Data Processing Agreement

Last updated 29 September 2026Offchain Holding B.V.

This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Terms”) between Offchain Holding B.V., trading as Divergent Labs, with its registered office at Oudezijds Voorburgwal 171, Amsterdam, the Netherlands (“Processor”, “we”, “us”), and the Customer identified in the Terms (“Customer”, “you”). It applies to the extent that we process Customer Personal Data in the course of providing the Services, and is entered into upon acceptance of the Terms without the need for signature. A countersigned copy is available on request.

1. Definitions

1.1 Capitalised terms not defined in this DPA have the meaning given to them in the Terms. The terms “controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “supervisory authority” have the meanings given to them in the GDPR.

1.2 “Customer Personal Data” means personal data contained in Customer Content that we process on behalf of the Customer in providing the Services.

1.3 “Data Protection Law” means the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming), and, to the extent applicable, the UK GDPR and the Swiss Federal Act on Data Protection, each as amended or replaced from time to time.

1.4 “Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data to third countries set out in the Annex to Commission Implementing Decision (EU) 2021/914.

1.5 “Subprocessor” means any processor engaged by us to process Customer Personal Data.

2. Roles and scope

2.1 In respect of Customer Personal Data, the Customer acts as controller (or as processor on behalf of a third-party controller), and we act as processor (or subprocessor, as the case may be).

2.2 The subject matter, nature, purpose and duration of the processing, and the types of personal data and categories of data subjects, are described in Annex I.

2.3 This DPA does not apply to personal data for which we act as controller, which is governed by our Privacy Policy.

2.4 The Customer is responsible for ensuring that it has a lawful basis for the processing of Customer Personal Data, that it has provided all required notices to data subjects, and that its instructions comply with Data Protection Law.

3. Instructions

3.1 We shall process Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law to which we are subject. In that case, we shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.2 The Customer’s instructions are set out in the Terms and this DPA and are further given through the Customer’s use and configuration of the Services. Any additional instructions require prior written agreement.

3.3 We shall immediately inform the Customer if, in our opinion, an instruction infringes Data Protection Law, and may suspend the execution of that instruction until it is confirmed or modified.

4. Confidentiality

We shall ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to personnel who require it to perform the Services.

5. Security

5.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks for the rights and freedoms of natural persons, we shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by article 32 GDPR. These measures include those described in Annex II.

5.2 We may update these measures from time to time, provided that such updates do not result in a material reduction of the overall level of security.

5.3 The Customer is responsible for its own use of the Services, including securing its Credentials, configuring access rights for its Users, and determining which data it submits to the Services.

6. Subprocessors

6.1 General authorisation. The Customer grants a general written authorisation for us to engage Subprocessors. The Subprocessors engaged as of the date of this DPA are listed in Annex III.

6.2 Obligations. We shall impose on each Subprocessor, by way of a written contract, data protection obligations that provide at least the same level of protection as those set out in this DPA. We remain fully liable to the Customer for the performance of each Subprocessor’s obligations.

6.3 Changes. We shall notify the Customer by email of any intended addition or replacement of a Subprocessor at least 30 days in advance. The Customer may object to the change on reasonable grounds relating to data protection by notifying us in writing within that period. The parties shall discuss the objection in good faith. If no resolution is reached, the Customer may terminate the affected Services with effect from the date of the change, and we shall refund any prepaid and unused Fees for those Services.

6.4 Urgent replacement. Where a Subprocessor must be replaced urgently for reasons of security or continuity of service, we may do so on shorter notice. We shall notify the Customer as soon as reasonably practicable, and the Customer’s right to object under clause 6.3 applies.

7. International transfers

7.1 We shall not transfer Customer Personal Data to a country outside the European Economic Area, or permit a Subprocessor to do so, unless the transfer complies with chapter V GDPR. Where the recipient country is not subject to an adequacy decision, the transfer shall be based on the recipient’s certification under the EU–US Data Privacy Framework, where applicable, or on the Standard Contractual Clauses, together with any supplementary measures required following a transfer impact assessment.

7.2 Where the Customer is established in a third country not subject to an adequacy decision, and we transfer Customer Personal Data to the Customer, Module Four (processor to controller) of the Standard Contractual Clauses is incorporated into this DPA by reference. For the purposes of those clauses: the optional docking clause (clause 7) applies; clause 17 shall be governed by the laws of the Netherlands; the courts referred to in clause 18 shall be those of Amsterdam, the Netherlands; and Annexes I and II of the Standard Contractual Clauses shall be deemed completed with the information in Annexes I and II of this DPA.

7.3 To the extent transfers are subject to the UK GDPR or the Swiss Federal Act on Data Protection, the Standard Contractual Clauses apply as amended by the UK International Data Transfer Addendum or with the adaptations required by the Swiss Federal Data Protection and Information Commissioner, respectively.

8. Data subject requests

8.1 Taking into account the nature of the processing, we shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests from data subjects to exercise their rights under chapter III GDPR.

8.2 If we receive a request directly from a data subject relating to Customer Personal Data, we shall forward it to the Customer without undue delay and shall not respond to it other than to refer the data subject to the Customer, unless otherwise instructed by the Customer.

9. Personal data breaches

9.1 We shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 The notification shall, to the extent the information is available at that time, describe the nature of the breach, including the categories and approximate number of data subjects and personal data records concerned; the likely consequences of the breach; the measures taken or proposed to address the breach and mitigate its possible adverse effects; and the name and contact details of a point of contact. Where information is not available at the time of notification, it shall be provided in phases without undue further delay.

9.3 We shall take reasonable steps to contain, investigate and remediate the breach, and shall provide reasonable assistance to the Customer in meeting its obligations under articles 33 and 34 GDPR.

9.4 Our notification of or response to a personal data breach shall not be construed as an acknowledgement of fault or liability.

10. Assistance

Taking into account the nature of the processing and the information available to us, we shall provide the Customer with reasonable assistance in ensuring compliance with its obligations under articles 32 to 36 GDPR, including in carrying out data protection impact assessments and prior consultations with a supervisory authority. We may charge reasonable fees for assistance that goes beyond what is required by Data Protection Law.

11. Deletion and return

11.1 Upon termination of the Services, the Customer may retrieve Customer Personal Data within the period set out in the Terms. Thereafter, we shall delete Customer Personal Data, unless Union or Member State law requires its storage.

11.2 Customer Personal Data contained in backups shall be deleted in accordance with the ordinary backup rotation cycle and shall not be actively processed in the meantime, other than for the purpose of restoring the Services.

11.3 Any Customer Personal Data retained pursuant to clause 11.1 shall remain subject to this DPA for as long as it is retained.

12. Information and audits

12.1 We shall make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations laid down in article 28 GDPR, including responses to reasonable security questionnaires no more than once per year.

12.2 Where the information provided under clause 12.1 is insufficient to demonstrate compliance, or where required by a supervisory authority, we shall allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer and bound by confidentiality. Audits shall take place no more than once in any twelve-month period, on at least 30 days’ prior written notice, during normal business hours, subject to a scope agreed in advance, and in a manner that does not disrupt our operations or compromise the confidentiality of other customers’ data. The Customer shall bear the costs of the audit.

12.3 Audits of Subprocessors shall be conducted by means of the audit reports and certifications made available by those Subprocessors.

13. Liability

Each party’s liability arising out of or in connection with this DPA is subject to the limitations of liability in the Terms, except to the extent such limitation is not permitted under Data Protection Law.

14. Term, precedence and governing law

14.1 This DPA remains in force for as long as we process Customer Personal Data on behalf of the Customer.

14.2 In the event of any conflict between this DPA and the Terms, this DPA prevails with regard to the processing of Customer Personal Data. In the event of any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

14.3 This DPA is governed by the laws of the Netherlands, and the courts of Amsterdam have exclusive jurisdiction, without prejudice to the Standard Contractual Clauses.

Annex I: Description of the processing

Data exporter. The Customer, as identified in the Terms, acting as controller or processor.

Data importer. Offchain Holding B.V., Oudezijds Voorburgwal 171, Amsterdam, the Netherlands, acting as processor. Contact: nick@divergentlabs.xyz.

Categories of data subjects. As determined by the Customer, and which may include the Customer’s employees, contractors, end users and customers, and other individuals whose personal data is contained in Customer Content.

Categories of personal data. As determined by the Customer, and which may include any personal data contained in Customer Content, such as data contained in code, files, datasets, prompts and model outputs, logs, and model weights.

Special categories of personal data. The Services are not intended for the processing of special categories of personal data or personal data relating to criminal convictions and offences. Where the Customer nonetheless submits such data, the Customer is responsible for ensuring that the processing is lawful and that appropriate additional safeguards are in place.

Nature of the processing. Hosting, storage, computation, transmission, retrieval and deletion of Customer Content as necessary to provide the Services, including the execution of Customer workloads, the provision of sandbox environments, and model inference.

Purpose of the processing. The provision of the Services to the Customer in accordance with the Terms.

Frequency of transfer. Continuous, for the duration of the Customer’s use of the Services.

Duration of the processing. The term of the Terms, together with the period for retrieval and deletion set out in clause 11.

Annex II: Technical and organisational measures

1. Access control. Access to systems processing Customer Personal Data is restricted to authorised personnel on a need-to-know basis. Customer access to the Services requires authentication, and permissions within an Organisation are role-based.

2. Logical separation. Customer Content is logically separated between customers. Workloads of different customers are executed in isolated environments.

3. Encryption. Customer Personal Data is encrypted in transit over public networks using current industry-standard protocols. Stored credentials and secrets are protected using strong cryptographic methods, and data stores are encrypted at rest.

4. Credential protection. Passwords and access tokens are not stored in plain text. Secrets provided by the Customer are not disclosed through the Services after submission.

5. Network security. Production systems are segmented, and network access between components is limited to what is required for their operation.

6. Infrastructure management. Production infrastructure is managed through controlled, documented configuration. Operational secrets are held in a dedicated secrets management system.

7. Availability and resilience. Services are hosted with reputable infrastructure providers, deployed with redundancy, and backed up in accordance with the providers’ practices.

8. Logging and monitoring. Access and security events are logged and monitored to detect unauthorised access and misuse.

9. Incident management. We maintain procedures for identifying, responding to and notifying personal data breaches in accordance with clause 9.

10. Personnel. Personnel with access to Customer Personal Data are bound by confidentiality obligations and are informed of their data protection responsibilities.

11. Subprocessor management. Subprocessors are selected on the basis of their ability to provide sufficient guarantees for the protection of personal data, and are bound by written data processing agreements.

Annex III: Subprocessors

Last updated 29 September 2026.