Data Processing Agreement
This DPA is incorporated into and forms part of the Terms of Service. It becomes effective when the Customer first submits Experiment Data to the platform.
For procurement purposes, a countersigned PDF version of this DPA is available on request at [email protected].
1. Scope and Purpose
This Data Processing Agreement ("DPA") governs the processing of personal data by AB-Labz on behalf of the Customer in connection with the analysis of Experiment Data submitted to the AB-Labz platform.
This DPA implements the requirements of GDPR Article 28, which requires a binding contract between data controllers and their processors.
2. Roles
AB-Labz acts as a data controller in a separate capacity for personal data relating to the Customer's own authorized users (account data, billing contacts). That processing is covered by the Privacy Policy.
3. Personal Data Processed
| Data category | Source | Retention |
|---|---|---|
| Statistical / behavioral event data (CSV upload) | Customer upload | Deleted at end of analysis session |
| Statistical / behavioral event data (API) | Customer API push | Up to 14 days, then automatically deleted |
| Runner data | Customer infrastructure only | Never transmitted to AB-Labz servers |
The platform is designed to operate on pseudonymized or aggregated data. The Acceptable Use Policy prohibits submission of directly identifiable personal data or special category data without prior written agreement. The Customer is responsible for ensuring submitted data has been appropriately pseudonymized and that its submission is lawful.
Data subjects are the Customer's end users whose behavioral or event data is captured in Experiment Data.
4. Processing Instructions
AB-Labz shall process Experiment Data only on documented instructions from the Customer, which are:
- To perform the statistical analyses and computations requested by the Customer through the platform interface or API.
- To generate AI-powered insights from aggregated analysis results (see AI Data Usage).
- To store Experiment Data for the periods specified in this DPA.
If AB-Labz is required by EU or Member State law to process data for purposes other than those instructed, it will inform the Customer of this legal requirement before processing, unless prohibited by law.
5. Sub-processors
The Customer provides general authorization for AB-Labz to engage the sub-processors listed at Subprocessors. AB-Labz will:
- Impose equivalent data protection obligations on all sub-processors.
- Notify the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance by updating the Subprocessors page and notifying known customers by email.
- Remain liable for the acts and omissions of sub-processors as for its own acts.
The Customer may object to a new sub-processor by contacting [email protected] within 14 days of notification. If the parties cannot resolve the objection, the Customer may terminate the agreement with a pro-rata refund of unused license fees.
6. International Data Transfers
Experiment Data is stored on DigitalOcean infrastructure in Frankfurt, Germany (EU). Administrative access by the Operator from Serbia is covered by Standard Contractual Clauses (SCC Module 2: Controller to Processor). Transfers to US-based sub-processors (Postmark, OpenAI) are also covered by SCC.
Full details are in International Data Transfers. Customers may request a copy of the applicable SCCs by contacting [email protected].
7. Security
AB-Labz implements appropriate technical and organisational measures to protect Experiment Data, as described in Technical & Organisational Measures. These include:
- Encryption of data in transit (TLS) and at rest
- Customer workspace isolation
- Role-based access controls and audit logging
- Automatic deletion of API data after 14 days
- 30-day rolling backup retention
8. Breach Notification
In the event of a personal data breach affecting Experiment Data, AB-Labz will:
- Notify the Customer without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
- Provide sufficient information for the Customer to fulfill its own notification obligations under GDPR Articles 33 and 34.
- Cooperate with the Customer in investigating and mitigating the breach.
See Incident Response for the full process.
9. Data Subject Rights
AB-Labz shall assist the Customer in fulfilling its obligations to respond to data subject rights requests (access, rectification, erasure, portability, objection) relating to Experiment Data.
Given the ephemeral nature of Experiment Data (deleted within 14 days or at session end), most erasure and portability requests will be satisfied automatically. For requests related to data within the retention window, contact [email protected].
10. Deletion and Return of Data
Upon termination of the agreement, AB-Labz will:
- Delete all remaining Experiment Data from active systems within 30 days.
- Purge backup copies containing Experiment Data within the 30-day rolling backup cycle.
- Provide written confirmation of deletion upon request.
Customer Workspace results (analyses, reports, AI insights—not raw Experiment Data) can be exported in JSON format before termination. See Data Export & Offboarding.
11. Audit Rights
The Customer may audit AB-Labz's compliance with this DPA no more than once per year, provided at least 30 days' prior written notice is given. Audits must be conducted during business hours, at the Customer's expense, and must not disrupt the Operator's operations or compromise the security of other customers. AB-Labz may satisfy audit requirements by providing relevant certifications, third-party audit reports, or written responses to reasonable audit questionnaires in lieu of an on-site visit.
12. Confidentiality
AB-Labz ensures that persons authorized to process Experiment Data are bound by appropriate confidentiality obligations.
13. Governing Law
This DPA is governed by the same law as the Terms of Service. Where GDPR applies, its provisions take precedence over any conflicting terms in this DPA.
14. Contact and Countersigned Copies
For questions regarding this DPA, to request a countersigned PDF copy, or to request applicable Standard Contractual Clauses, contact [email protected].