Data Processing Agreement

Last updated 1 October 2026

Sample text for this demo. Replace it with documents approved by your legal team.

This Data Processing Agreement (DPA) forms part of the agreement between the customer ("controller") and BIT s. r. o., the operator of Frieda ("processor") and applies whenever Frieda processes personal data on the customer's behalf.

1. Scope

Frieda processes candidate, client and user data only to provide the platform: storing roles and profiles, running agents, sending messages you approve, and producing reports.

2. Instructions

We process personal data only on your documented instructions, including the agent autonomy settings you configure. We will tell you if we believe an instruction breaks data protection law.

3. Security

Encryption in transit (TLS 1.2+) and at rest.
Role-based access, single sign-on and a full audit trail of human and agent actions.
Data hosted in EU data centres.

4. Sub-processors

We use a short list of sub-processors for hosting, email delivery and AI model inference. We will notify you at least 30 days before adding a new one, and you may object.

5. Assistance and breaches

We help you respond to data subject requests and impact assessments. We will notify you of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it.

6. Deletion

When the agreement ends, we delete or return your personal data within 30 days, unless the law requires us to keep it.