Data Processing Agreement
Version 1.3 · Last updated: November 10, 2026
Changes: 10 November 2026 (version 1.3): the backup location is stated. 10 November 2026 (version 1.2): the model-gateway provider is named in Annex 3; the Hetzner status is updated; the CRHQ signatory is named. 9 November 2026 (version 1.1): sections 8.2 and 9 and Annex 3 clarified; more protective for the Customer.
This agreement applies to every business customer that accepts our Terms of Service. To receive a copy to sign, write to hello@crhq.ai. The current list of sub-processors is in Annex 3.
Between the customer that has accepted the CRHQ Terms of Service (the “Customer”, acting as controller), and Zero Point Studio d.o.o., Rudeška cesta 179, 10000 Zagreb, Croatia, OIB 52438945902, VAT HR52438945902, operator of CRHQ (“CRHQ”, acting as processor).
1. Purpose and relationship to the Terms
1.1 This Data Processing Agreement (the “DPA”) sets out the terms under which CRHQ processes personal data on behalf of the Customer when providing the CRHQ service, as required by Article 28 of Regulation (EU) 2016/679 (the “GDPR”). It forms part of the CRHQ Terms of Service (the “Terms”).
1.2 If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If the Standard Contractual Clauses referred to in section 9 apply and conflict with this DPA, those Clauses prevail.
1.3 This DPA is concluded in writing, including in electronic form (Article 28(9) GDPR). Acceptance in the CRHQ account or a signed copy are equally valid.
2. Definitions
Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given in the GDPR. “Customer Data” means personal data that the Customer, its users, its agents or its website visitors put into, generate on, or connect to the Customer’s CRHQ servers. “Server” means a dedicated server provided to the Customer as part of the service. “Sub-processor” means a processor engaged by CRHQ to process Customer Data.
3. Roles and scope
3.1 For Customer Data, the Customer is the controller (or a processor acting for its own clients) and CRHQ is the processor. The details of the processing are in Annex 1.
3.2 CRHQ is the controller, not a processor, for the personal data it needs to run the Customer’s account and its own business: account details, billing, support correspondence, security logs and website analytics. That processing is described in the CRHQ Privacy Policy and is not covered by this DPA.
3.3 The Customer’s own providers. The Customer chooses and connects its own AI model providers (for example Anthropic, OpenAI, Cursor, Z.ai or Google, using its own subscription or API key) and its own third-party services (for example Google Workspace, Slack or a CRM). When the Customer’s agents send data to those services, they do so on the Customer’s instruction and under the Customer’s own contract with that provider. This includes contained agents answering the Customer’s website visitors, which use the same provider connection as the agent’s other work. Those providers are not CRHQ’s sub-processors. The Customer is responsible for having an adequate agreement with each of them.
3.4 Where the Customer uses a model or feature that CRHQ provides through its own account (listed in Annex 3: voice transcription, and models CRHQ offers through its own model gateway that an admin can switch an agent to), the provider of that feature is CRHQ’s sub-processor.
4. Instructions
4.1 CRHQ processes Customer Data only on the Customer’s documented instructions, including with regard to transfers to third countries, unless EU or Member State law requires otherwise. In that case CRHQ informs the Customer before processing, unless the law prohibits it.
4.2 The Customer’s documented instructions are: this DPA and the Terms, the Customer’s configuration and use of the service (including the agents, skills, recipes, schedules, connected services and permissions the Customer sets up), and any further written instructions the Customer gives through support. AI agents act within the configuration the Customer gives them. Their actions are processing on the Customer’s instruction, and the Customer remains responsible for configuring and supervising them, as set out in the Terms.
4.3 CRHQ will immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection law.
5. CRHQ’s access to Customer Data
5.1 Maintenance access. CRHQ maintains the Customer’s Servers. Its operations staff therefore have technical access to them (SSH, through a management host with SSH keys only, and CRHQ’s fleet tools) to keep them running, updated, backed up and secure. CRHQ uses that access only for maintenance.
5.2 No reading of content. CRHQ will never read the Customer’s conversations (session messages), files or documents, except when the Customer asks it to in writing, for example for support. “Read” means a person at CRHQ viewing that content. CRHQ’s systems process Customer Data automatically to provide the service, without anyone reading it (for example: making and restoring backups, checking answers for passwords and keys before they leave a Server, and collecting health figures that contain no content). If content appears incidentally while CRHQ fixes a technical problem (for example in an error message), CRHQ will not look further at it, keep it or use it.
5.3 Access as a user only by invitation. CRHQ never signs in to a Customer’s Server as a person unless the Customer’s organization invites CRHQ as a user, with the access level the Customer chooses. The Customer can remove that access at any time. Help with content (for example a support request about a conversation) is given this way.
5.4 Records. CRHQ’s access leaves a record. Changes made through CRHQ’s fleet tools are logged at CRHQ (who, what, which Server, result and time), and every direct sign-in is recorded in the Server’s own system log. A log of CRHQ’s access that the Customer’s organization can review is planned. Until it exists, CRHQ will provide the records of its access to a Customer’s Servers on request.
5.5 When the law requires it. CRHQ may access or disclose Customer Data where EU or Member State law requires it. In that case CRHQ does only what is required and, unless the law forbids it, informs the Customer first.
5.6 CRHQ does not use Customer Data to train AI models, for advertising, or for any purpose other than providing the service to the Customer.
5.7 Where the Customer’s Server belongs to an organization, people signed in to the organization’s main server can read and instruct conversations on the organization’s servers through the Fleet Agent, as described in the Terms (“Organization access to conversations”). That access is a feature the Customer controls. It is not access by CRHQ.
6. Confidentiality
CRHQ ensures that everyone it authorises to process Customer Data is bound by confidentiality, either by contract or by a statutory obligation, and processes the data only as necessary for the purposes of this DPA.
7. Security
7.1 CRHQ implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. These take into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing.
7.2 CRHQ may update these measures as technology develops, provided that the overall level of security is not reduced.
7.3 The Customer is responsible for the security of what it controls: its users’ accounts and passwords, the use of two-factor authentication, the permissions it grants to agents and people, the credentials it connects, and what it publishes through contained agents on websites.
8. Sub-processors
8.1 The Customer gives CRHQ general written authorisation to engage the sub-processors listed in Annex 3.
8.2 CRHQ will inform the Customer of any intended addition or replacement of one of its own sub-processors at least 30 days in advance, by email to the account owner and on crhq.ai/dpa, where the current list is published. Where a sub-processor changes its own subcontractors, CRHQ will inform the Customer as soon as it is informed, and the Customer’s right to object under section 8.3 applies from then. CRHQ will give the information the Customer needs to decide whether to object.
8.3 The Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If it can’t be resolved, the Customer may terminate the affected service, and CRHQ will refund any prepaid fees for the unused period.
8.4 CRHQ imposes on each sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA, except where Annex 3 states otherwise. If a sub-processor fails to meet its data protection obligations, CRHQ remains fully liable to the Customer for that sub-processor’s performance (Article 28(4) GDPR).
9. International transfers
9.1 Region. The Customer chooses the region of each Server when launching it: Europe (Germany or Finland), US East (Ashburn, USA), US West (Hillsboro, USA) or Asia Pacific (Singapore). The choice is the Customer’s documented instruction (Article 28(3)(a) GDPR) on where the Server’s data is stored and processed. Customer Data on a Server in Europe is stored and processed in the European Economic Area, except as set out for the sub-processors in Annex 3. Customer Data on a Server in another region is stored and processed in that country and is subject to its laws, including possible access by its authorities.
9.2 Information before the choice. Before the Customer chooses a region outside the European Economic Area, CRHQ tells it, in Annex 3, which country the data will be in, which sub-processors are involved and which safeguard applies. The Customer decides whether that region is appropriate for the personal data it will put on the Server.
9.3 Safeguards. A choice of region is an instruction. It is not by itself a transfer mechanism. Except where Annex 3 states that a safeguard is not confirmed, where Customer Data is transferred to a country without an adequacy decision, CRHQ ensures, and requires its sub-processors to ensure, that the transfer is covered by an adequacy decision (including the EU-US Data Privacy Framework, Commission Implementing Decision (EU) 2023/1795, where the recipient is certified) or by an appropriate safeguard under Article 46 GDPR, normally the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914; Module 3 where a processor transfers to a sub-processor), together with any supplementary measures needed. CRHQ does not rely on the derogations of Article 49 GDPR for hosting. Annex 3 states, for each sub-processor, the safeguard relied on and its current status. Where Annex 3 states that a safeguard is not confirmed, CRHQ will update Annex 3 and inform the Customer if that changes. The optional models listed in Annex 3 with no confirmed safeguard are used only if an admin of the Customer switches an agent to one of them; Annex 3 states their status.
9.4 Requests from public authorities. If CRHQ receives a legally binding request from a public authority, including an authority of a third country, for Customer Data, or learns that a sub-processor has received one, CRHQ will, unless the law forbids it: inform the Customer promptly; assess the lawfulness of the request and challenge it where there are reasonable grounds; disclose only the minimum required; and keep a record of the request. CRHQ requires equivalent commitments from its sub-processors to the extent its contracts allow, as stated in Annex 3.
9.5 Assessment. On request, CRHQ provides the Customer with a summary of its assessment of the laws and practices of the third countries listed in Annex 3, to help the Customer with its own assessment.
9.6 Moving a Server. CRHQ will help the Customer move a Server to another region. Data in the previous region is deleted after the move, within the periods in section 13.
9.7 The Customer’s own providers. Transfers made by the Customer’s own providers (section 3.3) are made on the Customer’s instruction and under the Customer’s responsibility.
10. Assistance with data subjects’ requests
10.1 The service lets the Customer find, export, correct and delete Customer Data on its Servers itself, including deleting the conversation of a single website visitor in a contained agent. Taking into account the nature of the processing, CRHQ assists the Customer, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR.
10.2 If CRHQ receives a request directly from a data subject about Customer Data, it will forward it to the Customer without undue delay and will not respond itself, unless the Customer instructs it to.
11. Assistance with security, breaches and impact assessments
Taking into account the nature of the processing and the information available to it, CRHQ assists the Customer in meeting its obligations under Articles 32 to 36 GDPR (security, notification of breaches, data protection impact assessments and prior consultation of the supervisory authority), mainly by providing the information in this DPA and its annexes and by answering reasonable questions.
12. Personal data breaches
12.1 CRHQ will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data.
12.2 The notification will describe, as far as known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point. Where not all information is available at once, CRHQ will provide it in phases without undue delay.
12.3 CRHQ will take reasonable steps to contain and remedy the breach, and will help the Customer notify the supervisory authority and data subjects where required. Notifying CRHQ of a breach is not an admission of fault.
13. Deletion and return at the end
13.1 During the term, the Customer can export and delete Customer Data on its Servers at any time.
13.2 When a subscription or trial ends, the Server is stopped when access ends and permanently removed 14 days later. When it is stopped, CRHQ keeps one final copy (snapshot) of its disk with its hosting provider, so it can be restored if the Customer returns or asks for data from it. That copy is used for nothing else. It is deleted when the Customer asks, and in any event 90 days after the Server is removed.
13.3 Backup copies expire on their normal schedule: daily copies after 7 days, weekly after 4 weeks, monthly after 12 months. Until they expire, they are kept secure, are not used, and are restored only at the Customer’s request.
13.4 On request, CRHQ will confirm in writing that deletion has been carried out. CRHQ may keep Customer Data only where EU or Member State law requires it to, and then only for as long as required and subject to this DPA.
14. Information and audits
14.1 CRHQ makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR. That includes this DPA, its annexes, and answers to reasonable security questionnaires.
14.2 If that information isn’t sufficient, the Customer, or an independent auditor bound by confidentiality, may audit CRHQ’s compliance once per calendar year. The Customer gives 30 days’ written notice, and the audit takes place during normal business hours and at the Customer’s own cost. It must not compromise the security of other customers or access their data. Additional audits are allowed after a personal data breach or where a supervisory authority requires one.
15. Liability
Each party’s liability under this DPA is subject to the limitations of liability in the Terms. Nothing in this DPA limits either party’s liability to data subjects under Article 82 GDPR, or any liability that cannot be limited by law.
16. Term, changes and law
16.1 This DPA applies for as long as CRHQ processes Customer Data, and survives termination of the Terms until all Customer Data has been deleted or returned under section 13.
16.2 CRHQ may update this DPA to reflect changes in law or in the service, with at least 30 days’ notice. An update can’t reduce the protection given to Customer Data.
16.3 This DPA is governed by the laws of the Republic of Croatia. Disputes are resolved by the competent courts in Zagreb, Croatia.
Annex 1. Details of the processing
| Subject matter | Providing the CRHQ service: dedicated servers on which the Customer’s AI agents work with a browser, files, memory, schedules, tools and connected services, plus contained agents that can talk to the Customer’s website visitors. |
|---|---|
| Duration | The term of the Customer’s subscription or trial, plus the periods in section 13 (removal 14 days after the end; final copy at most 90 days after removal; backups expire within 12 months). |
| Location | The region the Customer chooses for each Server (Europe: Germany or Finland; US East: Ashburn, USA; US West: Hillsboro, USA; Asia Pacific: Singapore), plus the sub-processors in Annex 3. |
| Nature of the processing | Hosting, storage, backup and restore; running the Customer’s agents and the tools they use; sending data to the services and AI providers the Customer connects; transcribing voice input; serving contained agents on websites; support at the Customer’s request; deletion. |
| Purpose | Solely to provide the service to the Customer under the Terms and the Customer’s instructions. |
| Categories of data subjects | Determined by the Customer. Typically: the Customer’s users (staff and contractors); the Customer’s clients, prospects and business contacts whose data the agents process; people whose data is in connected services (for example email correspondents and calendar participants); and visitors who chat with the Customer’s contained agents. |
| Categories of personal data | Determined by the Customer. Typically: names and contact details; account and user identifiers; the content of conversations, prompts and agent outputs; files and documents; emails, calendar entries and records from connected services; voice recordings sent for transcription; for contained agents, the visitor’s messages and a shortened IP address prefix. Web server access logs on CRHQ’s front server, which contain full IP addresses, are kept for up to 31 days. |
| Special categories | Not intended. The service is not designed for special categories of data (Article 9 GDPR) or data about criminal convictions (Article 10). If the Customer processes such data, it is responsible for assessing whether the safeguards in Annex 2 are appropriate. |
| Frequency | Continuous for the duration of the service. |
| Retention | As set out in section 13. The Customer controls retention of its own content on its Servers. Technical logs on the Servers are kept as described in Annex 2 (Logging). Conversations with a website’s public chat (contained agents) are kept 90 days by default, or as long as the Customer sets, and can be deleted per visitor. |
Annex 2. Technical and organisational measures (Article 32)
Measures in place. Planned improvements are listed as planned.
| Area | Measures in place |
|---|---|
| Separation | A dedicated virtual server per customer. Customer Data is not stored with other customers’ data. Each server is firewalled: SSH only from CRHQ’s management host; web traffic over TLS. |
| Encryption in transit | Traffic is encrypted in transit (TLS) over public networks. Backups are uploaded through short-lived (2-hour) links signed by CRHQ’s hub, which only allow writing to that server’s own backup folder; servers use no stored storage credential. |
| Encryption at rest | On customer servers, credentials, API keys and OAuth tokens are encrypted with AES-256-GCM, with a per-server key kept on that server. Two-step (TOTP) secrets are stored encrypted (AES-256-GCM), on servers and on crhq.ai. Passwords are stored as bcrypt hashes. Backups are encrypted at rest by the storage provider (Cloudflare R2). |
| Access control | Two-factor authentication (TOTP) is available to users. Roles and permissions per server. CRHQ’s operations staff have administrative (root) access to customer servers for operations and support, through a management host, with SSH keys only. Changes made through CRHQ’s management tools are logged (who, what, which server, result and time). CRHQ’s own administration (crhq.ai) signs out after 7 days idle and 30 days at most. |
| Protection against attacks | Firewall, fail2ban and automatic security updates on servers. Rate limits on sign-in. Bot protection (Cloudflare Turnstile) on public forms and contained agents. |
| Contained agents | Each conversation runs in a sealed space with only the knowledge the Customer grants. Answers are checked for known secrets before they leave. There are spending limits per answer, per visitor and day, per agent and day, and per server and month. Only a shortened IP prefix is stored with the chat. |
| Organization access (Fleet Agent) | Each server’s people see every access by their organization’s Fleet Agent (who, when, which conversation, what action). Recognised passwords and keys are redacted before conversation text leaves a server. The hub records every such access. |
| Availability and resilience | Backups offsite: daily copies kept 7 days, weekly 4 weeks, monthly 1 year. Backup checks before releases. Health monitoring of all servers. |
| Logging | Web server access logs on CRHQ’s front server (with full IP addresses) are kept for up to 31 days. On customer servers: system logs that record how a server is used (the system journal, web server, sign-in and system logs) are deleted automatically within 90 days. Operating-system maintenance records, such as software update history, the server’s set-up log and the last sign-in time of each server account, are kept up to 12 months or for the life of the server. Audit and access logs that the platform keeps about the use of a server are deleted automatically 12 months after they were recorded. For visitors to a website’s public chat, the partial IP address we keep is removed 12 months after their last visit. Backups contain copies until they expire (monthly backups up to 12 months). |
| Change management | Code review, automated tests before release, a test server first, and a security review of changes that affect security, access or data. |
| People | Confidentiality obligations for everyone who processes Customer Data (section 6). |
| Incident response | A written incident response and breach notification procedure: who acts and how fast, notice to the Customer as set out in section 12, a breach log, and a practice run at least once a year. |
| Planned | Further hardening of internal connections; security testing; staff security training. |
Annex 3. Sub-processors
| Sub-processor | What it does for CRHQ | Where | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Contracting partner and sub-processor for every location. Hetzner’s own subcontractors at the non-EU locations (Hetzner DPA, Appendix 3): USA: Hetzner US LLC (New York); NTT Global Data Centers Americas, Inc. (Sacramento); QTS Investment Properties Hillsboro, LLC (Overland Park). Singapore: Hetzner Singapore Pte. Ltd.; NTT Global Data Centers SG1 Pte Ltd. | Hosting of customer servers and the CRHQ hub; the final snapshot of stopped servers. Hetzner’s own measures are audited yearly by TÜV Rheinland (i-sec GmbH); Hetzner DPA version 1.2 concluded by CRHQ on 7 November 2026, with Appendix 1 covering customer content (AI-assistant conversations, documents, files, application data) and our customers’ users and end customers. Hetzner’s measures (TOMs version 1.2, 17 February 2026) include ISO 27001 and BSI C5 Type 2 certification and an independent review every year (by TÜV Rheinland, i-sec GmbH); the results are available to CRHQ in the Hetzner portal (DPA §4(3)) | The region the Customer chooses: Germany or Finland (Europe); Ashburn or Hillsboro, USA (US East, US West); Singapore (Asia Pacific). The CRHQ hub runs at Hetzner in Falkenstein, Germany. | Europe: no transfer; data stays in the EEA. US and Singapore Servers: the data on the Server is physically in the USA or Singapore, on Hetzner’s hardware in data centres run by the third parties above, and is subject to the laws of that country, including possible access by its authorities. CRHQ treats this as a transfer to a third country (Chapter V GDPR), with Hetzner Online GmbH as exporter and its US or Singapore subcontractors as importers. Hetzner’s written view (9 November 2026) is that it is not a transfer, because the data-centre operators have no access to customer data.
|
| Cloudflare, Inc., San Francisco, USA | Storage of backups (R2); bot protection (Turnstile) for public forms and contained agents | R2: Europe (our backup storage is located in Cloudflare’s Eastern Europe region, EEUR). Turnstile: global | EU Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Groq UK Limited (Groq’s contracting party for customers in the European Economic Area, under Groq’s Services Agreement), part of the Groq group (Groq LLC, USA) | Transcription of voice input, only when a user dictates (CRHQ’s account) | USA | EU Standard Contractual Clauses (in Groq’s data processing addendum) |
| LithosAI, Inc., 141 S Saint Clair St, Ste 204, Pittsburgh, PA 15206, USA. It provides the models CRHQ offers through its own model gateway; today that is DeepSeek V4.1 Flash. | Answers from a model that CRHQ offers through its own account, only for agents that an admin of the Customer switches to such a model (never a default) | USA. The provider does not publish where it processes data. | None confirmed. LithosAI publishes no data processing terms and no EU transfer safeguard (checked 10 November 2026). CRHQ has no data processing agreement with LithosAI; its published terms of use apply. It states that by default it keeps no inputs or outputs after processing (zero data retention). Because no Chapter V safeguard is in place, a Customer should not switch an agent that handles personal data subject to the GDPR to this model. CRHQ will update this row if that changes. |
Not sub-processors under this DPA: Stripe (CRHQ’s own billing, as controller); Brevo (CRHQ’s account, billing and service emails, which carry contact details and never Customer Data; CRHQ as controller); Namecheap (DNS for crhq.ai, no Customer Data); website analytics (CRHQ as controller); and the AI providers and third-party services the Customer connects under its own accounts (section 3.3).
Annex 4. Parties and signatures
| Controller (Customer) | Name, address, company registration number, contact person and email, data protection officer (if any): ____________ |
|---|---|
| Processor (CRHQ) | Zero Point Studio d.o.o., Rudeška cesta 179, 10000 Zagreb, Croatia, OIB 52438945902. Contact: hello@crhq.ai. Signed for CRHQ by: Andrej Šimunaj, CEO |
| Supervisory authority for CRHQ | Agencija za zaštitu osobnih podataka (AZOP), Zagreb, Croatia |
| Date and signatures | ____________ |