Data Processing Addendum

Customer is the business customer that accepted the Terms or an order. Task Machine is operated by Fabian Schucht, C. General Vives 1 6E, 35006 Las Palmas de Gran Canaria, Spain, NIE Z1096165J. This Addendum applies when Task Machine processes Customer Personal Data for Customer and continues for as long as that processing lasts. Customer Personal Data means personal data Task Machine processes on Customer's behalf through the service or related support.

Customer acts as controller or as a processor authorized by the relevant controller. Task Machine acts as Customer's processor or subprocessor, respectively. Each party remains responsible for its own obligations under applicable data protection law. That law includes the EU GDPR, applicable EEA and member-state law, UK data protection law, Swiss data protection law, and applicable United States state privacy law.

This Addendum controls a conflict with the Terms about Customer Personal Data. A separately signed agreement controls where it expressly replaces this Addendum. Mandatory transfer clauses control a conflicting provision for the transfer they cover. Account administration, direct commercial records, and service security can also involve Task Machine acting as an independent controller under the Privacy Policy. Link acts independently as merchant of record for Managed Payments.

The subject matter is processing needed to provide and support Task Machine. Processing continues during the service relationship and any return, deletion, or lawful retention period. It includes hosting, organizing, transmitting, retrieving, and storing content, executing instructed work, routing requests to providers, supporting collaboration, maintaining security, and troubleshooting.

Data subjects can include Customer's users, employees, contractors, applicants, customers, suppliers, contacts, and other people whose information Customer submits or connected services return. Data categories can include identity and contact details, professional information, communications, account and role information, documents, source files, prompts, transcripts, tool inputs and outputs, and other information selected by Customer.

The service does not require special-category or criminal-offence data. Customer must not submit such data unless it has established the necessary lawful basis, safeguards, provider configuration, and any required written agreement with Task Machine.

Task Machine processes Customer Personal Data only on documented instructions, including the agreement, workspace settings, permissions, prompts, connected services, support requests, and other written instructions accepted by Task Machine. If applicable law requires other processing, Task Machine will inform Customer before processing unless that law prohibits notice. Task Machine will inform Customer if it believes an instruction infringes applicable data protection law and may pause the affected processing while the parties clarify it.

Customer is responsible for the lawfulness and scope of its instructions, required notices, and rights and authorizations for the data it submits. Task Machine limits access to authorized people who need it and ensures they are subject to confidentiality commitments or an appropriate statutory duty.

Task Machine applies technical and organizational measures appropriate to the risk, including HTTPS, managed database encryption at rest, private customer object storage, access controls, encrypted Vault secrets, scoped worker credentials, restricted production access, security logging, backups, dependency maintenance, and incident response. The Security page describes the current controls and execution boundaries. These security measures and the Subprocessor Schedule form part of this Addendum. Updates will not materially reduce the protection of Customer Personal Data.

Customer manages its members, permissions, credentials, selected services, local machines, repositories, networks, and appropriate backups. Local execution is not an operating-system or filesystem sandbox. These responsibilities do not reduce Task Machine's obligations for controls it operates.

Customer gives general written authorization for Task Machine to use the providers identified in the Subprocessor Schedule. Before a subprocessor processes Customer Personal Data, Task Machine will impose the same data protection obligations as in this Addendum by contract or other legal act, as required by applicable law, and remains responsible for its performance as required by applicable law. A service Customer selects, contracts with, and controls directly is not automatically a Task Machine subprocessor.

Task Machine will update the schedule and give active DPA customers at least 15 days' advance notice through their recorded contact before a material new subprocessor starts processing Customer Personal Data, unless urgent security, legal, or service-continuity circumstances require a shorter period. Customer may object during the notice period on reasonable data protection grounds. The parties will seek a reasonable resolution in good faith. If no reasonable alternative is available, either party may end the affected service without penalty beyond charges already incurred.

Where Customer's transfer to Task Machine requires a safeguard, Task Machine will ensure the applicable EU standard contractual clauses with the appropriate module and required UK or Swiss adaptations, and the necessary party and transfer details and measures, are in place before the transfer, unless an adequacy decision or another lawful mechanism applies. Task Machine will separately safeguard restricted onward transfers using an adequacy decision, applicable standard contractual clauses, or another lawful mechanism, with supplementary measures where appropriate. Task Machine will provide information about the safeguards and a copy where available on request.

Task Machine does not use Customer Personal Data to train its own general-purpose models. Managed model requests require no-training provider routing. Zero data retention and EU routing are separate requirements, and neither changes Task Machine's own retention of product records.

Customer instructs the use of services it configures or invokes. Customer-selected services are subject to their own terms and settings. Task Machine does not itself make solely automated decisions producing legal or similarly significant effects about data subjects. If Customer uses the service for such decisions, Customer is responsible for the applicable safeguards and Task Machine will reasonably assist concerning processing it controls.

Taking account of the nature of the processing, Task Machine will provide reasonable assistance to help Customer respond to requests to access, correct, delete, restrict, object to, or port Customer Personal Data. If Task Machine receives a request about data Customer controls, it will direct the person to Customer where practical and will not respond substantively unless Customer authorizes it or law requires it.

Task Machine will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. It will provide reasonably available information about the breach, affected data and people, likely consequences, mitigation, and a contact point. Information may follow in stages. Task Machine will take reasonable steps to contain, investigate, and remediate the breach.

Taking account of the nature of processing and information available to it, Task Machine will reasonably assist Customer with security obligations, impact assessments, prior consultation, and relevant regulator inquiries. Customer remains responsible for its own assessments and notifications.

Customer may request an available copy of Customer Personal Data during the service term. After the processing services end, Task Machine will, at Customer's choice, return or delete Customer Personal Data and delete existing copies unless applicable law requires retention. Protected backup copies follow their normal cycle, subject to applicable law and Customer's instruction. During the service term, written deletion requests are assessed against the instruction and applicable law.

Task Machine automatically stores private checkpoints of Local Worker and managed cloud sandbox working directories in Scaleway Object Storage in Amsterdam, Netherlands. Gitignored files are excluded when the directory has a remotely reachable Git base. Other directories are copied in full, including hidden files and credentials present there. Scratch files are not included.

Private working-file checkpoints are the source of truth for Local Workers and managed cloud sandboxes. Sandbox disks are temporary caches. Task working files expire 14 days after the last update, or 7 days after completion, cancellation or archiving, whichever comes first. Chat working files expire 14 days after last activity or 7 days after archiving, whichever comes first. Other work scopes expire after 14 days without activity. Repeating an archive request does not restart the clock. Restoring a Task or Chat removes its archive-based deadline but cannot recover deleted working files. Active or queued Runs prevent cleanup. These rules apply to existing working files. Chats already archived when the archive clock is introduced use the migration time for that clock, without extending an earlier inactivity deadline. Already-expired files may be removed without another checkpoint. Deleting working files does not delete product records or transcripts. This is not a permanent-backup or crash-recovery guarantee. Workspace deletion removes checkpoints, with unreferenced bytes removed by background cleanup. Confirmed local caches become eligible for immediate removal for completed, cancelled or archived Tasks and archived Chats. Other confirmed idle caches are removed after seven days. Offline or customer-controlled copies may remain. A later Run discards an unconfirmed crash copy and restores the last committed checkpoint.

Archiving keeps product records, while working files follow the checkpoint limits above. Disconnecting an external service does not retract copies it has already received. Independent-controller records may be retained where law or legitimate legal, financial, fraud, security, or dispute purposes require them.

The liability, governing law, venue, termination, and notice provisions in the Terms or signed agreement apply to this Addendum unless applicable data protection law or mandatory transfer clauses require otherwise.

Task Machine will give active DPA customers advance notice of material changes to this Addendum. Updates will not materially reduce the protection of Customer Personal Data. The separate notice and objection process for subprocessors continues to apply.

For instructions, questions, or a signed copy of this Addendum, email [email protected].