on that page, and by email to workspace owners, at least 30 days before it starts processing your data. You can object, and if we cannot resolve your objection, you can stop using the affected service and end the agreement.

See also: Sub-processors

5.International transfers

Your workspace data is hosted in Germany. When a sub-processor processes it outside the European Economic Area, we rely on an adequacy decision or on the European Commission's standard contractual clauses.

6.Download the template

The template sets out these terms in full, with annexes that describe the processing, our security measures and our sub-processors. It is an editable Word document, in English or Spanish, and its version matches this page.