Data processing agreement (template)

This is the template of the data processing agreement (DPA) that GPT Workspace signs with business customers. To receive it pre-filled, write to contact@gpt.space with your company’s legal name, address, contact person and number of seats. The processors it names are listed and kept current on the Trust Center.

This template is provided for information and is not legal advice. Have it reviewed by your counsel before signing. Square-bracket fields are filled in before signature.

---

This Data Processing Agreement (“DPA”) forms part of the agreement for the use of GPT Workspace (the “Service”) between:

• [CUSTOMER LEGAL NAME], [CUSTOMER ADDRESS], [REGISTRATION NUMBER] (the “Customer” or “Controller”), and
• GPTW LLC, 150 Central Park, Los Alamos, New Mexico, USA (the “Provider” or “Processor”),

together the “Parties”. It is entered into on [EFFECTIVE DATE] and applies for as long as the Provider processes Personal Data on behalf of the Customer.

“GDPR” means Regulation (EU) 2016/679, and, where applicable, the UK GDPR as defined in the Data Protection Act 2018. “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Supervisory Authority” and “Personal Data Breach” have the meanings given in Article 4 GDPR. “Subprocessor” means a third party engaged by the Provider to process Personal Data on the Customer’s behalf. “Customer Data” means the Personal Data the Provider processes for the Customer under the Service agreement, as described in Annex 1.

2.1 The Customer is the Controller and the Provider is the Processor of the Customer Data. Where the Customer acts as a processor for its own clients, the Provider acts as a sub-processor and the Customer warrants that its own instructions are authorized by the relevant controller.

2.2 The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.

3.1 The Provider processes Customer Data only on the Customer’s documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which the Provider is subject; in that case the Provider informs the Customer of that legal requirement before processing, unless the law prohibits it.

3.2 The Customer’s instructions are: the Service agreement, this DPA, the configuration the Customer and its users set in the Service (including the data controls described in Annex 2), and the requests the Customer’s users send to the Service. The Provider informs the Customer immediately if, in its opinion, an instruction infringes the GDPR.

The Provider ensures that persons authorized to process the Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to what each person needs to perform the Service.

The Provider implements the technical and organizational measures listed in Annex 2 and keeps them under review. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing, the measures ensure a level of security appropriate to the risk.

6.1 The Customer gives a general written authorization to the Provider to engage the Subprocessors listed in Annex 3.

6.2 The Provider informs the Customer of any intended addition or replacement of a Subprocessor at least [30] days before the change takes effect, by e-mail to [CUSTOMER NOTIFICATION E-MAIL] and by updating the list at https://gpt.space/trust. The Customer may object on reasonable data-protection grounds within that period; if the Parties cannot resolve the objection, the Customer may terminate the affected part of the Service without penalty.

6.3 The Provider imposes on each Subprocessor, by way of a contract, the same data-protection obligations as set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organizational measures. Where a Subprocessor fails to fulfil its obligations, the Provider remains fully liable to the Customer for the performance of that Subprocessor’s obligations.

Taking into account the nature of the Processing, the Provider assists the Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising the Data Subject’s rights under Chapter III GDPR. The Provider forwards to the Customer, without undue delay, any request received directly from a Data Subject concerning Customer Data, and does not respond to it except on the Customer’s instruction or where required by law.

The Provider assists the Customer in ensuring compliance with the obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the Processing and the information available to the Provider.

The Provider notifies the Customer without undue delay, and in any case within [48] hours, after becoming aware of a Personal Data Breach affecting Customer Data, by e-mail to [CUSTOMER NOTIFICATION E-MAIL]. The notification describes, as far as known at the time, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; information that is not yet available is provided in phases without undue further delay.

10.1 At the Customer’s choice, the Provider deletes or returns all Customer Data after the end of the provision of the Service, and deletes existing copies, unless Union or Member State law requires storage of the Personal Data.

10.2 Independently of 10.1, the Customer and each of its users can delete their account and the data held by the Provider from the Service at any time; the deletion is performed within 24 hours of the request. Invoices and payment records are retained for the duration required by tax law.

11.1 The Provider makes available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

11.2 The Provider first satisfies audit requests by providing its ISO 27001 certificate and audit report (https://firebasestorage.googleapis.com/v0/b/billing-js.appspot.com/o/audit_report%2FQualtir%20ISO%2027001%20Audit%20Report.pdf?alt=media), its CASA Tier III assessment and written answers to a security questionnaire. An on-site or remote inspection is conducted at most [once per year], on [30] days’ written notice, during business hours, under a confidentiality agreement, and at the Customer’s expense, unless a Supervisory Authority requires otherwise or a Personal Data Breach has occurred.

12.1 The Provider is established in the United States and the Service is hosted on Google Cloud Platform in the United States. Where Customer Data of Data Subjects in the EEA, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the Parties rely on the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 (Module Two, controller to processor, or Module Three, processor to processor, as applicable), which are incorporated by reference, together with the UK International Data Transfer Addendum where UK data is concerned. The Provider’s Subprocessors that receive Customer Data participate in the EU-US Data Privacy Framework where that framework is available to them; the Standard Contractual Clauses govern every transfer the Provider itself makes.

12.2 For the options in the Standard Contractual Clauses: Clause 7 (docking) applies; Clause 9 option 2 (general authorization) with the notice period of Section 6.2; Clause 11 optional language does not apply; Clause 13 and Clause 17: the law of [MEMBER STATE, e.g. Ireland]; Clause 18: the courts of [MEMBER STATE]. Annex I and Annex II of the Clauses are Annexes 1 and 2 of this DPA.

13.1 Each Party’s liability under this DPA is subject to the limitations and exclusions of liability in the Service agreement, except where those cannot be limited under applicable data-protection law.

13.2 This DPA takes effect on the Effective Date and remains in force as long as the Provider processes Customer Data. In case of conflict between this DPA and the Service agreement, this DPA prevails for the Processing of Personal Data.

13.3 This DPA is governed by the law that governs the Service agreement, except that the Standard Contractual Clauses are governed by the law chosen in Section 12.2.

For the Customer	For the Provider
Name: [NAME]	Name: [NAME]
Title: [TITLE]	Title: [TITLE]
Date: [DATE]	Date: [DATE]
Signature:	Signature:

---

Item	Description
Subject matter	Provision of the GPT Workspace Service: AI assistance inside Google Docs, Sheets, Slides, Forms, Gmail, Drive, Google Chat, the Chrome extension and MCP servers.
Duration	The term of the Service agreement, plus the retention periods in Annex 2.
Nature and purpose	Reading the content the user points at in their Google account, sending it with the user’s prompt to an AI model provider, and writing the answer back to the user’s file or chat. Account administration, billing and support.
Categories of Data Subjects	The Customer’s employees and contractors who use the Service; persons whose data appears in the Customer’s documents, spreadsheets, e-mails and files processed through the Service.
Types of Personal Data	Account data (name, e-mail address, profile picture, Google account identifier); billing data (billing name, address, VAT number); usage metadata (number of requests, dates, document titles); the content of the prompts and of the Google files, e-mails and attachments the user submits, which may contain any category of Personal Data the Customer places there.
Special categories	None by design. The Service does not require special-category data; the Customer decides what its users submit. [Customer to indicate if special categories are expected: NONE / DESCRIBE]
Frequency	Continuous, on each request a user makes.
Retention	See Annex 2, “Retention”.

Area	Measure
Certifications	ISO 27001 certified information security management system (audit report available). CASA Tier III (App Defense Alliance) assessment for the Google Workspace integration. Compliance with the Google API Services User Data Policy, including the Limited Use requirements.
Hosting	Google Cloud Platform (Firebase), United States, US East and US West regions. Components that process Customer Data run inside the Provider’s private network behind load balancers and a web application firewall.
Encryption	TLS 1.2 or higher for all data in transit. AES-256 server-side encryption at rest on Firebase, key management through GCP IAM. Google access and refresh tokens encrypted at rest.
No copy of Customer files	Google files, e-mails and spreadsheets are read in real time with the user’s own OAuth token and are not copied to the Provider’s storage. The only exception is a file the user attaches for file search, which is uploaded to an OpenAI vector store (see Annex 3): the search index is dropped 1 day after last use and the copy is deleted after 7 days.
Data controls	Folder-scoped Drive access: the Customer’s users can restrict the Service to chosen Drive folders and shared drives; files outside them are not listed, read, moved or shared. Zero-data-retention routing: model requests can be restricted to provider endpoints that do not store prompts or train on them. See https://support.gpt.space/resources/enterprise-data-controls.
Model providers	Used under API terms that prohibit training on the requests. The Provider never trains or fine-tunes a model on Customer Data.
Access control	Access to production systems restricted to authorized staff with individual accounts, multi-factor authentication and least privilege through GCP IAM. Per-user data isolation enforced by Firebase security rules. Multi-factor authentication is mandatory for every account with production access; access rights are reviewed weekly.
Monitoring and testing	GCP Security Command Center continuous vulnerability scanning of all assets in scope; vulnerability disclosure policy for external researchers.
Retention	Account data, chat threads, settings and usage metadata: 18 months after the user’s last activity, or 24 hours after a deletion request. Files attached for file search: search index dropped 1 day after last use, uploaded copy deleted after 7 days. Model gateway request logs: 30 days, support use only. Prompts and answers: processed in real time, not stored long term by the Provider. Invoices: the duration required by tax law.
Deletion	Self-service deletion of the account and all related data in the Service; deletion on request within 24 hours.
Business continuity	Native Google Cloud backup and multi-region availability tooling; full backups every 7 days.
Staff	Confidentiality obligations in employment and contractor agreements; security awareness for staff with production access.

The current list is maintained at https://gpt.space/trust and reproduced here as at the Effective Date.

Subprocessor	Purpose	Location
Google Cloud Platform / Firebase (Google LLC)	Hosting, database, storage, authentication, secrets	United States
OpenRouter, Inc.	Gateway that routes every model request to the provider below; request logs kept 30 days for support only, never used for training	United States
OpenAI	Text and image models; vector store for file search	United States
Anthropic	Claude models (pinned to Anthropic’s own endpoint)	United States
Google (AI Studio)	Gemini text and image models	United States
Perplexity	Web search models	United States
OpenRouter inference hosts	Inference hosts for the open-weight GLM-5.3-flash and gpt-oss-120b models	Via OpenRouter
Typesafe	Decision model behind the GPT_CLASSIFY formula	Via OpenRouter
Google Programmable Search	Stock image lookup for generated slides (query only)	United States
Stripe	Payments, invoices, billing portal	United States and Ireland, under the Stripe DPA
PostHog (self-hosted instance)	Product analytics	European Union
Sentry	Error monitoring	European Union (EU data region)