Data processing agreement
Template terms for business customers whose personal data Agentic OS Group processes through Agentic OS, under Article 28 of the UK GDPR. Last updated 27 September 2026.
Template. This agreement is a standard template. Have it reviewed by a legal adviser before signing; the signed version, with the customer’s details and any agreed changes, is the one that applies.
1. Parties and roles
The Customer (the business named in the order or contract) is the controller. Agentic OS Group, West 57th Street, New York, company number +1 212 706600 (the Provider), is the processor. This agreement forms part of the main agreement between them for Agentic OS.
2. What is processed
| Subject matter | Providing and supporting the Agentic OS workspace, website, booking and portal services. |
|---|---|
| Duration | The term of the main agreement, plus the return or deletion period in section 9. |
| Nature and purpose | Storing, organising, displaying, transmitting and backing up data so the Customer can run its operations; nothing else. |
| Types of personal data | Names and contact details; booking, stay, invoice and payment records (no full card numbers); messages and documents; staff account and activity data. |
| Data subjects | The Customer’s guests, clients, suppliers and staff. |
3. The Provider’s obligations
The Provider will:
- process personal data only on the Customer’s documented instructions (including this agreement and the settings the Customer chooses in Agentic OS), and tell the Customer if it believes an instruction breaks data protection law;
- ensure everyone authorised to process the data is bound by confidentiality;
- keep appropriate technical and organisational security measures (Article 32), including encryption in transit, access by role and permission, audit records of access changes, encrypted backups and monitoring — see the security section of the privacy notice;
- help the Customer answer requests from data subjects (access, correction, deletion, portability and objection), including the export and erasure tools in Agentic OS;
- help the Customer with security, breach notification, data protection impact assessments and consultation with the Information Commissioner, taking into account the information available to the Provider;
- make available the information needed to show compliance with Article 28, and allow and contribute to reasonable audits on reasonable notice.
4. Sub-processors
The Customer gives general authorisation for the sub-processors on the sub-processors page. The Provider will update that page before adding or replacing a sub-processor; the Customer may object on reasonable data protection grounds within 30 days. The Provider imposes data protection obligations on each sub-processor equivalent to this agreement and remains responsible for them.
5. International transfers
Personal data is transferred outside the UK only with the safeguards UK law requires (an adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses).
6. Personal data breaches
The Provider will tell the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Customer’s data, with the information the Customer needs to meet its own duties.
7. The Customer’s obligations
The Customer is responsible for having a lawful basis for the processing, for the accuracy of the data it enters, and for giving the Provider lawful instructions.
8. Liability
Each party’s liability under this agreement is subject to the limits in the main agreement, except where the law does not allow those limits.
9. End of the agreement
At the end of the service the Provider will, at the Customer’s choice, return the personal data (for example as an export) or delete it within 90 days, including from backups when they expire, unless the law requires it to be kept.
10. Law
This agreement is governed by the law of England and Wales. Questions: agenticos@agentic.os.