Skip to main content

Data Processing Agreement

Document control
FieldValue
Version2.0
Effective date1 October 2026
Last revised31 August 2026
Approved bySubgen AI Spain, S.L.
SupersedesVersion 1.0, dated 1 January 2024

The full version history is available in the Legal document changelog.

Preamble​

This Data Processing Agreement amends and forms part of the Agreement between Subgen AI and the Customer. This Data Processing Agreement prevails over any conflicting terms of the Agreement but does not otherwise modify the Agreement.

1. Definitions​

The capitalized words in this Agreement shall have the meaning given below:

"Agreement": means the service agreement entered into by and between the Parties, governing the provision of the Serenity* Star Services by Subgen AI to the Customer.

"Applicable Data Protection Law": means any applicable national, federal, EU, state, provincial or other privacy, data security, or data protection law or regulation, including, to the extent applicable, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 applicable since 25 May 2018 (the "GDPR").

"Authorized Recipient": means (i) Subgen AI's affiliates, (ii) Subgen AI's team members, (ii) Subgen AI's Sub-processors or (iv) any third party that is authorized by the Applicable Data Protection Law to access the Personal Data.

"Authorized Purpose": means the authorized purpose for the Processing as mentioned in Exhibit 1.

"Customer": means any legal person who subscribes to the Serenity* Star Services and, where applicable, its affiliates.

"Data Controller": means the person who determines the purposes and the means of the Processing.

"Data Processing Agreement" or "DPA": means this data processing agreement governing the Processing carried-out by the Parties, that forms part of the Agreement.

"Data Processor": means the person who carries-out the Processing on behalf of the Data Controller and under its documented instructions.

"Data Subjects": means the person whose Personal Data is processed.

"International Data Transfer": means any disclosure of Personal Data by an organization established in the EEA to a Restricted Country.

"Subgen AI": means Subgen AI Spain, S.L., a company incorporated under the laws of Spain, with Spanish tax identification number (NIF) B40656274, registered with the Commercial Registry of Valencia under Section 8, Sheet V-192386, with its registered office at Calle Colón 8, Puerta 2, 46004 Valencia, Spain, and its affiliates.

"Personal Data": means any data relating to an identified or identifiable Data Subject.

"Personal Data Breach": means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.

"Processing": means the processing of Personal Data described in Exhibit 1.

"Restricted Country": means any country located outside of the European Economic Area (EEA) and that does not benefit from an adequacy decision from the European Commission.

"SCC": means the clauses annexed to the EU Commission Implementing Decision 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council as amended or replaced from time to time.

"Services": means all services provided within the Serenity* Star ecosystem by Subgen AI to the Customer, including but not limited to Serenity* Star and Serenity* AI, the latter also being referred to as Serenity* AI Chat.

"Sub-processor": means any Data Processor appointed by Subgen AI to carry-out all or part of the Processing on behalf of the Customer.

"Supervisory Authority": means any independent authority competent to supervise the Processing.

Terms not defined in this document. Any capitalized word that is not defined in this DPA shall have the meaning given in the Agreement.

2. Role of the Parties​

2.1. Subgen AI as Data Processor​

Services provided on Serenity* Star platforms. When Customer uses any of the Serenity* Star platforms:

  • The Customer is the Data Controller;
  • Subgen AI is the Data Processor for the limited and specific Authorized Purposes set out in Exhibit 1.

Services provided via Cloud Providers. When Customer uses the Services through a Cloud Provider:

  • The Customer is the Data Controller;
  • The Cloud Provider processes the Personal Data provided by the Customer as Data Processor for the purpose of making the Models available to the Customer on the Cloud Provider's Infrastructure;
  • Subgen AI will only process Personal Data provided by the Customer as Data Processor for the limited and specific Authorized Purposes set out in Exhibit 1.

Description of the Processing. Subgen AI processes the Personal Data on behalf of the Customer in order to provide the Customer with the Services under the Agreement. A description of the Processing is available in Exhibit 1 of this DPA. The Customer agrees that Subgen AI may update the description of the Processing from time to time to reflect new Services, features or functionalities.

2.2. Subgen AI as Data Controller​

Subgen AI as Data Controller. The Customer authorizes Subgen AI to process the User Data as Data Controller for the purpose of:

  • Monitoring abuse;
  • Processing voluntary reports;
  • Research and development purposes, only if Customer:
    • Uses the Free Services; or
    • Uses the Paid Services on Serenity* Star platforms and has not opted out by using the applicable feature on its Account.

Subgen AI does not use User Data to train or fine-tune its Models.

3. General obligations of the Parties​

Each Party shall comply with their respective obligations under the Applicable Personal Data Protection Law and shall not, by any act or omission, cause the other to be in breach of any such obligations under the Applicable Data Protection Law.

3.1. General obligations of Subgen AI​

Subgen AI shall:

  • Process the Personal Data only in accordance with the documented lawful instructions of the Customer as set forth in this DPA, the Agreement or by email and for no other purpose, unless required to do so by the applicable laws. In such a case, Subgen AI shall promptly inform the Customer of that legal requirement, unless prohibited to do so by applicable law and/or on important grounds of public interest;
  • Promptly inform the Customer if, in its opinion, the Customer's instructions infringe the Applicable Data Protection Law. In such an event, Subgen AI is entitled to refuse to perform the Processing of Personal Data that it believes to be in violation of the Applicable Data Protection Law;
  • Ensure that any person Subgen AI authorizes to process Personal Data (including Subgen AI team members and the Subprocessors), are subject to a duty of confidentiality, whether by contract or statutory, and must not allow any person to process Personal Data who is not under such confidentiality obligations;
  • Taking into account the nature of the Processing and the information available to Subgen AI, upon the Customer's written request and to the extent that is commercially reasonable and required by the Applicable Data Protection Laws, provide the Customer with reasonable and timely assistance (i) in the event of an investigation from a Supervisory Authority related to the Processing, (ii) to conduct a data protection impact assessment, a prior consultation with a Supervisory Authority, (iii) to comply with its obligations under Article 32 GDPR.

3.2. General obligations of the Customer​

The Customer agrees that:

  • It will comply with its obligations under the Applicable Data Protection Law regarding the Processing and any Processing instruction it issues to Subgen AI;
  • It is responsible for providing guidance to Authorized users regarding the use of the Serenity* Star Services, and in particular the use of Personal Data within the Services;
  • It is responsible for applying filters to prevent any unauthorized use of Personal Data by the Authorized Users;
  • It is responsible for ensuring compliance with all security requirements when using any component of the Serenity* Star ecosystem;
  • Subgen AI's security obligations under this DPA apply without prejudice to the Customer's own security obligations under the Applicable Data Protection Law;
  • It has provided notice and obtained all consents and rights necessary under the Applicable Data Protection Law for Subgen AI to process Personal Data under this DPA.

4. Data Subjects Rights​

4.1. Information​

As Data Controller, the Customer is solely responsible for providing the Data Subjects with any information required by the Applicable Data Protection Law.

4.2. Data Subject Requests​

Taking into account the nature of the Processing and upon the Customer's request, Subgen AI shall provide the Customer with commercially reasonable assistance to enable the Customer to respond to any request from Data Subjects to exercise any of their rights under the Applicable Data Protection Law.

4.3. Direct Requests​

In the event that any request is made directly to Subgen AI, Subgen AI will not respond to such request directly without the Customer's prior consent, unless required to do so by applicable law. Instead, Subgen AI will transfer that request to the Customer who will then be solely responsible to respond to such request. If Subgen AI is legally required to respond to the Data Subjects' request, Subgen AI will promptly notify the Customer and provide it with a copy of the request unless prohibited to do so by applicable law.

5. Security and Personal Data Breach​

5.1. Security Measures​

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Subgen AI shall implement and maintain appropriate technical and organizational measures across the Serenity* Star ecosystem to protect Personal Data from any Personal Data Breach and to preserve the security and confidentiality of the Personal Data. These measures include:

  • Encryption of data at rest and in transit
  • Access controls and authentication mechanisms
  • Regular security assessments and penetration testing
  • Continuous monitoring and logging of system access
  • Regular backup procedures
  • Specific security measures for each Serenity* Star platform component

5.2. Personal Data Breach​

In the event of a Personal Data Breach, Subgen AI shall:

  1. Notify the Customer without undue delay and no later than 72 hours after becoming aware of the breach
  2. Provide detailed information including:
    • Description of the nature of the breach
    • Categories and number of Data Subjects affected
    • Categories of Personal Data involved
    • Measures taken or proposed to address the breach
    • Potential consequences of the breach
  3. Cooperate with the Customer in investigating and remediating the breach
  4. Document all breaches and remedial actions taken

6. Sub-processing​

6.1. Categories of Sub-processor​

This DPA distinguishes three categories of recipient, which are subject to different regimes:

  • Platform Sub-processors support the Serenity* Star platform for every Customer and Process Personal Data irrespective of any choice the Customer makes. They are listed in section 1 of the Sub-processors page.
  • Customer-Elected Providers Process Personal Data only where the Customer has enabled the corresponding Model, Skill or other optional feature in its Workspace. They are listed in section 2 of the Sub-processors page.
  • Customer-Configured Destinations are third parties to which the Customer itself directs the transmission of data, by configuring a feature such as the Remote MCP Connector or the HTTP Request Skill, or by connecting an external account to its Workspace. Subgen AI neither selects nor contracts with them, and cannot list them. They are addressed in clause 6.5.

6.2. General Authorization for Platform Sub-processors​

The Customer provides prior general authorization for Subgen AI to engage Platform Sub-processors, subject to the following conditions:

  • Subgen AI maintains an up-to-date list of Platform Sub-processors on the Sub-processors page
  • Subgen AI provides 30 days' prior notice of any intended changes to that list
  • Platform Sub-processors are bound by data protection obligations no less protective than those in this DPA
  • Subgen AI remains liable for its Platform Sub-processors' compliance with the DPA obligations

6.3. Objection Right​

Customers may object to a new Platform Sub-processor within 30 days of notification. If no resolution is reached, Customer may terminate the affected Services.

6.4. Customer-Elected Providers​

The platform offers optional features that rely on third-party providers, including the Models available for chat, embeddings, vision, image generation and speech generation, and the third-party services behind certain Skills. Such a provider is engaged as a Sub-processor only when, and for as long as, the Customer has enabled the corresponding Model, Skill or feature in its Workspace. Enabling it constitutes the Customer's authorization to engage that provider for the Processing that the feature entails.

Subgen AI keeps section 2 of the Sub-processors page accurate and publicly available, so that the Customer can assess a provider before enabling any feature that relies on it. Because such a provider Processes no Personal Data until the Customer enables the corresponding feature, the notice period in clause 6.2 does not apply to the addition of a Model, a Skill or a provider to the catalogue.

Each Customer-Elected Provider Processes Personal Data on the terms that provider itself publishes. Subgen AI identifies those providers on the Sub-processors page so that the Customer can review those terms before enabling a feature, but does not undertake that any such provider is bound by terms equivalent to this DPA. By enabling a Model, Skill or feature, the Customer accepts the terms of the corresponding provider for the Processing that the feature entails.

Subgen AI remains liable to the Customer for the performance of the obligations of a provider the Customer has enabled, in accordance with Article 28(4) of the GDPR.

6.5. Customer-Configured Destinations​

Certain features allow the Customer to specify the destination to which data is transmitted. These include the Remote MCP Connector, which connects to a Model Context Protocol server at an address the Customer supplies; the HTTP Request Skill, which calls an endpoint the Customer defines; and any external account the Customer connects to its Workspace.

Where the Customer uses such a feature, the Customer determines the recipient. Subgen AI transmits the data as instructed and does not select, evaluate, or enter into any agreement with that recipient. Such a recipient is therefore not a Sub-processor engaged by Subgen AI, and cannot be listed on the Sub-processors page.

The Customer is responsible for the lawfulness of each such transmission, for any agreement required with the recipient, and for any transfer of Personal Data outside the European Economic Area that the transmission entails.

6.6. Notification of Changes​

Changes to the list of Platform Sub-processors are notified as follows:

  • Channel: by email to the administrative contact associated with the Customer's Account, and by publication on the Sub-processors page.
  • Notice period: at least 30 days before the new Sub-processor starts Processing Personal Data on behalf of the Customer.
  • Subscription: the Customer may subscribe to notifications of changes to the Sub-processor list by writing to [email protected].

7. International Data Transfers​

7.1. Platform Sub-processors​

The Sub-processors that support the Serenity* Star platform for every Customer are listed in section 1 of the Sub-processors page, which states, for each of them, the region in which it Processes Personal Data and the basis for any transfer outside the European Economic Area.

The Sub-processors that host the platform and the Customer's Inputs and Outputs Process Personal Data within the European Economic Area. Where a Sub-processor identified in that section Processes Personal Data in a Restricted Country, the transfer is made under the mechanism identified there, and clause 7.4 applies.

7.2. Customer-Elected Providers​

The platform gives the Customer access to a catalogue of Models and Skills served by different third-party providers. Such a provider Processes Personal Data only where the Customer has enabled the corresponding Model, Skill or feature in its Workspace. By enabling it, the Customer instructs Subgen AI to transmit the corresponding data to that provider.

Section 2 of the Sub-processors page identifies the providers that the Customer may elect to engage in this way, and the feature each one supports.

The Customer is responsible for determining, before enabling a Model, Skill or feature, whether the corresponding provider is compatible with the Customer's own obligations under Chapter V of the GDPR. The Customer may restrict its Workspace to features whose providers Process Personal Data within the European Economic Area.

7.3. Customer-Configured Destinations​

Where the Customer uses a feature described in clause 6.5 to transmit data to a destination that the Customer itself specifies, the Customer determines both the recipient and the location of any resulting Processing. The Customer is responsible for the basis of any transfer outside the European Economic Area that results.

7.4. Location of Processing and use of Customer data​

Where Processing takes place. The platform, the Customer's Inputs and Outputs and the Customer's account data are hosted within the European Economic Area. Section 1 of the Sub-processors page states, for each Platform Sub-processor, the region in which it Processes Personal Data and the basis for any transfer outside the European Economic Area.

Model providers. Where the Customer enables a Model, Skill or feature served by a third-party provider, the corresponding data is Processed by that provider in the region identified for it. The Customer may restrict its Workspace to features whose providers Process Personal Data within the European Economic Area, as set out in clause 7.2.

No training on Customer data. Subgen AI does not use the Customer's Inputs or Outputs to train or fine-tune its Models. Where the Customer enables a Model served by a third-party provider, that provider's own terms govern whether it does so; those providers are identified on the Sub-processors page.

7.5. Standard Contractual Clauses​

Where Subgen AI transfers Personal Data to a Restricted Country and the SCC apply to that transfer, the Parties agree to be bound by the SCC, which are incorporated by reference into this DPA.

8. Audits​

8.1. Audit Rights​

Upon reasonable notice and no more than once per year, Customer may audit Subgen AI's compliance with this DPA by:

  • Requesting documentation and certifications
  • Conducting on-site audits during regular business hours
  • Using an independent auditor bound by confidentiality obligations

8.2. Audit Process​

  • Customer must provide at least 30 days' notice
  • Audits must not unreasonably interfere with Subgen AI's operations
  • Customer bears all audit costs
  • Audit findings must be shared with both Parties

9. Return or Deletion of Personal Data​

9.1. End of Services​

Upon termination of Services, at the choice of the Customer notified in writing before termination or within thirty (30) days after it, Subgen AI shall:

  • Return Personal Data to the Customer in a commonly used, machine-readable format; or
  • Delete all Personal Data from its systems.

In the absence of a choice by the Customer within that period, Subgen AI shall delete the Personal Data. Subgen AI shall thereafter delete all existing copies, subject to the retention period in clause 9.2 and save where storage is required by Union or Member State law. Subgen AI shall ensure that Sub-processors comply with the same requirement.

9.2. Retention Period​

Personal Data will be retained for 30 days after Service termination unless:

  • Longer retention is required by law
  • Customer requests immediate deletion
  • Specific retention periods are defined for individual Serenity* Star platforms

10. Term and Termination​

10.1. Duration​

This DPA shall commence with the Agreement and continue until all Personal Data is deleted or returned to Customer.

10.2. Survival​

Obligations relating to confidentiality, liability, and dispute resolution survive termination.

11. Limitation of Liability​

11.1. Liability Cap​

The total aggregate liability of either Party under this DPA shall be subject to the limitations set forth in the Agreement.

11.2. Exclusions​

Liability caps do not apply to:

  • Willful misconduct or gross negligence
  • Breach of confidentiality obligations
  • Violations of Data Protection Laws

The liability framework specifically considers the diverse services within the Serenity* Star ecosystem and provides appropriate protection for both Parties while ensuring compliance with data protection regulations.

12. Compliance with Laws and Regulations​

12.1 Compliance Framework​

Subgen AI shall maintain a comprehensive compliance framework covering:

  • EU AI Act compliance
  • GDPR requirements
  • Industry-specific regulations
  • Local data protection laws

12.2 Documentation and Records​

Both parties shall maintain required documentation including:

  • Records of processing activities
  • Impact assessments
  • Security incident logs
  • Compliance certifications

13. Changes to this DPA​

13.1 Modification Process​

  • Subgen AI may modify this DPA with 30 days' notice
  • Material changes require Customer consent
  • Changes required by law take immediate effect
  • Updates will be communicated via email and platform notifications

13.2 Objection Rights​

  • Customers may object to material changes within 15 days
  • If no agreement is reached, Customer may terminate Services

14. Dispute Resolution​

14.1 Governing Law​

This DPA is governed by the laws of Spain, without regard to its conflict of law principles.

14.2 Jurisdiction​

The courts of Valencia, Spain shall have exclusive jurisdiction over any disputes.

14.3 Dispute Process​

  1. Informal resolution attempt required
  2. Mediation through agreed third party
  3. Legal proceedings as last resort

Exhibit 1 - Description of the Processing​

Subgen AI may update the description of the Processing from time to time to reflect new Services, features or functionality within the Serenity* Star ecosystem.

1. Serenity* Star​

A. List of the Parties

  • Data Controller: The Customer
  • Data Processor: Subgen AI
  • Subgen AI privacy contact: [email protected]

B. Description of the Processing

Categories of Data Subjects:

  • The Customer
  • The Authorized Users
  • End-Users
  • Any other natural person whose Personal Data is used by the Customer or the Authorized User as User Data

Categories of Personal Data:

  • Account data (professional contact details, organization name, Subgen AI User ID etc.)
  • API Keys (where applicable)
  • Any Personal Data included in the User Data
  • Support request data

Special categories of Personal Data:

  • None. Customer shall not process sensitive data under this DPA without prior written agreement.

Nature of the Processing:

  • Generation of AI model outputs
  • Model fine-tuning and customization
  • User authentication and authorization
  • Service delivery and optimization

2. Serenity* AI​

A. List of the Parties

  • Data Controller: The Customer
  • Data Processor: Subgen AI
  • Subgen AI privacy contact: [email protected]

B. Description of the Processing

Categories of Data Subjects:

  • The Customer
  • The Authorized Users
  • Enterprise users
  • Support staff

Categories of Personal Data:

  • Account data
  • Usage patterns and interaction data
  • Corporate workflow data
  • Training data for specialized agents

Common Processing Elements​

Duration of Processing:

  • For the term of the Agreement

Frequency of Processing:

  • Continuous, as required for service delivery

Nature and Purpose of Processing:

  • To provide and maintain the Serenity* Star services
  • To ensure security and compliance
  • To provide customer support
  • To improve and optimize services

Type of Personal Data:

  • As specified for each platform above
  • No special categories of data unless explicitly agreed

Retention Periods:

  • Active processing: Duration of the Agreement
  • Post-termination: 30 days unless otherwise specified
  • Backup retention: Up to 90 days
  • Compliance data: As required by applicable laws

Technical and Organizational Security Measures:

  • As detailed in Exhibit 2 of this DPA

Exhibit 2 - Technical and Organizational Measures​

1. General Security Architecture​

1.1 Infrastructure Security

  • Multi-layered security architecture
  • Regular security audits and assessments
  • Continuous monitoring and threat detection
  • Automated security patching and updates

1.2 Access Control Systems

  • Role-based access control (RBAC)
  • Multi-factor authentication (MFA)
  • Privileged access management
  • Regular access reviews and audits

1.3 Network Security

  • Network segmentation
  • Encrypted communications
  • Intrusion detection/prevention systems
  • DDoS protection

2. Platform-Specific Security Measures​

2.1 Serenity* Star

  • Model isolation and sandboxing
  • Secure API endpoints
  • Training data protection
  • Model access controls

2.2 Serenity* AI

  • Enterprise-grade security
  • Secure SSO integration
  • Data loss prevention
  • Workspace isolation

3. Data Protection Measures

3.1 Encryption

  • Data at rest: AES-256
  • Data in transit: TLS 1.2 / TLS 1.3
  • Key management system
  • Regular encryption updates

3.2 Data Backup and Recovery

  • Automated backup systems
  • Geographic redundancy
  • Regular recovery testing
  • Backup encryption

3.3 Data Minimization

  • Purpose limitation controls
  • Data retention policies
  • Automated data cleanup
  • Privacy by design implementation

4. Organizational Security Measures

4.1 Security Training

  • Regular employee training
  • Security awareness programs
  • Phishing simulations
  • Compliance education

4.2 Incident Response

  • 24/7 security team
  • Incident response plan
  • Regular drills and updates
  • Stakeholder communication protocols

4.3 Physical Security

  • Data center security
  • Office access controls
  • CCTV monitoring
  • Visitor management
Last updated on