Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between your company ("Customer") and Capstan. It applies whenever Capstan processes personal data in your workspace for you. You don't need to sign it separately. If your company needs a countersigned copy, ask legal@capstan.example and we'll send one within two working days.

1. Roles

The Customer is the controller of personal data in its workspace. Capstan is the processor. Capstan's subprocessors are listed on the subprocessors page.

2. What's processed

• Purpose: running the Customer's agents, storing their runs and traces, and supporting the Customer.
• Personal data: whatever the Customer's agents read and write in its connected tools, such as names, email addresses, order and ticket details, and the names of the Customer's own users.
• People concerned: the Customer's users, and the Customer's own customers, employees and contacts whose data passes through its tools.
• Duration: for as long as the Terms apply, and the deletion period after them.

The Customer must not send special category data (such as health data) through Capstan unless both sides have agreed in writing.

3. Capstan's commitments

Capstan will:

1. process personal data only on the Customer's documented instructions, which include the Terms, this DPA and how the Customer configures its agents;
2. make sure everyone with access is bound to confidentiality;
3. keep the security measures described on the security page, including encryption in transit and at rest, scoped access, and logging;
4. not use the Customer's data to train AI models, and require the same of every model provider;
5. help the Customer answer requests from people exercising their rights, and with impact assessments where needed;
6. delete or return the data when the Terms end, as set out in section 8.

If Capstan believes an instruction breaks data protection law, it will tell the Customer.

4. Subprocessors

The Customer authorises the subprocessors on the subprocessors page. Capstan gives at least 30 days' notice by email before adding or replacing one. The Customer can object on reasonable data protection grounds; if we can't resolve it, the Customer may end the affected service and get a refund for the unused period.

Capstan remains responsible for its subprocessors and holds each of them to terms that protect data at least as well as this DPA.

5. International transfers

Data is stored in the region the Customer chooses (the US, or the EU on Business and Enterprise plans). Where personal data moves out of the EU, EEA, UK or Switzerland, the EU Standard Contractual Clauses (module two, and module three for subprocessors) and the UK Addendum apply, and are part of this DPA.

6. Personal data breaches

Capstan will tell the Customer without undue delay, and within 48 hours of confirming a personal data breach. The notice will say what happened, what data and people are affected, what we've done, and who to contact. We'll keep the Customer updated as we learn more.

7. Audits

Capstan is audited every year against SOC 2 Type II. On request, Capstan shares the latest report and its penetration test summary under a confidentiality agreement, and answers reasonable security questionnaires. If those aren't enough to show compliance, the Customer may audit Capstan once a year, with 30 days' notice, during business hours and at its own cost.

8. Return and deletion

When the Terms end, the Customer can export its data for 30 days. Capstan then deletes the Customer's personal data, including from backups, within a further 35 days, unless the law requires it to keep some. On request, Capstan confirms deletion in writing.

9. Order of precedence

If this DPA and the Terms disagree about personal data, this DPA wins. If the Standard Contractual Clauses and this DPA disagree, the clauses win.