Template for signature with a client. Do not process shared client data until this DPA is signed.

Template DPA — SentinelAI – Data Processing Agreement (GDPR / UK GDPR Art. 28)

Version 6 November 2026. Part of the SentinelAI Service terms (section 7). Applies from the start of agency white-label (phase 2) or any other paid service where the Client is the controller and we process personal data on the Client's instructions. Do not process shared client data until this DPA is signed.

Controller (Client): [CLIENT LEGAL NAME], [REGISTERED ADDRESS], contact [NAME, EMAIL].

Processor (we): Joao Jorge, CX Postal 556, 8550-152 Marmelete, Portugal, teamaijj@mail.grokbot.com.

1. Subject and duration. We process data only to provide SentinelAI operational status views and digests for the Client's (or the Client's customers') AI agents, chatbots or automation bots, from events and figures the Client supplies or authorises. The agreement lasts for the contract plus the deletion period in clause 9.

2. Data. Agent or bot labels, status events, run and error counts, last-run timestamps, optional cost/usage figures the Client pastes or connects, and contact details needed to deliver the service. Personal data may include staff work names, emails or usernames if the Client includes them in events. Data subjects: the Client's staff and, where white-label, the Client's customers and people named in events in a work capacity. No special-category data (Art. 9), no end-user chat content beyond what is strictly needed for status, no security/forensic dumps marketed as threat detection, no HR/salary/disciplinary files, no card or bank data, no passwords. The Client minimises and removes such content before sending.

3. Instructions. We process only on the Client's documented written instructions (this agreement and emails), including on transfers. We tell the Client if an instruction seems unlawful, or if the law requires other processing (unless the law forbids telling).

4. Confidentiality. Anyone we allow to process the data is bound by confidentiality.

5. Security (Art. 32). Encryption in transit and at rest where available, MFA and least-privilege access, an access log, no copies on personal devices or in chat tools beyond what is needed to provide the service, and no use of the data to train AI models. SentinelAI is an operational dashboard, not a certified security control.

6. Sub-processors. The Client authorises those in Annex A. We give notice by email at least 14 days before any addition or change; the Client may object and, if we cannot meet the objection, end the contract without penalty. We impose the same data protection duties on each sub-processor and remain responsible for them.

7. Data-subject rights. We help the Client, as far as possible, to answer requests (access, erasure etc.) and pass on any request we receive without delay.

8. Breaches. We notify the Client without undue delay and in any case within 24 hours of becoming aware of a personal data breach, with the facts known, so the Client can meet its Art. 33 duty. We also help with Art. 32–36 duties as needed.

9. Deletion. Within 30 days after the contract ends (or within 14 days after a free pilot ends) we delete the uploads, working files and all copies we hold for that Client, and confirm this by email. The Client can ask us to delete a dataset earlier at any time.

10. Audit. On request we give the Client the information needed to show compliance with Art. 28 and allow reasonable audits, with reasonable notice.

11. Transfers. No transfer outside the EU/UK unless covered by an adequacy decision, EU SCCs, the UK IDTA or Addendum, or DPF certification.

12. Law. Portuguese law applies; courts of the Comarca de Lisboa. Mandatory UK GDPR duties still apply to UK clients.

Annex A – Sub-processors

Note: this public browser demo calculates on the user's device from fictional data and does not send events to these sub-processors. Annex A covers the hosted site and any paid / white-label processing path.