Version 20 August 2026
Data processing agreement
If you use Union AI to process other people's personal data, you need a data processing agreement. This is the summary; ask us for the text you can sign.
Draft
Requesting the signable version
Roles: controller and processor
You are the controller for the personal data that ends up in your prompts. Union AI is the processor: we process that data solely to carry out your request and on your instruction. For your own account data we are the controller ourselves, as set out in the privacy statement. Which data should go into an AI tool in the first place is a separate question, worked through in is ChatGPT GDPR compliant for company data.
Subject matter and duration
The processing covers the content of prompts and the generated responses, and lasts as long as you use the service. Prompts and responses are not stored: they exist only in memory while your request is being processed. So there is no retention period to agree on and nothing to destroy at the end.
Subprocessors and change notice
We use the subprocessors listed on the subprocessors page, the complete list, including the parties with a US parent entity. We announce changes at least 30 days in advance, so you can object. If you object and we cannot resolve it, you may terminate the agreement with a refund of unused credit.
| Category | Who | What they see |
|---|---|---|
| Inference | Scaleway SAS, European Union | The prompt and the response |
| Hosting | Cloudflare, Inc. | Encrypted traffic at the edge |
| Database | Neon (Databricks), EU region | Account and usage, no prompt content |
| Payments | Stripe Payments Europe Ltd, Ireland | Billing data |
Transfers outside the EU
Inference takes place in the European Union only. Our subprocessors for hosting, database and payments process in European regions, but have a US parent entity; the European Commission's standard contractual clauses apply to them, along with the additional measures those parties take. We do not claim that this settles every jurisdictional question: see subprocessors for our unvarnished reading.
Security measures
Encryption in transit and at rest, access on a need-to-know basis, API keys stored only as a hash, secrets in a key vault and not in code, and periodically tested backups of the database. We do not read your prompts.
Data breaches and assistance
In the event of a breach we inform you without undue delay, with the information you need to meet your own notification obligation. We help you with data subject requests, with a DPIA and with questions from the supervisory authority, as far as can reasonably be asked of a processor.
Audits: once a year you may have an audit carried out by an independent party, or request our reporting. Questions about this agreement go to hello@europeanailab.eu.
Frequently asked questions
Do I need a data processing agreement to use AI at work?
If other people's personal data ends up in your prompts, yes. Under article 28 of the GDPR a controller must have a written agreement with every processor, and an AI service that handles your customers' or employees' data is a processor. Consumer subscriptions usually come with no such agreement at all.
Who is the controller and who is the processor?
You are the controller for the personal data in your prompts: you decide what goes in and why. Union AI is the processor for that content and acts on your instruction. For your own account data we are the controller ourselves, as set out in the privacy notice.
Do I need a DPIA for an AI tool?
You need one where the processing is likely to result in a high risk to people, which regulators associate with large-scale processing, special category data and decisions that affect someone's rights. Using AI on health records, biometric data or job applications usually clears that bar. Using it to summarise your own public documentation does not.
How do I get the signable DPA?
Email hello@europeanailab.eu and we send the full data processing agreement as a document. There is deliberately no download button while the text is under legal review, because a dated file doing the rounds is harder to pull back than an email.
Are there transfers outside the EU?
Inference stays inside the European Union. Hosting, database and payments process in European regions but have a United States parent entity, so the European Commission's standard contractual clauses apply to them. We do not claim that this settles every jurisdictional question, and the subprocessors page sets out our unvarnished reading.
How quickly are data breaches reported?
We inform you without undue delay, with the information you need to meet your own notification obligation, and the supervisory authority is notified within 72 hours where the breach poses a risk. You may also have an independent audit carried out once a year, or ask for our reporting instead.