Data Processing Agreement
Last updated:
This Data Processing Agreement (“DPA”) forms part of the agreement between Galaxies Ltda. (“Galaxies,” “we,” or “us,” acting as Processor / Operadora) and the Client identified in the applicable commercial proposal or software license agreement (“Client,” acting as Controller / Controladora). It applies whenever Galaxies processes personal data on the Client's behalf in connection with the Platform, and is incorporated by reference into the Terms of Service, above. If this DPA conflicts with the Terms on a data protection matter, this DPA controls.
The specific terms of a signed DPA can vary by enterprise contract — write to contato@galaxies.gg for a countersigned copy. What follows is our standard template.
1. Definitions
Controller / Controladora — the party that decides why and how personal data is processed. Ordinarily, the Client.
Processor / Operadora — the party that processes personal data on the Controller's instructions. Ordinarily, Galaxies.
Sub-processor — any third party Galaxies engages to process personal data on the Client's behalf.
Data Protection Laws — LGPD, GDPR, CCPA, and any other data protection law applicable to the processing under this DPA.
Personal Data, Data Subject, Processing, International Transfer — have the meanings given in the Glossary of the Privacy Policy, above.
2. Subject matter and duration
Galaxies processes personal data on the Client's behalf for the duration of the underlying commercial agreement, for the purpose of providing and supporting the Platform. This DPA terminates automatically when that agreement ends, subject to Section 12 (Deletion and return of data).
3. Nature and purpose of processing
Galaxies processes personal data to operate, secure, and support the Platform: authenticating Users, running Synthetic Personas, storing Client content, providing customer support, and maintaining service logs.
4. Categories of data and data subjects
Categories of data — contact and registration data, navigation data, Platform usage data, and any additional data the Client uploads to or generates on the Platform in the course of using it.
Categories of data subjects — the Client's employees, contractors, and other Users authorized to access the Platform; and, where the Client uploads such data, the Client's own customers or research participants.
The Client will not upload sensitive personal data to the Platform unless a separate written agreement with Galaxies specifically addresses that data.
5. Processor obligations
Galaxies agrees to:
process personal data only on the Client's documented instructions, including regarding international transfers, unless required to do otherwise by law — in which case Galaxies will inform the Client, unless prohibited from doing so;
ensure that people authorized to process personal data are bound by confidentiality;
implement the technical and organizational measures described in Section 8;
assist the Client, at the Client's cost where the assistance requires material resources, in responding to data subject requests and in meeting the Client's obligations around security, breach notification, and data protection impact assessments;
delete or return personal data at the end of the engagement, per Section 12;
make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits per Section 11.
6. Client obligations
The Client warrants that it has a valid legal basis for the personal data it provides to Galaxies or uploads to the Platform, and that its instructions to Galaxies comply with applicable Data Protection Laws. The Client is responsible for the accuracy, quality, and legality of the personal data it provides.
7. Sub-processors
The Client authorizes Galaxies to engage sub-processors to support the Platform, including the cloud infrastructure and AI providers described in the Terms of Service and Privacy Policy, above (including Google, OpenAI, and Anthropic, among others). Galaxies imposes data protection obligations on its sub-processors that are substantially similar to those in this DPA, and remains responsible for their performance. Galaxies will give the Client reasonable notice of any new sub-processor that will materially change how personal data is handled, so the Client can object on reasonable data-protection grounds.
8. Security measures
Galaxies maintains technical and organizational measures appropriate to the risk, including:
encryption of personal data in transit and, where appropriate, at rest;
access controls limiting personal data access to personnel who need it;
logging and monitoring of access to systems that process personal data;
regular review of these measures as the Platform and threat landscape evolve.
9. International transfers
Where Galaxies or its sub-processors transfer personal data outside the country where it was collected, including to the United States, Galaxies relies on the safeguards described in the Privacy Policy above (Section 7) and, where required, standard contractual clauses or an equivalent mechanism recognized under the applicable Data Protection Law.
10. Personal data breach notification
Galaxies will notify the Client without undue delay after becoming aware of a personal data breach affecting the Client's data, and will provide the information reasonably available to it to help the Client meet its own notification obligations.
11. Audits
On reasonable prior written notice, and no more than once per year absent a security incident, the Client may request evidence of Galaxies' compliance with this DPA, which Galaxies will provide through documentation, certifications, or a mutually agreed audit that doesn't unreasonably disrupt Galaxies' operations or expose other clients' data.
12. Deletion and return of data
At the Client's request, or automatically at the end of the underlying commercial agreement, Galaxies will delete or return the personal data it processed on the Client's behalf, except where retention is required by law — in which case Galaxies will continue to protect it under this DPA's terms.
13. Liability
Each party's liability under this DPA is subject to the limitations of liability set out in the Terms of Service, above.
14. Term, governing law, and contact
This DPA takes effect when the Client's commercial agreement with Galaxies takes effect and remains in force for as long as Galaxies processes personal data on the Client's behalf. It's governed by the laws of the Federative Republic of Brazil, consistent with the Terms of Service. Questions about this DPA, or to request a countersigned
copy: contato@galaxies.gg.