Data Processing Agreement

This Data Processing Agreement (“DPA”) is between Venom Labs, S.L. (NIF B05853908), Urbanización Reserva de Marbella, Fase 2, Manzana 3, Bloque 7, Piso 7309, 29604 Marbella (Málaga), Spain (“Venom”, “we”, “us”), and the organization that uses the Venom website, web app, and MCP server (the “Service”) under our Terms of Service (“Customer”, “you”). It forms part of the Terms and sets out how Venom processes personal data on Customer’s behalf, as Article 28 of the EU General Data Protection Regulation (“GDPR”) requires.

Customer accepts this DPA by accepting the Terms and using the Service. No signature is needed. If you’d like a copy signed by both parties, email support@venomlabs.dev with your organization’s legal name and address. If Customer has signed a separate agreement with Venom that includes data processing terms, those terms take precedence where they conflict with this DPA.

1. Roles and scope

• Customer is the controller of the personal data in its workspace (“Customer Personal Data”), and Venom processes it as Customer’s processor. Where Customer is itself a processor for another controller, Venom is its subprocessor, and Customer passes on that controller’s instructions.
• Customer Personal Data is the personal data in what Customer, its members, and the AI clients they connect put into the Service: projects, tasks, task briefs, log entries, artifacts, skills, and settings; the organization’s teams and its members’ roles and handles; and the credentials Customer stores for third-party MCP servers.
• Venom is a separate controller, not a processor, for each user’s account and sign-in, for billing, product analytics, security and abuse prevention, and sales and support requests, and for its own legal obligations. Our Privacy Policy covers that processing; this DPA does not.

2. Subject matter, duration, nature, and purpose

• Subject matter: providing the Service to Customer under the Terms.
• Duration: for as long as Customer uses the Service, and then until Customer Personal Data is deleted under section 11.
• Nature: hosting and storing Customer Personal Data; organizing and showing it in the web app; reading and writing it through the MCP server for the AI clients that Customer’s members connect; forwarding agents’ requests, with the stored credentials, to the third-party MCP servers Customer adds; sending the Service’s emails, such as invitations and mention notifications; keeping backups; and securing the Service.
• Purpose: Venom uses Customer Personal Data, like all of Customer’s content, only to provide, secure and support the Service for Customer, and as the law requires. Venom does not use it to train or improve AI or machine-learning models, does not sell it, does not use it for advertising, and does not use it for any other purpose of its own. Venom does not run AI models.

3. Data subjects and categories of data

Data subjects

• Customer’s members and the people it invites, such as employees and contractors.
• People whom Customer’s members or AI clients mention or describe in Customer’s content, such as colleagues, customers, or users of Customer’s own products.

Categories of personal data

• Names, email addresses, roles, team memberships, and handles, including handles on other services that Customer links to a member (for example, a GitHub username).
• Who wrote each log entry, and with which AI client.
• Any other personal data that Customer chooses to put in its projects, tasks, logs, artifacts, and skills.
• Credentials for third-party MCP servers, stored encrypted.

Special categories

The Service is not designed for special categories of personal data (GDPR Article 9) or data about criminal convictions and offences (Article 10), and has no specific safeguards for them: content is visible to the organization’s members with access, can be read by the AI clients they connect, and can appear in excerpts in notification emails. Customer must not put such data into the Service unless Venom has agreed in writing to additional safeguards.

4. Customer’s instructions

• Venom processes Customer Personal Data only on Customer’s documented instructions. The Terms, this DPA, and Customer’s use and configuration of the Service, including the actions of its members and the AI clients they connect, are those instructions. Further instructions must be in writing and consistent with the Terms.
• If EU or Member State law requires Venom to process Customer Personal Data in another way, Venom tells Customer about that legal requirement before processing, unless that law prohibits this on important grounds of public interest.
• Venom immediately tells Customer if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection law.
• Customer is responsible for having a lawful basis for the processing, for the instructions it gives, and for the personal data it puts into the Service.

5. Venom’s obligations

• Confidentiality. Venom gives access to Customer Personal Data only to staff who need it to run and support the Service and who are bound by confidentiality. Venom’s directors are bound by a statutory duty of secrecy, and everyone involved in the processing by the duty of confidentiality in Article 5 of Spain’s Organic Law 3/2018; anyone else given access signs a written confidentiality undertaking first.
• Security. Venom protects Customer Personal Data with the measures in section 7.
• Assistance. Taking into account the nature of the processing and the information available to it, Venom helps Customer meet its obligations under GDPR Articles 32 to 36: security, breach notification, data protection impact assessments, and prior consultation. Venom also tells Customer without delay if it becomes aware that Customer Personal Data it processes is inaccurate or out of date.
• Records. Venom keeps the record of processing activities that GDPR Article 30(2) requires.
• Requests from authorities. If a public authority asks Venom for Customer Personal Data, Venom refers it to Customer where the law allows, tells Customer unless the law prohibits it, and discloses only what the law requires.

6. Subprocessors

Customer gives Venom general authorization to engage subprocessors. Venom uses these service providers. Some receive no workspace content; they are listed so that this list matches our Privacy Policy.

• Amazon Web Services: Hosting, databases, file storage, sign-in (Amazon Cognito), email delivery (Amazon SES), and encryption keys. EU (Ireland, eu-west-1).
• Stripe: Payment processing for paid plans. Receives billing contacts and payment details, not workspace content. May process data outside the EEA, including in the US.
• Google: Optional “Sign in with Google”, and Google Workspace for our support email, which holds what you send to support. May process data outside the EEA, including in the US.
• PostHog: Product analytics for the website, the web app, and our servers. Receives usage events from our servers linked to account and organization IDs, and browser events from the website and the web app that aren’t linked to any account or organization; never workspace content. EU (Frankfurt, Germany). PostHog staff may access it from the US.
• Cloudflare: DNS for venomlabs.dev, and Turnstile, which checks that email sign-ups come from a person. Traffic to the Service does not pass through Cloudflare. May process data outside the EEA, including in the US.
• Attio: Customer relationship management. Receives what people send through our contact sales form, and for each person who signs up their name, email address, whether they signed in with Google or email, and the names of organizations they create or are invited to; never workspace content. May process data outside the EEA, including in the US.
• Slack: Our team’s internal messaging. Receives a message for each person who signs up with their name, email address, whether they signed in with Google or email, and the names of organizations they create or are invited to; never workspace content. May process data outside the EEA, including in the US.

• AI clients and third-party MCP servers that Customer’s members choose to connect are not Venom’s subprocessors. Customer engages them directly, under their providers’ own terms, and Venom passes data to them on Customer’s instructions.
• Venom engages each subprocessor under a written contract that imposes on it, in substance, the same data protection obligations as this DPA imposes on Venom, as far as they apply to the service it provides. At Customer’s request, Venom provides a copy of those terms (it may redact commercial or confidential information). Venom remains fully responsible to Customer for its subprocessors’ performance of those obligations, and tells Customer if a subprocessor fails to fulfil them in a way that affects Customer Personal Data.
• Changes. Venom updates this list, and emails Customer’s owners, at least 30 days before a new subprocessor starts processing Customer Personal Data. Customer can object in writing within that period on reasonable data protection grounds, and the parties will discuss the objection in good faith. If they can’t resolve it, Customer may end the Terms before the new subprocessor starts processing Customer Personal Data, with a pro rata refund of any fees paid for the period after termination.

7. Security measures

Venom maintains the technical and organizational measures below, described in more detail on our Security page. Venom may change them over time, but won’t reduce the overall level of protection.

• Location. The Service runs on Amazon Web Services in the EU (Ireland, eu-west-1). Our AWS organization policy blocks the use of other AWS regions for these services.
• Encryption in transit. Connections to the Service use HTTPS with TLS 1.2 or 1.3, and plain HTTP requests are redirected to HTTPS. Traffic between our own services stays inside our AWS virtual private network and is not encrypted with TLS inside that network.
• Encryption at rest. Stored files are encrypted in Amazon S3 with AES-256, and our databases are encrypted at rest with keys owned and managed by AWS. Credentials for third-party MCP servers are encrypted with a dedicated AWS Key Management Service key that rotates automatically. Of our services, only the one that stores a credential can encrypt it, and only the one that uses it can decrypt it. The MCP access and refresh tokens we issue are stored only as one-way SHA-256 hashes.
• Access control. Sign-in is handled by Amazon Cognito, with passwords of at least 12 characters that include upper-case and lower-case letters and a number, or with Google. Every request is checked against the user’s live membership and role in the organization before data is read or written. AI clients connect with OAuth 2.1 and PKCE, to one organization per connection. Access tokens last 1 hour; refresh tokens are replaced each time they are used (the old one can still be used once within 60 seconds, so that a retried request doesn’t fail) and expire after 30 days without use.
• Network. Only the web app and the MCP server accept traffic from the internet, through our load balancer. The services that hold account and project data accept connections only from our own services.
• Staff access to production. Production runs in its own AWS account, separate from development. People sign in through AWS single sign-on with time-limited sessions, and the root user of the production and development accounts is blocked. AWS CloudTrail records administrative activity to a separate security account, with log file validation, and keeps it for 400 days.
• Change management. Changes are normally made through pull requests that run our automated checks. Deployments run through GitHub Actions with short-lived AWS credentials, not stored access keys, and production deploys are started by hand from the main branch.
• Resilience. In production, the project and task database has point-in-time recovery, and the account and project databases are protected against accidental deletion. Earlier versions of stored files are kept for 90 days.
• Certifications. Venom does not yet hold a SOC 2 report or ISO 27001 certification.

8. International transfers

• Venom stores Customer Personal Data in the EU (Ireland). The subprocessors in section 6 that may process data outside the European Economic Area are marked there.
• Venom transfers Customer Personal Data outside the EEA only with a safeguard that Chapter V of the GDPR recognizes: an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for certified providers, or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”), Module 3 (processor to processor), in Venom’s contracts with its subprocessors.
• If Customer is established outside the European Economic Area and is not subject to the GDPR for this processing, the SCCs, Module 4 (processor to controller), apply to Venom’s transfers of Customer Personal Data to Customer, and are incorporated into this DPA by reference. For them: Customer is the data importer and Venom the data exporter; sections 2, 3, and 7 complete the annexes; the optional Clause 7 and the option in Clause 11 do not apply; and Clauses 17 and 18 choose Spanish law and the courts of Spain.
• Where a Customer that is itself a processor engages Venom as a subprocessor, or the parties’ roles otherwise require it, the module of the SCCs that matches the roles applies on the same terms, with Clause 9 Option 2 (general authorization) and the notice period in section 6 where that module includes Clause 9, and the Spanish Agencia Española de Protección de Datos as the competent supervisory authority under Clause 13 where it applies.
• Customer can ask for a copy of these safeguards at support@venomlabs.dev.

9. Data subjects’ rights

• Customer’s members can correct and remove much of Customer Personal Data in the web app: they can edit and delete log entries, edit artifacts, projects, tasks, and skills, and archive them; owners and admins can change members’ roles and deactivate members, and the organization’s primary owner can delete the organization. Archived items, artifact revisions, and deactivated members’ records stay until the organization is deleted, unless Customer asks Venom to delete them.
• Where those features aren’t enough, Venom helps Customer, on request to support and taking into account the nature of the processing, to answer requests from data subjects who exercise their rights under the GDPR. On Customer’s request, Venom deletes specific items, such as an artifact and its revisions, or a deactivated member’s records, within one month.
• If a data subject contacts Venom directly about Customer Personal Data, Venom refers them to Customer and tells Customer. Venom does not answer the request itself unless Customer asks it to or the law requires it.

10. Personal data breaches

• Venom notifies Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. Venom sends the notice by email to Customer’s owners.
• The notice describes, as far as Venom knows them: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed to address it, and a contact for more information. Information that isn’t available at first follows as soon as it is.
• Venom takes reasonable steps to contain and investigate the breach and to reduce its effects, and helps Customer meet its own notification obligations. Notifying a breach is not an admission of fault.

11. Deletion and return at the end of the Service

• Customer Personal Data stays in the Service until an owner deletes the organization or the Terms end. Ending a paid plan doesn’t delete it: the organization moves to the Free plan, as the Terms describe.
• At any time before deletion, Customer can retrieve its content through the MCP server and the web app, and can ask support@venomlabs.dev for a complete copy in a structured, machine-readable format (JSON, with skills and artifacts as their original files). Venom provides it free of charge within 30 days of the request. If Customer switches to another provider, the switching and export terms in the Terms and on our Data Act page also apply.
• When the Terms end for any reason, Customer decides whether Venom deletes Customer Personal Data or returns it first. If Customer doesn’t choose within the data retrieval period in the Terms, Venom deletes it at the end of that period.
• When an owner deletes the organization, Venom starts deleting its workspace content, teams, members’ roles, and the third-party API keys stored for it straight away, normally completing within minutes, and removes copies in backups and earlier file versions within 100 days. Members’ personal sign-ins to third-party MCP servers made through the organization are deleted when they disconnect them, or on request to support. On request, Venom confirms the deletion in writing.
• If EU or Spanish law requires Customer Personal Data to be kept, Venom returns it to Customer instead of keeping it, unless that law requires Venom itself to keep it. Venom may keep data, blocked from any other use, only while liabilities arising from its relationship with Customer can still be claimed (Article 33 of Spain’s Organic Law 3/2018), and protects it under this DPA for as long as it does.

12. Audits

• Venom makes available to Customer the information needed to demonstrate compliance with GDPR Article 28: this DPA, our Security page, and written answers to Customer’s reasonable security and data protection questions.
• If that isn’t enough, or a supervisory authority requires it, Customer may audit Venom’s compliance, including by inspection, itself or through an independent auditor who is bound by confidentiality and is not a competitor of Venom. Customer gives at least 30 days’ written notice, audits no more than once in any 12 months unless a personal data breach, an authority, or indications of non-compliance by Venom justify an earlier audit, avoids unreasonable disruption to the Service and access to other customers’ data, and bears its own costs.
• In deciding on an audit, Customer may take into account any relevant certifications Venom holds. The parties make the information in this section, including the results of any audit, available to the competent supervisory authority on request.

13. Liability

Each party’s liability under this DPA is subject to the Terms’ limitation of liability, to the extent the law allows. Nothing in this DPA limits either party’s liability to data subjects under GDPR Article 82, under the SCCs where they apply, or where the law does not allow it to be limited.

13a. Non-compliance and termination

• Venom tells Customer promptly if it can’t comply with this DPA for any reason. Customer may then instruct Venom to suspend processing, by stopping use of the affected part of the Service, until Venom complies or the Terms end.
• Customer may terminate the Terms with immediate effect, with a pro rata refund of fees paid for the period after termination, if processing has been suspended and compliance isn’t restored within one month, if Venom is in substantial or persistent breach of this DPA or the GDPR, or if Venom fails to comply with a binding decision of a court or supervisory authority about its obligations under them.
• Venom may terminate the processing concerned if, after Venom has told Customer that an instruction infringes the law, Customer insists on it.

14. Precedence, changes, and governing law

• Where this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. Where the SCCs apply and conflict with this DPA, the SCCs prevail.
• Venom may update this DPA to follow new legal requirements or changes to the Service, and updates the date above when it does. Venom emails Customer’s owners at least 30 days before a change that reduces Customer’s rights or Venom’s obligations takes effect, unless the law requires the change sooner. If Customer objects on reasonable data protection grounds, Customer may end the Terms before the change takes effect, with a pro rata refund of fees paid for the period after termination. Changes that only add protections can take effect straight away, and changes to the subprocessor list follow section 6.
• This DPA is governed by the same law, and subject to the same courts, as the Terms, except where the SCCs or data protection law require otherwise.

15. Contact

Questions about this DPA, requests for a signed copy, and notices under it: support@venomlabs.dev.
Venom Labs, S.L., NIF B05853908, Urbanización Reserva de Marbella, Fase 2, Manzana 3, Bloque 7, Piso 7309, 29604 Marbella (Málaga), Spain. Registro Mercantil de Málaga, inscripción en trámite.