Data Processing Agreement SynAI B.V.

Version: 1.0
Last updated: March 2026

1. Parties

This Data Processing Agreement ("Agreement") applies between:

Controller ("Client"):
The party that uses the services of SynAI B.V. and has Personal Data processed in connection therewith, as identified in the Project Plan or the service agreement.

Processor:
SynAI B.V.
Lindanusstraat 14 - 16
6031EA Nederweert
Chamber of Commerce (KVK): 42009196
Email: info@synai.eu
Phone: +31 85 369 5490

2. Definitions

In addition to the definitions in the General Terms and Conditions, the following terms in this Agreement shall mean:

• "Personal Data": Any information relating to an identified or identifiable natural person, as referred to in Article 4(1) GDPR;
• "Processing": Any operation or set of operations performed on Personal Data, as referred to in Article 4(2) GDPR;
• "Controller": The Client who determines the purposes and means of the Processing of Personal Data;
• "Processor": SynAI B.V., which processes Personal Data on behalf of the Controller;
• "Sub-processor": A third party engaged by the Processor to carry out (part of) the Processing;
• "GDPR": The General Data Protection Regulation (Regulation (EU) 2016/679);
• "Data Breach": A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

3. Subject Matter and Duration of Processing

3.1 Subject Matter

1. The Processor shall process Personal Data solely on behalf of and for the benefit of the Controller, within the context of the services provided through the Synai Portal.
2. The nature of the Processing concerns the transfer, transformation and routing of Personal Data through workflows, automations and AI integrations.
3. The Processor does not store Personal Data. Processing is limited to transfer and processing in working memory (transit processing). Personal Data is not persistently stored on the Processor's systems, unless technically necessary for the direct execution of the Processing and then only for the duration of that specific processing operation.

3.2 Categories of Personal Data

The categories of Personal Data processed depend on the workflows configured by the Client and may include, but are not limited to:

• Name and contact details
• Email addresses and phone numbers
• Customer and relationship data
• Financial data
• Other data that the Client processes through the Portal

3.3 Categories of Data Subjects

The data subjects whose Personal Data is processed depend on the workflows configured by the Client and may include, but are not limited to:

• Customers and contacts of the Client
• Employees of the Client
• Suppliers and partners of the Client
• Other data subjects whose data the Client processes through the Portal

3.4 Duration

This Agreement shall remain in effect for as long as the Processor processes Personal Data on behalf of the Controller. The Agreement shall terminate by operation of law upon termination of the underlying service agreement.

4. Obligations of the Processor

The Processor undertakes the following:

4.1 Instructions

1. The Processor shall process Personal Data solely on the basis of written instructions from the Controller, unless a legal obligation requires the Processor to process the data.
2. If the Processor believes that an instruction infringes the GDPR or other applicable legislation, the Processor shall immediately inform the Controller thereof.

4.2 Confidentiality

1. The Processor shall ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
2. The obligation of confidentiality shall remain in effect after termination of this Agreement.

4.3 Security

1. The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing (Art. 32 GDPR).
2. These measures shall include, but are not limited to:
   • Encryption of Personal Data in transit (TLS/HTTPS);
   • No persistent storage of Personal Data on the Processor's systems;
   • Access control and authentication;
   • Logging of processing activities;
   • Regular evaluation of security measures.

4.4 No Storage

1. The Processor shall not store Personal Data after completion of the specific processing operation.
2. Personal Data processed in transit shall be automatically and immediately removed from working memory upon completion of the processing.
3. The Processor shall not make copies or backups of Personal Data, unless this is necessary for the direct execution of the assignment and then only for the duration of that processing.

5. Sub-processors

5.1 General Authorisation

1. The Controller grants the Processor general written authorisation to engage sub-processors, provided that the Processor complies with the conditions set out in this article.
2. The Processor shall inform the Controller in advance of any intended changes to the list of sub-processors, so that the Controller may raise objections.

5.2 Current Sub-processors

At the time of conclusion of this Agreement, the Processor uses the following sub-processors:

Sub-processor	Country of Establishment	Purpose	Storage
DigitalOcean	US (EU region available)	Hosting Portal infrastructure	No (transit)
Hetzner	Germany	Server provisioning	No (transit)
OpenRouter	US	AI API routing	No (transit)
n8n (self-hosted)	EU (Hetzner)	Workflow execution	No (transit)

5.3 Obligations Regarding Sub-processors

1. The Processor shall impose on sub-processors the same obligations as those laid down in this Agreement, in particular with regard to providing sufficient guarantees for appropriate technical and organisational measures.
2. The Processor shall remain fully liable to the Controller for the performance of the sub-processor's obligations.

5.4 Objection Procedure

1. The Controller shall have the right to object to a new sub-processor within 14 days of notification.
2. If the Controller raises an objection, the parties shall enter into consultation. If no agreement is reached, the Controller shall have the right to terminate the Agreement.

6. Rights of Data Subjects

6.1 Assistance

1. The Processor shall assist the Controller in fulfilling requests from data subjects to exercise their rights (Art. 15 to 22 GDPR), including the right of access, rectification, erasure, restriction, data portability and objection.
2. Since the Processor does not store Personal Data, assistance with such requests shall be limited to providing information about the nature of the Processing.

6.2 Referral

If a data subject contacts the Processor directly with a request, the Processor shall refer the data subject to the Controller and shall inform the Controller thereof.

7. Data Breaches

7.1 Notification Obligation

1. The Processor shall notify the Controller without undue delay and in any event within 48 hours of becoming aware of a Data Breach.
2. The notification shall contain at least:
   • The nature of the Data Breach, including the categories and approximate number of data subjects and Personal Data records concerned;
   • The name and contact details of the Processor's contact point;
   • The likely consequences of the Data Breach;
   • The measures taken or proposed to address the Data Breach.

7.2 Assistance with Data Breaches

The Processor shall provide the Controller with all reasonable assistance in:

• Reporting the Data Breach to the Data Protection Authority (Art. 33 GDPR);
• Informing data subjects where required (Art. 34 GDPR);
• Investigating and mitigating the consequences of the Data Breach.

8. Data Protection Impact Assessment (DPIA)

The Processor shall provide the Controller with reasonable assistance in carrying out a data protection impact assessment (Art. 35 GDPR) and any prior consultation with the Data Protection Authority (Art. 36 GDPR), insofar as this relates to the Processing by the Processor.

9. Audits and Inspections

9.1 Right to Audit

1. The Controller shall have the right to conduct audits and inspections, or to have them conducted by an independent third party, in order to verify compliance with this Agreement.
2. The Processor shall provide all reasonable cooperation and make all necessary information available.

9.2 Conditions

1. The Controller shall give at least 14 days' prior written notice of an intended audit.
2. The audit shall be conducted during normal business hours and in a manner that minimises disruption to the Processor's operations.
3. The costs of the audit shall be borne by the Controller, unless the audit reveals a deficiency on the part of the Processor.

10. Termination and Data Deletion

10.1 Upon Termination

1. Upon termination of this Agreement, the Processor shall immediately cease all Processing of Personal Data on behalf of the Controller.
2. Since the Processor does not persistently store Personal Data, deletion or return of stored data is not applicable.

10.2 Confirmation

The Processor shall confirm in writing, at the Controller's request, that no Personal Data is being processed and that no Personal Data has been stored.

11. International Transfers

11.1 Transfers within the EEA

The Processor shall preferably process Personal Data within the European Economic Area (EEA).

11.2 Transfers outside the EEA

1. Where Personal Data is transferred to sub-processors outside the EEA (in particular when using AI services via OpenRouter), the Processor shall ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR.
2. Appropriate safeguards may consist of:
   • An adequacy decision by the European Commission;
   • Standard Contractual Clauses (SCCs) of the European Commission;
   • Binding Corporate Rules (BCRs).
3. The Controller acknowledges that when using AI services, Personal Data may be transferred to the United States or other countries outside the EEA. The Controller is responsible for deciding which data is processed through AI services.

12. Liability

1. The Processor's liability under this Agreement is limited in accordance with the provisions of the General Terms and Conditions of SynAI B.V.
2. The Controller shall indemnify the Processor against claims from data subjects or third parties arising from the Controller's failure to comply with its obligations under the GDPR.

13. Final Provisions

13.1 Order of Precedence

In the event of a conflict between this Agreement and the General Terms and Conditions, this Agreement shall prevail with regard to the processing of Personal Data.

13.2 Amendments

Amendments to this Agreement shall only be valid if agreed in writing by both parties.

13.3 Applicable Law

This Agreement shall be governed exclusively by the laws of the Netherlands. Disputes shall be submitted to the competent court in the district of Amsterdam.

Contact

SynAI B.V.
Chamber of Commerce (KVK): 42009196

Lindanusstraat 14 - 16
6031EA Nederweert

Email: info@synai.eu
Phone: +31 85 369 5490
Website: https://synai.eu

This Data Processing Agreement forms an integral part of the service agreement between the Controller and SynAI B.V.