Last Updated: October 19, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between the entity identified as the customer ("Controller", "you") and PartnerAPI ("Processor", "we", "us"), and governs the processing of personal data by PartnerAPI on your behalf.
This DPA is entered into pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, where applicable, the UK GDPR.
2.1. You are the Controller and PartnerAPI is the Processor with respect to Personal Data processed in connection with the Services.
2.2. This DPA applies to all Personal Data that the Processor processes on behalf of the Controller under the Agreement.
2.3. The duration of processing is the term of the Agreement, plus any post-termination period required for deletion or return of Personal Data as described in Section 12.
3.1. The Processor processes Personal Data solely to provide the Services under the Agreement. Processing activities include:
The following categories of Personal Data may be processed depending on the Controller's use of the Services:
| Category | Examples |
|---|---|
| Identity data | Names, email addresses, profile images |
| Contact data | Email addresses, phone numbers |
| Authentication data | OAuth provider identifiers, session tokens |
| Legal profile data | Legal name, date of birth, consent records |
| Log data | IP addresses, HTTP request/response metadata (PII sanitised at ingestion) |
| Document content | Content of documents uploaded by the Controller (may contain Personal Data at the Controller's discretion) |
| Conversation data | User messages and AI responses in agent sessions |
| Form response data | Responses to Controller-defined forms (may contain Personal Data at the Controller's discretion) |
| Usage and billing data | API usage metrics, subscription status, token consumption |
| Audit data | User actions, IP addresses, user-agent strings |
6.1. Documented instructions. The Processor shall process Personal Data only on documented instructions from the Controller, including with respect to transfers of Personal Data to a third country, unless required to do so by EU or Member State law — in which case the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law.
6.2. Confidentiality. The Processor shall ensure that all persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
6.3. Security. The Processor shall implement and maintain appropriate technical and organisational measures as described in Section 7.
6.4. Subprocessors. The Processor shall comply with the conditions for engaging Subprocessors as set out in Section 8.
6.5. Data subject assistance. The Processor shall assist the Controller in fulfilling its obligations to respond to Data Subject requests as set out in Section 10.
6.6. Compliance assistance. The Processor shall assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to the Processor.
6.7. Deletion and return. At the end of the provision of Services, the Processor shall delete or return Personal Data as set out in Section 12.
6.8. Audit. The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits as set out in Section 13.
The Processor implements and maintains the following technical and organisational measures to ensure a level of security appropriate to the risk:
Encryption:
Tenant data isolation:
PII sanitisation:
Access control:
Audit logging:
Infrastructure:
8.1. General authorisation. The Controller provides general written authorisation for the Processor to engage Subprocessors to perform specific processing activities. The current list of Subprocessors is available at partnerapi.com/legal/subprocessors.
8.2. Notification of changes. The Processor shall notify the Controller at least 30 days before adding or replacing a Subprocessor, giving the Controller the opportunity to object. Notification will be sent to the email address associated with the Controller's account.
8.3. Right to object. If the Controller objects to a new Subprocessor on reasonable data protection grounds within the 30-day notice period, the parties shall discuss the concern in good faith. If a resolution cannot be reached, the Controller may terminate the affected Services without penalty.
8.4. Flow-down obligations. The Processor shall impose on each Subprocessor, by way of a written contract, data protection obligations no less protective than those set out in this DPA. The Processor remains fully liable to the Controller for the performance of each Subprocessor's obligations.
8.5. Current Subprocessors:
<!-- SUBPROCESSORS:START (auto-generated from docs/gdpr/subprocessors.yaml — run pnpm subprocessors:generate after editing the YAML) -->| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| AWS (S3, SES) | Object storage, email delivery | EU (eu-west-1, eu-north-1) | N/A (EU) |
| Render | Managed application hosting and managed database — runs the PartnerAPI API and its background workers, and hosts the primary application database. Render operates on AWS infrastructure. | EU (Frankfurt) — application services, background workers and managed Postgres | EU-US DPF + SCCs + DPA |
| Vercel | Frontend application hosting — serves the public tenant landing pages and the authenticated partner portal, including sign-in and server-side rendering of portal pages. Personal data passes through Vercel in transit and in server-render memory; the web tier holds no database of its own. Vercel operates on third-party cloud infrastructure. | US (Vercel Inc.) — no deployment region pinned in our configuration | SCCs + DPA |
| Sentry | Error tracking and monitoring | EU | N/A (EU) |
| Grafana Cloud (Loki) | Platform service-log storage and querying — PartnerAPI's own observability only. Customer API logs are not stored here; they live in PartnerAPI's own log infrastructure in AWS eu-north-1. | EU | SCCs |
| OpenAI | AI embedding generation, inference, and content moderation for partner-uploaded knowledge documents | US | SCCs + DPA |
| Chroma Inc. (Chroma Cloud) | Vector embedding storage for tenant document content (per-tenant collections used for AI knowledge retrieval) | EU (GCP europe-west1, Belgium) — Chroma Inc. is US-based | SCCs + DPA (DPA under review) |
| Vercel (v0) | Generative AI for tenant landing pages — when a tenant admin asks for a landing page to be generated or changed, the prompt, any reference-page content and the page's current HTML are sent to Vercel v0 to produce the new page. Personal data reaches it only where the tenant's own prompt or page copy contains it. | US (Vercel Inc.) | SCCs (pending acceptance) (DPA under review) |
| Vercel (Sandbox) | Isolated, single-use compute for automated dependency upgrades — when a customer enables upgrade runs, a copy of the connected code repository (including commit author names and email addresses in its history) is built and updated inside a temporary virtual machine with restricted network access. Not yet in use; listed in advance. | US (Vercel Inc., iad1 region) | SCCs + DPA |
| Slack | Notification delivery to your own Slack workspace, and the Slack interface to the assistant. Notification content, assistant conversations held in Slack, and the Slack account identifier used to route them are processed by Slack. | US | SCCs + EU-US DPF + DPA |
| Zoom (Zoom Scheduler) | Meeting booking for the final step of the partnership-map claim flow — the email address of someone claiming a company profile is passed to Zoom's scheduler so the booking form arrives prefilled, and Zoom records the booking details. | US | SCCs + EU-US DPF + DPA |
| Mailjet | Transactional email delivery | EU | N/A (EU) |
| Stripe | Payment processing and billing | US/EU | SCCs + DPA |
| Atlassian (Confluence + OAuth) | OAuth identity provider; Confluence page content ingestion when the Controller enables the Confluence integration | US | SCCs + DPA |
9.1. The Processor stores Personal Data primarily in the European Union: the primary application database is Render-managed Postgres in Frankfurt, and object storage is AWS eu-west-1 (application data plane) and AWS eu-north-1 (customer-log object storage and Loki/EBS supporting infrastructure). Those locations are within the EU/EEA, so no SCCs are required for intra-EU storage as such. Two things follow that this clause states rather than leaves implicit: storage location is not processing location, so see the Location column in §8.5 for where each Subprocessor processes and §9.2 for processing outside the EU/EEA; and where the provider of an EU-located store is itself established outside the EU/EEA, SCCs remain the controlling Article 44–49 instrument, which is why the Transfer Mechanism column in §8.5 names SCCs for such a Subprocessor even where the data sits in the EU.
9.2. Where Personal Data is transferred to, or processed by, a Subprocessor located outside the EU/EEA, the Processor ensures that such transfers are protected by Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914), supplemented by additional technical measures where necessary. The Location column in §8.5 above identifies each Subprocessor's processing location and the Transfer Mechanism column names the instrument relied on, including where a data processing agreement is still under review; §8.5 rather than this clause is the current list, so that the two cannot drift apart.
9.3. The Processor shall inform the Controller if it becomes aware that an international transfer cannot be completed in compliance with applicable data protection law, and shall work with the Controller to identify an alternative solution.
10.1. Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising Data Subject rights under Chapter III GDPR, including:
10.2. The Processor provides automated tools to support the Controller in responding to Data Subject requests, including data export (machine-readable JSON), account deletion, profile rectification, processing restriction, and AI data-processing opt-out.
10.3. If the Processor receives a Data Subject request directly, it shall promptly redirect the request to the Controller, unless otherwise instructed.
10.4. The Processor shall respond to Controller requests for assistance within 10 business days, or sooner where required to meet the Controller's regulatory deadlines.
11.1. The Processor shall notify the Controller without undue delay and no later than 48 hours after becoming aware of a Security Incident affecting the Controller's Personal Data.
11.2. The notification shall include, to the extent available:
11.3. Where it is not possible to provide all information at the same time, the Processor shall provide information in phases without further undue delay.
11.4. The Processor shall co-operate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the Security Incident.
11.5. Notification of a Security Incident shall not be construed as an acknowledgement of fault or liability by the Processor.
12.1. Upon termination or expiry of the Agreement, and upon the Controller's written request, the Processor shall either:
12.2. The Processor shall complete deletion or return within 30 days of receiving the Controller's written instructions, unless EU or Member State law requires further storage.
12.3. Where retention is legally required, the Processor shall inform the Controller of the requirement and limit processing to that which is required by law.
12.4. The Processor shall certify deletion in writing upon the Controller's request.
13.1. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA.
13.2. The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller, subject to the following conditions:
13.3. If the same audit information has been provided to the Controller within the previous 12 months via a third-party audit report (e.g., SOC 2), the Processor may make that report available in lieu of a further audit, provided it reasonably addresses the Controller's concerns.
The Processor has appointed a Data Protection Officer who can be contacted at:
Each party's liability under this DPA shall be subject to the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA limits either party's liability for breaches of its data protection obligations where such limitation is not permitted by applicable law.
16.1. This DPA shall remain in effect for the duration of the Agreement and for as long as the Processor processes Personal Data on behalf of the Controller.
16.2. The Processor may update this DPA from time to time to reflect changes in applicable law or the Services. Material changes will be notified to the Controller at least 30 days in advance. Continued use of the Services after the effective date of changes constitutes acceptance of the updated DPA.
This DPA shall be governed by and construed in accordance with the laws that govern the Agreement, unless otherwise required by mandatory data protection law.
For questions about this DPA or our data protection practices: