Data Processing Agreement
Effective October 25, 2026
1. Scope and Parties
This Data Processing Agreement ("DPA") is between the customer that has accepted the OKiDO Terms of Service ("Customer") and Roborian, Inc., a Delaware corporation ("Roborian"). It forms part of the Terms and applies whenever Roborian processes Customer Personal Data on the Customer's behalf in providing the OKiDO platform (the "Service"). It meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and the Swiss Federal Act on Data Protection, as applicable.
2. Definitions
- Customer Personal Data means personal data that the Customer, its users, or its AI agents submit to or create in the Service, and that Roborian processes on the Customer's behalf.
- Sub-processor means a third party that Roborian engages to process Customer Personal Data.
- Standard Contractual Clauses or SCCs means the clauses adopted by European Commission Implementing Decision (EU) 2021/914.
- Terms such as controller, processor, personal data, processing, data subject, and personal data breach have the meanings given in the GDPR.
3. Roles and Instructions
The Customer is the controller, or a processor acting for its own customers, of Customer Personal Data. Roborian is a processor, or a sub-processor where the Customer is itself a processor. Roborian processes Customer Personal Data only on the Customer's documented instructions, which are this DPA, the Terms, and the way the Customer and its users configure and use the Service (including the processes, agents, approval rules, and integrations they set up), unless the law requires otherwise. In that case Roborian informs the Customer before processing, unless the law prohibits this. Roborian tells the Customer promptly if, in its opinion, an instruction infringes data protection law.
The Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis for the personal data it brings into the Service and informing data subjects.
4. Details of the Processing
| Subject matter and duration | Providing the Service to the Customer, for the term of the Customer's subscription and the deletion period in section 12. |
|---|---|
| Nature and purpose | Hosting, storing, organizing, displaying, transmitting, and otherwise processing Customer Personal Data to run the Customer's processes, projects, and tasks; to let AI agents and AI assistants carry out steps the Customer defines; to send notifications and emails; to keep audit records; and to provide support. |
| Categories of data subjects | The Customer's users and staff, and any people whose data the Customer puts into the Service, such as its clients, suppliers, candidates, or other contacts. |
| Types of personal data | Names, contact details, account and role information, work content (tasks, documents, comments, form submissions, files, recordings), AI conversation content and agent action records, and usage and audit logs. The Customer decides what other personal data it adds. |
| Special categories | The Service is not designed for special categories of personal data. The Customer must not add them unless it has assessed that this is lawful and the measures in the Annex are appropriate. |
5. Confidentiality and Security
Roborian ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality. Roborian implements and maintains the technical and organizational measures described in the Annex to this DPA, which are designed to provide a level of security appropriate to the risk, as required by Article 32 GDPR. Roborian may update these measures, provided the overall level of protection does not decrease.
6. Sub-processors
The Customer gives Roborian general authorization to engage the sub-processors listed on our Sub-processors page. Roborian updates that page at least 30 days before a new sub-processor starts processing Customer Personal Data. The Customer may object to a new sub-processor on reasonable data protection grounds within that period by writing to [email protected]. The parties will then discuss the objection in good faith; if they cannot resolve it, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.
Roborian imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible to the Customer for its sub-processors' performance of those obligations.
7. International Transfers
The Service is hosted by OVHcloud in France (EU). Roborian is established in the United States, and some sub-processors, including the AI providers, are located there. To the extent Customer Personal Data from the EU/EEA is transferred to Roborian or onward to a sub-processor in a country without an adequacy decision, the SCCs apply and are incorporated into this DPA by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. For the SCCs:
- Clause 7 (docking clause) applies.
- Clause 9(a): option 2 (general written authorization) applies, with the notice period in section 6 of this DPA.
- The optional wording in Clause 11(a) does not apply.
- Clause 17: the SCCs are governed by the law of Ireland.
- Clause 18: disputes are resolved by the courts of Ireland.
- Annexes I and II of the SCCs are completed by section 4 of this DPA, the Annex to this DPA, and the Sub-processors page. The competent supervisory authority is determined under Clause 13.
For transfers from the UK, the International Data Transfer Addendum issued by the UK Information Commissioner applies; for transfers from Switzerland, the SCCs apply with the adjustments required by Swiss law. Where a recipient is certified under the EU-U.S. Data Privacy Framework or its UK and Swiss extensions, that certification may be used instead.
8. AI Features
When the Customer uses AI features, Roborian sends the prompts and the context needed for the request to the AI providers listed on the Sub-processors page, only to produce the response or carry out the agent step. Roborian does not use Customer Personal Data to train AI models, and under their API terms the AI providers do not use it to train theirs. AI agents act within the approval rules the Customer sets, and every agent action is recorded in the Service. How OKiDO is classified under the EU AI Act is set out on our EU AI Act page.
9. Assistance
Taking into account the nature of the processing, Roborian assists the Customer with appropriate technical and organizational measures in responding to requests from data subjects exercising their rights, and with the Customer's obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments, and prior consultation), using the information available to it. If Roborian receives a request directly from a data subject about Customer Personal Data, it refers the data subject to the Customer.
10. Personal Data Breaches
Roborian notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Roborian provides further information as it becomes available and takes reasonable steps to contain and remedy the breach.
11. Information and Audits
Roborian makes available the information reasonably necessary to demonstrate compliance with this DPA, including the records the Service keeps and written answers to reasonable security questionnaires. If that information is not sufficient, the Customer may audit Roborian's compliance once a year, or after a personal data breach, with at least 30 days' written notice, during business hours, at the Customer's cost, and subject to reasonable confidentiality obligations. An audit must not give access to other customers' data.
12. Return and Deletion
The Customer can export its data while its account is active and may ask Roborian for an export at [email protected]. When the Customer deletes its organization or account, the related Customer Personal Data is deleted from the Service. Within 30 days after the Service ends, Roborian deletes any remaining Customer Personal Data, unless the law requires it to be kept. Copies in backups are deleted as those backups expire in the normal rotation and are protected until then.
13. Liability and Precedence
Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow liability to be limited. If this DPA conflicts with the Terms, this DPA prevails on the protection of personal data. If the SCCs apply and conflict with this DPA, the SCCs prevail.
14. Contact
Questions about this DPA, or requests for a signed copy: [email protected].
Annex: Technical and Organizational Measures
- Encryption: data is encrypted in transit with TLS and at rest. Third-party credentials are encrypted with AES-256-GCM using a per-deployment key, and passwords are hashed with bcrypt.
- Access control: role-based access control with isolation between organizations, multi-factor authentication, and authentication tokens in HttpOnly, Secure, SameSite cookies.
- Infrastructure: containerized and access-controlled, with encrypted database connections and encrypted backups. User-defined and AI-generated code runs in sandboxed containers with timeouts and resource limits.
- AI governance: every AI agent action passes a policy check and the approval rules the Customer sets, and is recorded with the tool used, inputs, result, approver, and model.
- Logging: audit events record who did what and when, are protected against change from within the Service, and are kept for up to two years.
- People: access to production systems is limited to staff who need it, who are bound by confidentiality.