Data Processing Addendum

Terms not defined here have the meaning given in the EU General Data Protection Regulation (“GDPR”) or the UK GDPR. “Personal Data”, “Data Subject”, “Processing”, “Controller”, and “Processor” carry their GDPR meanings.

You are the Controller of Personal Data submitted to the Service. CyberTwin is the Processor. CyberTwin processes the Personal Data only on your documented instructions, including transfers to third countries, except as required by law.

• Subjects: your employees, contractors, customers' personnel referenced in environment data, integration users.
• Categories: identifiers (name, email), professional context (role, organization, MFA status), audit-trail data (sign-ins, configuration changes), and any Personal Data you choose to upload via documents.

We do not require, and we recommend you do not submit, special-category Personal Data (health, biometric, genetic, religious, political, sex life). If you do, you remain the Controller and warrant that you have an appropriate legal basis.

Current subprocessors are listed at cybertwin.io/subprocessors and on our Trust & security page. We will notify you in writing 30 days before adding a subprocessor. You may object on reasonable grounds; if we cannot accommodate the objection, you may terminate the affected portion of the Service for a prorated refund.

The list states, for each subprocessor, what it does, where it processes data and what it receives. Our AI subprocessor's retention: Anthropic’s published policy is to delete API inputs and outputs within 30 days of receipt or generation, keeping them longer only if a request is flagged under its Usage Policy (up to 2 years) or the law requires it. Shorter retention, down to none, needs a separate agreement with Anthropic; we do not have one today.

For transfers of Personal Data from the EEA, UK, or Switzerland to a third country lacking an adequacy decision, the EU Standard Contractual Clauses (Module 2 — Controller to Processor) and, where applicable, the UK International Data Transfer Addendum are deemed incorporated and govern the transfer.

Our hosting and database are in Frankfurt, in the EU. Counting every subprocessor, Personal Data is processed today in the EU, the United States and Japan; the subprocessor list gives each one's region.

We implement the technical and organizational measures described on our Trust & security page, including TLS 1.2 or higher in transit, encryption at rest, integration credentials encrypted at rest with a server-side key (AES-256-GCM), and audit logging. SOC 2 readiness is underway; no auditor is engaged yet. We can update these measures as long as the level of protection is not reduced.

We notify you without undue delay, and in any event within 72 hours of becoming aware of a Personal Data breach affecting your data. Notifications include the categories and approximate volumes of records affected, the likely consequences, and the measures taken or proposed.

We assist you in responding to Data Subject access, rectification, deletion, restriction, portability, and objection requests, taking into account the nature of the processing. Data export (supporting access and portability) is self-serve from Settings → Data management; deletion and other requests can be addressed to privacy@cybertwin.io.

On reasonable written notice, and not more than once per year except after a Personal Data breach, you may audit our compliance with this DPA. We satisfy audit obligations through our security-controls documentation (available under NDA). SOC 2 readiness is underway; no auditor is engaged yet, so no SOC 2 report exists today.

On termination of the Service, Personal Data remains available for export for 90 days, is retained a further 90 days for re-activation, and is then deleted — 180 days total — except as legally required to retain. Backups expire on their normal cycles. Deletion is handled manually today: we run it by hand, not by an automatic job.

In case of conflict, this DPA controls over the Terms of Service for matters relating to Personal Data Processing.

Acceptance of these terms by your authorized representative (in-app, by email, or by signed order form) constitutes execution of this DPA on behalf of the Controller.