Data processing agreement

Last updated: 22 October 2026

This agreement is part of the terms of service and governs the processing of personal data that we carry out on behalf of the customer, under Article 28 of Regulation (EU) 2016/679 (GDPR). The customer is the controller; Galaxy TS is the processor.

1. Subject matter and duration

We host and operate the customer's Agentic Company environment: its workspace, gateway, orchestrator of the agents and storage. The processing lasts as long as the subscription, plus the 30 days in which the customer can export its data.

2. Nature and purpose

Storage, organisation and use of the data the customer puts into its environment, only to provide the service: running the agents' work, applying the customer's rules and approvals, keeping the audit trail, sending the environment's service emails.

3. Data subjects and categories of data

• The customer's users: name, email address, login, roles, department, authentication data (password hash, second-factor secret, recovery codes as hashes), the record of their actions and approvals, and the days on which each was active, kept as a hash so that only the number of active people per day can be read.
• People named in the customer's content - for example in the analyses and documents it uploads: whatever personal data those documents contain. Before any text is sent to an AI model, the environment replaces names with placeholders using the customer's dictionary.

The service is not designed for special categories of data (Article 9 GDPR); the customer agrees not to put them into its environment.

4. Our obligations

• We process the data only on the customer's documented instructions, which are these terms and the customer's use of the service. If an instruction seems to us to break the law, we tell the customer.
• The people who may access the data are bound to confidentiality, and access it only when the service needs it.
• We apply the security measures described in section 6.
• We help the customer, as far as the service allows, to answer the requests of data subjects and to meet its obligations on security, breach notification and impact assessments.
• We notify the customer of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it.
• At the end of the service we delete the environment and its data, after the 30 days in which the customer can export them, unless the law requires us to keep them.
• We make available the information needed to show that these obligations are met, and allow audits by the customer or an auditor it appoints, with reasonable notice and at the customer's cost.

5. Sub-processors

The customer authorises the following sub-processors:

We tell the customer at least 30 days before adding or replacing a sub-processor; the customer can object for reasonable grounds and, failing an agreement, cancel the subscription.

The AI model provider (Anthropic, DeepSeek) is chosen by the customer and called with the customer's own API key, under the customer's own contract with it: it is not our sub-processor. The customer is responsible for assessing that provider, including where its servers are; DeepSeek, for example, processes data in China. Only anonymized text is sent to the model.

6. Security measures

• Each customer has its own environment, in its own Azure resource group, in the Azure region it chose.
• Data encrypted in transit (TLS 1.2 or higher) and at rest.
• Secrets and keys kept in Azure Key Vault; the services authenticate with managed identities, without passwords in their configuration.
• Sign-in with a second factor of authentication for every user; sensitive actions require a recent sign-in.
• Text anonymized with the customer's dictionary before it reaches an AI model, with a check that no name in the dictionary is left.
• Actions that leave the company pass through the gateway, which applies the customer's rules and approvals, and are recorded in an audit trail protected by a hash chain.

7. Transfers outside the EU

The customer chooses the Azure region of its environment. We do not transfer the customer's data outside the European Economic Area, except where the customer chooses to, for example by choosing an AI provider outside it or a hosting region outside it (such as the United States or the United Kingdom).

Hosting in a region outside the European Economic Area is a transfer made on the customer's documented instruction. It relies on the safeguards of Microsoft's data protection terms: for the United States the EU-US Data Privacy Framework or the European Commission's standard contractual clauses, for the United Kingdom the European Commission's adequacy decision or the same clauses.