1. Scope and incorporation

This Data Processing Addendum ("DPA") forms part of the agreement between Promptic GmbH ("Promptic") and the customer or organization using Promptic ("Customer") to the extent the agreement references this DPA, Customer accepts this DPA, or Customer uses Promptic to process personal data on behalf of Customer. This DPA applies only to personal data that Promptic processes as a processor or sub-processor for Customer ("Customer Personal Data").

If there is a conflict between this DPA and the agreement, this DPA controls for the processing of Customer Personal Data. If Standard Contractual Clauses apply, they control over this DPA for the relevant international transfer.

2. Roles

Customer is the controller or processor of Customer Personal Data. Promptic is a processor or sub-processor, as applicable. Customer is responsible for the lawfulness of Customer Personal Data, the accuracy of Customer's instructions, and the rights and notices needed for Customer's own users, employees, contractors, and end users.

Promptic processes Customer Personal Data only on Customer's documented instructions, including to provide, secure, and support the contracted service. Improvements are limited to delivering that instructed service, not independent reuse of Customer Personal Data. The agreement, product configuration, API calls, support requests, and this DPA document those instructions. Where Union or Member State law requires other processing, Promptic will inform Customer before processing unless that law prohibits notification on important grounds of public interest.

3. Processing details

4. Customer obligations

• Customer will provide all notices, obtain all consents, and establish all legal bases required for Customer Personal Data.
• Customer will not submit prohibited or highly sensitive data unless Promptic has agreed to that processing in writing.
• Customer will configure model providers, API keys, AI applications, access permissions, retention, and integrations in a lawful and secure manner.
• Customer is responsible for selecting appropriate models and configuring integrations. Providers independently contracted by Customer, including Customer's own provider accounts and endpoints, are subject to Customer's provider agreements. Providers engaged by Promptic remain Promptic's subprocessors even when Customer must enable the route.
• Platform-managed Claude, Gemini, and other models may be sent through Vercel AI Gateway with prompt-training prohibition on every request. EU routes enforce zero data retention. US and Global routes prefer zero data retention but may allow provider retention when no eligible ZDR route is available. EU and US routes additionally pin provider inference to that region; Global routes may be processed in any available region. Additional EU models use Amazon Bedrock Mantle through a regional European endpoint. Promptic restricts the published catalog to reviewed, billable model routes and does not expose non-European Bedrock routes. Customer remains responsible for deciding whether the selected model, route, and Promptic service are appropriate for the submitted data and use case.

5. Promptic obligations

• Promptic will ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations.
• Promptic will implement and maintain appropriate technical and organizational measures as described in the Security and TOMs page.
• Promptic will not sell Customer Personal Data or share it for cross-context behavioral advertising.
• Promptic will not use Customer Personal Data to train foundation models or build generalized model datasets.
• Promptic will inform Customer if, in Promptic's reasonable opinion, an instruction infringes applicable data protection law, unless prohibited by law.

6. Subprocessors

Customer grants Promptic general authorization to engage subprocessors necessary to provide the service. Promptic's current subprocessor list is available at /subprocessors. Promptic will impose written data protection obligations on subprocessors that are materially equivalent to the obligations in this DPA, including sufficient guarantees for appropriate technical and organizational measures. Promptic remains fully liable to Customer for its subprocessors' performance of their data protection obligations.

Promptic will provide notice of intended additions or replacements of subprocessors by updating the Subprocessors page and notifying affected active customers by email or in-product notice at least 30 calendar days before the new subprocessor processes Customer Personal Data. Customer may object on reasonable data protection grounds during the notice period by contacting hello@promptic.eu. A shorter period requires Customer's specific authorization or a binding legal requirement; in the latter case Promptic will notify Customer as soon as legally permitted. Promptic will work with Customer to resolve a reasonable objection, including through an alternative configuration. If no resolution is available, Customer may terminate the affected service before the change without a termination penalty and receive a pro-rata refund of unused prepaid fees for that service.

7. AI model providers

Customer instructs Promptic to transmit Customer Personal Data to AI model providers when necessary to perform model calls selected, configured, or requested by Customer. Platform OpenAI processing uses Promptic's OpenAI project configured for Europe and OpenAI API data controls, including no default training on API inputs and outputs and Modified Abuse Monitoring for eligible API processing. Optional OpenRouter routing is disabled unless Customer enables it for an AI application or model call. If Customer enables OpenRouter routing using Promptic's provider account, Promptic remains responsible for the applicable subprocessor terms and transfer safeguards. Where Customer independently contracts with a provider and connects its own account, Customer is responsible for that provider agreement and settings. In either case Promptic remains responsible for its own processing and secure transmission under this DPA.

8. Data subject requests and assistance

Taking into account the nature of processing, Promptic will reasonably assist Customer in responding to data subject requests, data protection impact assessments, consultations with authorities, and other Customer obligations under applicable data protection law. Promptic may provide assistance through product functionality, documentation, support, exports, deletion tools, or reasonable written support.

If Promptic receives a data subject request relating to Customer Personal Data, Promptic will either direct the requester to Customer or notify Customer, unless legally prohibited.

9. Personal data breaches

Promptic will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, without waiting for a completed investigation. Initial notice will include the nature of the breach, affected data and people, likely consequences, mitigation measures, and a contact point to the extent known. Missing information will follow in phases without undue further delay. Promptic will assist Customer with its notification and security obligations under Articles 32 to 36 GDPR; Customer's regulatory notification deadline is not a grace period for Promptic's notice.

10. Return and deletion

At the end of the processing services, Promptic will, at Customer's choice, return Customer Personal Data in a commonly used electronic format or delete it, and delete remaining copies after return. Customer can communicate its choice through support, including after account access ends. Active-system deletion is processed promptly. Residual backup and disaster-recovery copies are isolated from ordinary use and expire within 90 days; any restored copy remains subject to the deletion instruction. Retention beyond this is permitted only where Union or Member State law requires storage, with processing limited to that requirement. Promptic's independent controller records are governed separately by the Privacy Policy, not a general exception for retaining Customer Personal Data.

11. International transfers

Promptic configures core production infrastructure with a strong EU focus where available. Where Customer Personal Data is transferred outside the EEA, Switzerland, or the UK and no adequacy decision applies, Promptic relies on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, Data Privacy Framework certifications where applicable, and supplementary safeguards such as encryption, access controls, and vendor due diligence.

Where SCCs are the transfer mechanism, Promptic will ensure that the appropriate module and required parties, selections, and annexes are completed for the actual transfer before it occurs, including supplementary measures where necessary. Module 2 concerns controller-to-processor transfers and Module 3 processor-to-processor transfers. This DPA alone does not substitute for completed transfer clauses. Customer may request information and copies of applicable safeguards from hello@promptic.eu, with necessary redactions to protect confidential information without concealing the substance of the safeguards.

12. Audit information

Promptic will make available information reasonably necessary to demonstrate compliance with this DPA. This may include security documentation, subprocessors, transfer safeguards, written responses, and summaries of technical and organizational measures. Promptic will allow and contribute to audits, including inspections, by Customer or an independent auditor mandated by Customer. The parties will reasonably coordinate notice, confidentiality, scope, and scheduling to protect other customers and service security; separate agreement is not a condition of exercising this right. Urgent incidents, substantiated compliance concerns, and competent authority requirements may require shorter notice. Documentation does not replace an inspection where it is needed to verify compliance.

13. Contact

DPA requests, privacy requests, and security review questions can be sent to hello@promptic.eu.