WiseWare
Plan a demo

DATA PROCESSING AGREEMENT

WiseWare.chat SaaS Platform

WiseWare BV - Data Processing Agreement Version 1.3 - August 11, 2026

This Data Processing Agreement (“DPA”) forms part of the Master Subscription Agreement or other written agreement between WiseWare BV (“WiseWare”, “Processor”) and Customer (“Controller”) for the provision of WiseWare.chat services (the “Main Agreement”). This DPA governs the processing of Personal Data by WiseWare on behalf of Customer.

1. DEFINITIONS

  • “Services”: the WiseWare.chat platform and related services
  • “Sub-processor”: third parties we use to deliver Services
  • “Account”: the subscribing organization with complete data isolation
  • “AI Agent”: intelligent container managing specific business functions and workflows
  • “Session”: conversation container linking a specific User and AI Agent
  • “Knowledge Base”: organized folders and files containing reference materials for AI Agents

Other terms have meanings given in GDPR and the Master Agreement.

2. SCOPE AND APPLICABILITY

This DPA applies to all Personal Data processed by WiseWare as part of providing the Services. Customer acts as Controller and WiseWare acts as Processor under GDPR Article 28.

The Services enable Customer to deploy intelligent AI Agents powered by their own knowledge bases, providing secure, customizable AI assistance tailored to specific business needs through session-based interactions.

3. PROCESSING BASIS

We process Personal Data as your processor for: AI Agent platform operation, session-based AI interactions, file and folder management across personal drives, shared drives, and session workspaces, user account administration, file processing and metadata generation, system integration via MCP servers, support services, and security monitoring.

Categories of Personal Data and Data Subjects are described in Annex A.

4. OUR COMMITMENTS

Beyond standard GDPR processor obligations, WiseWare provides:

  • EU data storage: Customer Data is stored in the EU/EEA. AI model inference is performed via EU API endpoints, so Customer Data is not transferred outside the EU/EEA for inference. Customer Data is not used to train external AI models
  • Complete tenant isolation: Dedicated data storage ensuring complete separation between organizations

5. PROCESSING INSTRUCTIONS

Customer instructs WiseWare to process Personal Data for providing the Services as described in the Main Agreement, including:

  • Managing AI Agents and their configurations
  • Processing session-based interactions between Users and AI Agents
  • Managing files and folders across personal drives, shared drives, and session workspaces
  • Generating and managing file metadata and extracted text content for AI processing
  • Facilitating system integrations via MCP server connections
  • Generating documents and reports through AI Agent conversations
  • Maintaining user access controls and system configurations

Any additional instructions require written agreement. WiseWare will inform Customer if instructions violate applicable data protection laws.

6. SECURITY

We implement appropriate technical and organizational security measures including EU hosting, encryption, access controls, and tenant isolation. Detailed measures available upon request.

Customer is responsible for the lawfulness of Personal Data and for providing documented processing instructions.

7. SUB-PROCESSING

Customer provides general written authorization to WiseWare to engage sub-processors. WiseWare maintains a current list of sub-processors at wiseware.nl/trust/subprocessors. WiseWare will inform Customer of intended additions or replacements by updating that list at least 15 days before they take effect; the posting date constitutes notice. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve an objection in good faith, Customer may terminate only the affected Services as its sole remedy. In urgent cases affecting continuity or security, WiseWare may shorten or waive advance notice and will inform Customer without undue delay thereafter. Third parties explicitly configured by Customer (e.g., customer-selected integrations) are not WiseWare sub-processors under this DPA. We ensure that data processing agreements providing safeguards consistent with Article 28 GDPR are in place with all Sub-processors and remain liable for their compliance.

8. DATA SUBJECT RIGHTS

The platform provides self-service capabilities for data management. We assist with GDPR requests within statutory timeframes and will reasonably assist with data protection impact assessments and, where required, prior consultations with supervisory authorities. Professional services charges may apply for complex requests requiring legal analysis.

9. INCIDENTS & COMPLIANCE

We will notify Customer without undue delay after becoming aware of a Personal Data Breach and provide information required by Article 33(3) GDPR, followed by updates as further details become available. We cooperate with regulatory inquiries while maintaining customer data isolation.

10. AUDITS

WiseWare will make available information necessary to demonstrate compliance with Article 28 GDPR and allow audits by Customer or Customer’s appointed independent auditor, once per 12 months during business hours with reasonable notice. WiseWare may satisfy this audit right by providing up-to-date independent third-party reports or certifications where available. Audits will not unreasonably interfere with operations, are subject to confidentiality, and are limited to what is necessary to verify compliance.

11. DATA RETENTION

  • Account data: Until termination + 30-day export period
  • User profile data: Until account termination or user deletion
  • AI Agent configurations: Until Customer deletion or account termination
  • Session data: Lifetime of the Account or until Customer deletion
  • Files and folders: Until Customer deletion (personal drives, shared drives, session workspaces)
  • Generated metadata: Until corresponding file deletion
  • Technical logs: 12 months maximum

Upon termination, Customer has 30 days to export all Account data before deletion. After the export period, WiseWare will delete Personal Data, except where retention is required by law. Residual Personal Data in backups will be overwritten in the ordinary course of backup cycles.

12. INTERNATIONAL TRANSFERS

Personal Data is processed within the EU/EEA. AI model inference is performed via EU API endpoints, and WiseWare does not transfer Personal Data outside the EU/EEA. WiseWare ensures that data processing agreements providing safeguards consistent with Article 28 GDPR are in place with all sub-processors.

13. LIABILITY

Liability is governed by the Main Agreement and applicable Dutch law.

14. TERM AND TERMINATION

This DPA remains effective with the Main Agreement. Termination follows the Main Agreement provisions.

15. GOVERNING LAW

This DPA is governed by Dutch law.

ANNEX A: PROCESSING DETAILS

Data Subjects

  • Admin Users: Customer employees managing AI Agents and system configuration
  • Member Users: Customer employees using AI Agents for business assistance

Personal Data Categories

  • Account Data: Names, email, authentication, role assignments, preferences
  • Agent Data: AI agent configurations, behavioral instructions, settings
  • Session Data: Conversations, summaries, ratings, generated documents
  • File Data: Uploaded files, metadata, folder structures, version history
  • Integration Data: External system connections and interactions
  • Technical Data: Usage patterns, logs, performance metrics (legitimate interests)

Processing Purposes

  • Platform operation and AI agent functionality
  • File management across personal, shared, and session workspaces
  • User authentication and access control
  • Service improvement and security monitoring

Retention

  • All business data: Until Customer deletion or 30 days after termination
  • Technical logs: 12 months maximum

ANNEX B: SUB-PROCESSORS

Current Sub-processors

Current sub-processors and their locations are published at wiseware.nl/trust/subprocessors and form part of this DPA. Material changes per Section 7.

Categories:

  • Cloud Infrastructure & Hosting: Application hosting, database storage, backup services (EU/EEA)
  • AI Model Providers: AI model inference and text generation via EU API endpoints (EU/EEA)
  • Monitoring & Analytics: Application performance monitoring and error tracking (EU/EEA)
  • Communication & Support: Email delivery and communication services (EU/EEA)

WiseWare BV Utrecht, Netherlands KvK: 98236652 Version 1.3 - August 11, 2026

This Data Processing Agreement ensures GDPR compliance for WiseWare.chat’s specialized private GPT platform with AI-powered business assistance capabilities.