Data Processing Agreement — template (Stilops as processor)

6 and 7: the e-mail hosting has moved from MXroute (US) to Hetzner (EU)).

Status and reservation. This is the standard template that Stilops offers to customers who wish to conclude a data processing agreement (Art. 28(3) GDPR). It has been drawn up by Stilops itself and has not been reviewed by a lawyer; a customer may propose its own model. The template is honest about what Stilops can and cannot guarantee — especially regarding sub-processors (art. 6) and international transfers (art. 7). An agreement is formed by signature by both parties; publication of this template is not an offer that is accepted by use.

Parties

1. Controller: [customer name], established at [address], Chamber of Commerce (KvK) [number], hereinafter "Customer".
2. Processor: Stilops, established at [address], Chamber of Commerce (KvK) [number], hereinafter "Stilops".

This data processing agreement forms part of the General Terms and Conditions of the Stilops customer portal (version as recorded at registration) and prevails in the event of conflict regarding the processing of personal data.

Art. 1 — Subject matter and duration

1. Stilops processes personal data exclusively on behalf of Customer, for the provision of the service: AI agents that make proposals and, after approval by Customer, perform tasks.
2. The agreement lasts for as long as the service is provided, plus the retention period of art. 10.

Art. 2 — Nature, purpose, types of data and data subjects (Annex 1)

Art. 3 — Instructions

1. Stilops processes only on documented instructions from Customer. The instructions consist of: the General Terms and Conditions, this agreement, and the assignments that Customer gives in the portal.
2. Every execution with effect requires explicit approval by Customer in the product. That approval constitutes an instruction for that single action.
3. If Stilops considers that an instruction infringes the GDPR, Stilops will notify Customer and will not carry out the instruction until Customer has decided.
4. Collective knowledge base (only if Customer enables it). If the setting "Participate in the collective knowledge base" is switched on, this constitutes an instruction from Customer to derive, once a week, from the knowledge that its agents have learned about its organisation, general insights that are not traceable to Customer or to individuals. Stilops reviews each insight manually before it is passed on to agents of other customers, and does not include personal data, names, addresses or numbers. An approved insight is no longer personal data; Stilops is itself responsible for it. The setting is off by default and Customer can always switch it off; after that nothing further is derived. Insights that have already been approved remain in place, because they are not traceable to Customer.

Art. 4 — Confidentiality

Persons who have access to personal data at Stilops (as of 2-9-2026: the owner) are bound by confidentiality. Access by AI agents is limited to the data of the organisation for which they have been hired (separation per organisation in the data layer, with regression test).

Art. 5 — Security (Art. 32 GDPR) (Annex 2)

Stilops implements at least:

• encryption of integration secrets at rest (AES-256-GCM, separate key per environment) and of all connections in transit (TLS);
• password hashing (scrypt), two-step verification available per account, http-only session cookies, rate limits on login attempts;
• tenant separation by organisation ID, a sandbox per run for code-writing agents;
• an append-only audit trail of every proposal, every test run and every decision;
• secret detection on input, and an emergency stop that halts all agent activity;
• encrypted, periodic back-ups with a documented recovery procedure; retention periods in accordance with the Retention Periods document in the compliance register.

The current status of each measure is set out in the public compliance register (https://stilops.com/nalevingsregister/nl); Customer may refer to it as evidence.

Art. 6 — Sub-processors

1. Customer grants general authorisation for the sub-processors in the list at https://stilops.com/nalevingsregister/documenten/subverwerkers (Annex 3). That list indicates for each party whether a data processing agreement exists and where the processing takes place.
2. Stilops informs Customer at least 30 days before a new sub-processor or a material change, via the portal or by e-mail. Within that period Customer may raise a reasoned objection; if the parties cannot resolve it, Customer may terminate without a notice period.
3. Stilops imposes on its sub-processors the same obligations as in this agreement, insofar as the sub-processor offers this. Where that is not the case, this is stated in the list.
4. Stripe has a hybrid role, not a single one. As a sub-processor (this article), Stripe acts only insofar as it executes the payment order on behalf of Stilops (processing transaction data, linking it to customer/invoice). For fraud prevention, AML/KYC and Stripe's own legal obligations as a payment institution, Stripe itself determines purpose and means; to that extent Stripe is an independent controller and that processing falls outside this agreement. Customer concludes this agreement with knowledge of this distinction.

Art. 7 — Transfers outside the EEA

1. Hosting and storage of the service, and the e-mail hosting of Stilops, take place in the EU (Hetzner, Germany).
2. The language model (Anthropic), DNS/traffic protection (Cloudflare) and payments (Stripe) are US parties. They offer EU standard contractual clauses; whether Stilops has accepted them is stated per party in the sub-processor list.

Art. 8 — Data breaches

Stilops reports a personal data breach affecting Customer's personal data without undue delay and aims to report within 24 hours after establishment, with the information from the Incident and data breach procedure §5 (for customers in the portal: https://portal.stilops.com/portal/naleving). Customer decides on notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to data subjects; Stilops assists in this.

Art. 9 — Assistance

Stilops assists Customer, at reasonable cost insofar as the work falls outside the service, with requests from data subjects (access, rectification, erasure, portability: all data of an organisation can be exported and deleted per organisation), with a DPIA and with prior consultation.

Art. 10 — End of the processing

Upon termination of the service, Customer's data is deleted after expiry of the retention period set by Customer (minimum 183 days), with the exception of what Stilops is legally required to retain (invoices, seven years) and the proof of agreements. On request, Stilops provides an export before deletion.

Art. 11 — Audit

1. Stilops makes available the information necessary to demonstrate compliance: the public compliance register, this template, the retention periods, the incident procedure (in the portal), and on request the relevant log entries from Customer's audit trail.
2. Customer may, once a year, with 30 days' notice and at its own expense, have an audit carried out by an independent auditor bound by confidentiality. Stilops may substitute a recent independent report (for example ISAE 3402) as soon as one exists — as of 2-9-2026 there is none.

Art. 12 — Liability and final provisions

Liability follows the General Terms and Conditions. Dutch law applies; disputes go to the competent court in [district]. In the event of a change to the GDPR or to the service, the parties will amend this agreement in consultation; Stilops may make a clarification without notice, a substantive change receives a new version number and 30 days' notice.

Annex 1 — Processing overview: art. 2. Annex 2 — Security measures: art. 5 and the compliance register. Annex 3 — Sub-processors: the Sub-processor List at https://stilops.com/nalevingsregister/documenten/subverwerkers.

Signature: