Data Processing Agreement

Last updated: 20 March 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Artanis Ltd ("Processor", "Artanis", "We") and the Customer ("Controller", "You"). This DPA applies to the extent that Artanis processes Personal Data on behalf of the Customer in the course of providing the Service.

This DPA is incorporated automatically when You agree to the Terms of Service. Enterprise customers requiring a countersigned copy may contact privacy@artanis.ai.

1. Definitions

Capitalised terms not defined in this DPA have the meanings given to them in the Terms of Service. In addition:

• "Data Protection Laws" means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation 2016/679), and any other applicable data protection and privacy legislation.
• "Personal Data", "Data Subject", "Processing", "Controller", "Processor", and "Personal Data Breach" have the meanings given in the UK GDPR.
• "Sub-Processor" means any third-party processor engaged by Artanis to process Personal Data on the Controller's behalf.
• "UK IDTA" means the International Data Transfer Agreement issued by the Information Commissioner's Office under Section 119A of the Data Protection Act 2018.

2. Scope and Roles

The Customer is the Controller and Artanis is the Processor with respect to any Personal Data contained within Customer Data submitted to the Service. The details of the processing are set out in Annex 1.

For the avoidance of doubt, Artanis is a Controller in its own right for account data, usage data, and other personal data described in Our Privacy Policy. This DPA does not apply to that processing.

3. Processing Instructions

Artanis shall process Personal Data only on documented instructions from the Controller, including with respect to transfers of Personal Data to a third country, unless required to do so by applicable law. In such a case, Artanis shall inform the Controller of that legal requirement before processing, unless the law prohibits such disclosure.

The Customer's instructions for processing are as set out in the Terms of Service, this DPA, and any subsequent written instructions agreed between the parties. If Artanis believes that an instruction from the Controller infringes Data Protection Laws, Artanis shall promptly notify the Controller.

4. Confidentiality

Artanis shall ensure that all persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to Personal Data is limited to personnel who require access to perform their duties in connection with the Service.

5. Security Measures

Artanis shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the UK GDPR. These measures are described in Annex 2 and include, at a minimum:

• Encryption of Personal Data in transit (TLS 1.2+) and at rest;
• Access controls and authentication mechanisms;
• Regular testing, assessment, and evaluation of the effectiveness of technical and organisational measures;
• Measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems; and
• The ability to restore the availability of and access to Personal Data in a timely manner in the event of a physical or technical incident.

6. Sub-Processing

The Controller provides general written authorisation for Artanis to engage Sub-Processors. The current list of approved Sub-Processors is set out in Annex 3.

Artanis shall:

• Notify the Controller by email at least 30 days before adding or replacing a Sub-Processor, giving the Controller the opportunity to object;
• If the Controller objects on reasonable grounds related to data protection, the parties shall discuss the concern in good faith. If the concern cannot be resolved within 30 days, the Controller may terminate the affected Service by written notice;
• Impose on each Sub-Processor, by way of a written contract, data protection obligations no less protective than those set out in this DPA; and
• Remain fully liable to the Controller for the performance of each Sub-Processor's obligations.

7. Assistance with Data Subject Rights

Taking into account the nature of the processing, Artanis shall assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to Data Subject requests to exercise their rights under Chapter III of the UK GDPR (Articles 15 to 22).

If Artanis receives a request from a Data Subject directly, Artanis shall promptly notify the Controller and shall not respond to the request without the Controller's prior written instructions, unless required to do so by applicable law.

8. Personal Data Breach Notification

Artanis shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Personal Data processed on the Controller's behalf. The notification shall include:

• A description of the nature of the breach, including the categories and approximate number of Data Subjects and Personal Data records affected;
• The name and contact details of Artanis's contact point for further information;
• A description of the likely consequences of the breach; and
• A description of the measures taken or proposed to be taken to address the breach, including measures to mitigate its possible adverse effects.

Artanis shall cooperate with the Controller and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of any Personal Data Breach.

9. Data Protection Impact Assessments

Artanis shall provide reasonable assistance to the Controller with any data protection impact assessments and prior consultations with supervisory authorities that the Controller is required to carry out under Articles 35 and 36 of the UK GDPR, taking into account the nature of the processing and the information available to Artanis.

10. Audit Rights

Artanis shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the UK GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller.

Audits shall be:

• Conducted with reasonable prior notice (at least 30 days, except in the case of a Personal Data Breach or regulatory investigation);
• Limited to once per year, unless required by a supervisory authority or in response to a Personal Data Breach;
• Conducted during normal business hours and in a manner that minimises disruption to Artanis's operations; and
• Subject to the auditor entering into appropriate confidentiality obligations.

Where Artanis obtains relevant third-party audit reports or certifications (such as SOC 2 or ISO 27001), Artanis may make these available to the Controller to satisfy audit requests, provided they are reasonably current and comprehensive.

11. International Data Transfers

Personal Data may be transferred outside the United Kingdom in connection with the Sub-Processors listed in Annex 3. Artanis shall ensure that any such transfer is subject to appropriate safeguards in accordance with Article 46 of the UK GDPR, specifically:

• The UK International Data Transfer Agreement (UK IDTA) issued by the ICO; or
• The EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), Module 2 (Controller to Processor), supplemented by the UK Addendum issued by the ICO.

Artanis shall conduct and document a transfer risk assessment for each international transfer and shall implement supplementary measures where necessary to ensure that the level of protection for Personal Data is not undermined.

12. Data Deletion and Return

Upon termination or expiry of the Terms of Service, at the Controller's choice:

• Return: Artanis shall return all Personal Data to the Controller in a structured, commonly used, and machine-readable format within 30 days of the termination date; or
• Deletion: Artanis shall securely delete all Personal Data within 30 days of the termination date, and upon request provide written certification that such deletion has been completed.

Artanis may retain Personal Data to the extent and for the period required by applicable law, provided that Artanis ensures the confidentiality of such data and processes it only for the purposes for which retention is required.

13. Liability

The liability of each party under this DPA is subject to the limitations and exclusions set out in the Terms of Service, except that the limitations of liability shall not apply to the extent prohibited by Data Protection Laws.

14. Term

This DPA shall remain in effect for as long as Artanis processes Personal Data on behalf of the Controller. Sections that by their nature should survive termination shall survive, including but not limited to data deletion obligations, audit rights (for a period of 12 months following termination), and confidentiality obligations.

15. Precedence

In the event of any conflict between this DPA and the Terms of Service, this DPA shall take precedence with respect to data protection matters.

Annex 1: Details of Processing

Subject Matter and Duration

The processing of Personal Data in connection with the provision of the Artanis AI evaluation and observability platform, for the duration of the Customer's Subscription.

Nature and Purpose of Processing

• Storing and displaying Customer Data within the Service;
• Processing Customer Data through AI models to assist with evaluation building and prompt improvement;
• Generating evaluation results, analytics, and reports from Customer Data; and
• Enabling data export in standard formats.

Categories of Data Subjects

Data Subjects may include any individuals whose personal data is contained within the Customer Data submitted to the Service. This is determined by the Controller and may include:

• End users of the Controller's AI applications;
• The Controller's employees and contractors; and
• Any other individuals whose data the Controller submits to the Service.

Categories of Personal Data

The categories of Personal Data are determined by the Controller and may include any personal data contained within prompts, AI inputs and outputs, labels, evaluation data, and associated metadata. Artanis does not require or request that the Controller submit special category data (Article 9) or criminal conviction data (Article 10).

Retention

Personal Data is retained for the duration of the Customer's Subscription, plus 30 days following termination to facilitate data export, after which it is securely deleted unless otherwise instructed by the Controller or required by applicable law.

Annex 2: Technical and Organisational Security Measures

Artanis implements the following security measures in accordance with Article 32 of the UK GDPR:

Encryption

• All data in transit is encrypted using TLS 1.2 or higher;
• All data at rest is encrypted using AES-256 or equivalent.

Access Control

• Role-based access controls for all internal systems;
• Multi-factor authentication for access to production systems;
• Principle of least privilege applied to all personnel; and
• Regular access reviews.

Infrastructure Security

• Application hosted on Vercel's infrastructure with enterprise-grade security;
• Network isolation and firewall protections;
• Automated vulnerability scanning; and
• Regular security updates and patching.

Organisational Measures

• All personnel with access to Personal Data are bound by confidentiality obligations;
• Security awareness training for all staff;
• Incident response procedures and escalation processes; and
• Business continuity and disaster recovery planning.

Annex 3: Approved Sub-Processors

The following Sub-Processors are authorised to process Personal Data on behalf of the Controller:

Optional integrations: The Service allows Customers to configure optional third-party integrations (such as Langfuse, LangSmith, or AWS) using the Customer's own API keys. These integrations are controlled entirely by the Customer and are not Sub-Processors of Artanis. The Customer is responsible for ensuring an appropriate legal basis for any data sharing with such third parties.

This Sub-Processor list was last updated on 20 March 2026. To be notified of changes, contact privacy@artanis.ai.

Contact

For questions about this DPA, to request a countersigned copy, or to exercise any rights described herein, please contact:

• By email: privacy@artanis.ai
• By post: Artanis Ltd, 71-75 Shelton Street, London WC2H 9JQ, United Kingdom