Data Processing Addendum (DPA)

Last updated: January 26, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service and any order form, statement of work, subscription, or other agreement referencing those terms (collectively, the “Agreement”) between:

Customer (“You”) and
Augment d.o.o. (operating as “Eulex”) (“Eulex”, “We”, “Us”)

Privacy contact: [email protected] Security contact: [email protected]

If there is any conflict between this DPA and the Agreement regarding data protection, this DPA controls.

1. Data Processing Roles

As between You and Eulex:

You are the Controller (or “Business” where applicable), and
Eulex is the Processor (or “Service Provider/Processor” where applicable),

processing Customer Personal Data on Your behalf.

2. Processing Purposes

Eulex will process Customer Personal Data as Your Processor:

to provide, maintain, secure, and support the Services;
to monitor service quality and improve accuracy through quality assurance and troubleshooting, including by storing limited logs of prompts and outputs where the Customer or an Authorized User has enabled prompt logging;
to prevent fraud, abuse, and security incidents; and
to comply with legal obligations,

and in accordance with the Instructions.

3. Details of Processing

The subject matter, nature, purpose, categories of Personal Data, categories of data subjects, and duration of Processing are described in Exhibit A.

4. Definitions

“Customer Data” means data submitted to the Services by or on behalf of Customer, including account and usage data linked to an identified or identifiable person.
“Customer Content” means prompts, text, documents, files, and other content provided by Customer or Authorized Users through the Services.
“Customer Personal Data” means any Personal Data contained in Customer Data and/or Customer Content that Eulex Processes as a Processor.
“Data Protection Law” means applicable privacy and data protection laws and regulations, including (where applicable) GDPR, UK GDPR, Swiss data protection law, and applicable U.S. state privacy laws.
“Instructions” means Customer’s documented instructions, including Customer’s configuration and use of the Services, the Agreement, and documented support requests.
“Personal Data Breach” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
“Subprocessor” means a third party engaged by Eulex to Process Customer Personal Data on Eulex’s behalf.
“Google Cloud / Vertex AI” means Google Cloud Platform services, including Vertex AI, used by Eulex to provide certain AI-enabled functionalities of the Services.

5. Processing Requirements (Processor Obligations)

As a Processor, Eulex will:

Process on Instructions. Process Customer Personal Data only on Your behalf, in accordance with the Instructions, and only as necessary for performance of the Services.
Confidentiality. Ensure persons authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations.
Inability to Comply. Notify You promptly if Eulex cannot comply with this DPA.
Unlawful Instructions. Inform You if Eulex reasonably believes an Instruction infringes Data Protection Law (to the extent permitted by law).

6. Subprocessors

Eulex will:

engage the organizations or persons listed at https://eulex.ai/legal/subprocessors (the “Subprocessor List”) as necessary to perform the Services. You consent to Eulex’s use of its existing Subprocessors and grant Eulex a general written authorization to engage Subprocessors to perform all or part of the processing activities required to provide the Services;
if You subscribe to receive email notifications as described in the Subprocessor List, notify You at least 30 days before any addition or replacement of a Subprocessor becomes effective;
permit You to object to a new Subprocessor on reasonable grounds relating to protection of Customer Personal Data by emailing [email protected] within 15 days of receiving notice (an “Objection”);
work with You in good faith to address an Objection through one of the following options:
- (i) provide the affected feature without the Subprocessor;
- (ii) implement commercially reasonable mitigation;
- (iii) enable You to disable the affected feature; or
- (iv) allow You to stop providing the affected Customer Personal Data for that feature; and
enter into written agreements with each Subprocessor imposing data protection obligations no less protective than this DPA. Eulex remains responsible for Subprocessors’ performance to the extent required by Data Protection Law.

Google Cloud / Vertex AI. Without limiting the general authorization above, Customer acknowledges that Eulex may use Google Cloud (including Vertex AI) as a Subprocessor to provide AI-enabled functionalities (including model inference) as described in Exhibit A and in the Subprocessor List.

Vertex AI Regional Processing. Eulex will configure its use of Google Cloud / Vertex AI for AI-enabled functionalities so that model inference requests containing Customer Content are processed via an EU region endpoint (currently including europe-west1 or europe-west4, or a successor EU region made available by Google for the relevant functionality), and Eulex will not use Google’s “global” endpoint for such inference requests. Eulex may deviate from the above only where (i) required to maintain the security or functionality of the Services, (ii) requested or configured by Customer, or (iii) required by law; in such cases, Eulex will use commercially reasonable efforts to minimize any cross-border data access and will treat any resulting cross-border processing as subject to Section 12 (International Data Transfers).

If an Objection cannot be resolved within 30 days after Eulex receives it, either party may terminate the affected order/subscription/feature for cause and Eulex will refund any prepaid, unused fees for the terminated portion covering periods after termination.

7. Customer Notices (Authority Requests and Data Subject Requests)

To the extent legally permitted, Eulex will promptly inform You if Eulex receives:

a legally binding request for disclosure of Customer Personal Data;
a notice, inquiry, or investigation by a supervisory authority relating to Customer Personal Data; or
a complaint or request from a data subject regarding Customer Personal Data (“Data Subject Request”).

Except to confirm receipt, request clarification, or identify the data subject, Eulex will not respond to a Data Subject Request without Your prior written authorization unless required by law.

8. Personal Data Breach

Upon becoming aware of a Personal Data Breach involving Customer Personal Data, Eulex will notify You without undue delay and provide reasonably available information necessary for You to meet Your breach notification obligations under Data Protection Law.

9. Assistance to Customer and Audits

Upon Your written request, Eulex will provide reasonable assistance, taking into account the nature of Processing and information available to Eulex, with:

responding to Data Subject Requests;
preparing DPIAs and consulting with supervisory authorities where required; and
providing information reasonably necessary to demonstrate compliance with Processor obligations.

Audit rights: Audits are limited to what is required by Data Protection Law and subject to reasonable confidentiality and security conditions. Eulex may satisfy audit requests by providing security documentation or independent audit reports where available. Any on-site audit requires reasonable prior notice and is limited in scope and frequency (no more than once per 12 months unless a material incident justifies more).

10. Required Processing

If Eulex is required by applicable law to Process Customer Personal Data outside Your Instructions, Eulex will (to the extent legally permitted) inform You in advance.

11. Security

Eulex will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, or damage. A high-level description is set out in Exhibit B.

12. International Data Transfers (EEA/UK/Switzerland)

Where Customer Personal Data protected by EEA/UK/Swiss law is transferred to a country without an adequacy decision (a “Restricted Transfer”), the parties will ensure appropriate safeguards are in place, including (as applicable) EU Standard Contractual Clauses and the relevant UK and/or Swiss add-ons/adaptations.

Vertex AI EU Regional Processing. Eulex will configure its use of Google Cloud / Vertex AI so that model inference requests containing Customer Content are processed in an EU region endpoint (as described in Section 6). Eulex will not knowingly route such inference requests via a “global” endpoint.

Changes and Transfers. If Eulex becomes aware of a material change in its Subprocessor arrangements or technical configuration that would reasonably be expected to result in (or materially increase the likelihood of) a Restricted Transfer for AI-enabled processing on Google Cloud / Vertex AI, Eulex will provide notice via the Subprocessor notification mechanism described in Section 6 (where applicable) and will ensure that an applicable transfer mechanism is in place prior to such Restricted Transfer.

If You request, Eulex will provide a separate data transfer addendum (including required annexes) to document the applicable transfer mechanism(s) for any Restricted Transfer.

13. Deletion and Return

Within 30 days after termination or expiration of the Services (or upon Your reasonable request), Eulex will delete or return Customer Personal Data (including instructing Subprocessors to do the same), unless retention is required by law.

14. Customer Obligations

You represent and warrant that:

You have all necessary rights, consents, and lawful bases to provide Customer Personal Data to Eulex and to authorize Eulex to Process it as described in the Agreement and this DPA;
Your Instructions comply with Data Protection Law; and
You will use secure and appropriate mechanisms to provide Customer Personal Data to Eulex and will configure access controls responsibly.

15. Governing Law and Jurisdiction

This DPA (and any non-contractual obligations arising out of or in connection with it) is governed by the laws of Croatia, excluding its conflict of law rules.

The parties agree that the courts in Zagreb, Croatia shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this DPA, except where mandatory applicable law provides otherwise (including any mandatory rights of data subjects under applicable Data Protection Law).

Exhibit A — Details of Processing

Subject matter: Provision of the Eulex SaaS services, including research, drafting, analysis, web retrieval (if enabled), collaboration, administration, and support.

Nature of Processing: collection, recording, organization, structuring, storage, retrieval, use, disclosure to Subprocessors where necessary, deletion.

Purpose of Processing: provide, secure, maintain, and support the Services; prevent fraud/abuse; comply with legal obligations; and perform quality assurance and troubleshooting as described below.

AI-enabled processing (Google Cloud / Vertex AI): Where Customer enables or uses AI-enabled features, Eulex may process Customer Content and related Customer Personal Data to provide such features using Google Cloud services, including Vertex AI, as a Subprocessor, including for model inference and related functionality. Eulex will configure such model inference processing to use an EU region endpoint (as described in Section 6 and Section 12) and will not use a global endpoint for inference requests containing Customer Content, subject to the limited exceptions set out in Section 6.

Prompt Logging (Quality Assurance, if enabled): Where the Customer or an Authorized User enables “prompt logging” in their profile or account settings, Eulex may store and review logs of Customer Content (including prompts and model outputs) solely for quality assurance and troubleshooting of the Services. If prompt logging is disabled, Eulex will not store such prompt/output logs.

Retention and deletion: Prompt/output logs are retained for 30 days and are automatically deleted thereafter, unless longer retention is required to investigate security incidents, prevent abuse, or comply with law.

Access controls: Access to prompt/output logs is restricted to specifically authorized personnel on a need-to-know basis, protected by multi-factor authentication (2FA/MFA), and subject to appropriate monitoring/audit logging.

Web retrieval (if enabled) — Prompt Navigator controls: For web retrieval features, Eulex may use web retrieval providers listed in the Subprocessor List. The Services may automatically determine, based on the user’s prompt, whether web retrieval would be useful. Before any web retrieval request is sent, the user is presented with a toggle in Prompt Navigator and may disable web search. When disabled, no web retrieval requests are sent. When enabled, Eulex sends only an AI-revised and summarized query designed to remove personal data where feasible prior to transmission.

Categories of Personal Data: names, contact details, account identifiers, user activity linked to an identified/identifiable person, and any Personal Data included in Customer Content.

Categories of data subjects: Customer users, employees/contractors, Customer end-clients, and individuals referenced in Customer Content.

Duration: term of the Agreement plus deletion/return period, unless legally required retention applies.

Exhibit B — Security Measures (High Level)

Eulex maintains an information security program designed to include measures such as:

access controls and authentication; least privilege;
encryption in transit (and at rest where applicable);
logging and monitoring;
vulnerability management and patching;
incident response procedures;
secure development practices;
personnel confidentiality and security training; and
Subprocessor due diligence and contractual security obligations;
role-based access controls for prompt/output logs (where enabled), including MFA/2FA;
audit logging and monitoring of administrative access to such logs;
automated deletion controls supporting 30-day retention for prompt/output logs (where enabled).

Appendix 1 — U.S. State Privacy Addendum (If Applicable)

To the extent applicable under U.S. state privacy laws, Eulex will:

Process Customer Personal Data only for the purposes described in this DPA and the Agreement;
not “sell” or “share” such data as those terms are defined under applicable law;
not retain, use, or disclose such data outside the direct business relationship with Customer except as permitted by law; and
support reasonable steps to remediate unauthorized use consistent with applicable law.