Data Processing Agreement (DPA)
Last updated: September 26, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer") and Matic Broz s.p., trading as ProteinIQ ("ProteinIQ," "we," "us," or "our"), Veselova ulica 14, 3000 Celje, Slovenia. It applies when ProteinIQ processes Customer Personal Data on Customer's behalf and sets out the terms required by Article 28 of the GDPR.
This version was last updated on 26 September 2026. If you accepted an earlier version, this version applies to you from 26 October 2026.
1. Definitions
- "GDPR" means Regulation (EU) 2016/679.
- "Data Protection Laws" means the GDPR, the Slovenian Personal Data Protection Act (ZVOP-2), and any other data protection laws that apply to the processing.
- "Customer Personal Data" means personal data contained in User Content (as defined in the Terms of Service) that Customer or its users upload to or generate in the Service.
- "Subprocessor" means a third party engaged by ProteinIQ to process Customer Personal Data.
- Terms such as "controller," "processor," "processing," "personal data breach," and "data subject" have the meanings given in the GDPR.
2. Roles and Scope
2.1 Customer Personal Data
For Customer Personal Data, Customer is the controller (or a processor acting for its own controller), and ProteinIQ is the processor (or subprocessor).
2.2 Data ProteinIQ Controls
ProteinIQ is an independent controller for the personal data it needs to run its business, such as account and sign-in data, billing records, usage and credit records, security logs, and support correspondence. Our Privacy Policy describes that processing, and this DPA does not apply to it.
2.3 Scientific Data
Protein sequences, structures, molecules, and other scientific data that do not relate to an identifiable person are not personal data, and this DPA does not apply to them.
3. Details of Processing
| Item | Details |
|---|---|
| Subject matter | Providing the Service under the Terms of Service |
| Duration | For the term of the Terms of Service, plus the deletion period in Section 9 |
| Nature and purpose | Storing, transferring, and computing on User Content to run jobs, workflows, the AI Assistant, and Studio; displaying and exporting results; backups; support at Customer's request |
| Types of personal data | Whatever Customer includes in User Content, such as names or identifiers in file names, notes, and metadata, and, if Customer chooses to upload it, pseudonymized or identifiable genetic or health data |
| Data subjects | Customer's researchers, staff, and collaborators, and any research participants or other people whose data Customer includes |
| Special categories | Only if Customer uploads them; see Section 4.2 |
4. Customer Obligations
4.1 Lawful Instructions
Customer is responsible for having a lawful basis for the processing, for providing any required notices to data subjects, and for ensuring its instructions comply with Data Protection Laws. Customer's use of the Service in accordance with the Terms of Service, and its configuration of the Service, are its documented instructions.
4.2 Special Categories of Data
Customer will not upload special categories of personal data, such as identifiable genetic or health data, unless it has a lawful basis under Articles 6 and 9 of the GDPR and has removed direct identifiers where the research purpose allows. Customer is responsible for determining whether the Service's safeguards are appropriate for such data.
5. ProteinIQ Obligations
ProteinIQ will:
- Process Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise, in which case we will tell Customer first unless the law forbids it
- Tell Customer promptly if we believe an instruction infringes Data Protection Laws
- Ensure that anyone authorized to process Customer Personal Data is bound by confidentiality
- Implement the security measures in Section 6
- Engage Subprocessors only as described in Section 7
- Assist Customer, taking into account the nature of the processing, with data subject requests (Section 8), security, breach notification, data protection impact assessments, and prior consultations under Articles 32 to 36 of the GDPR
- Delete or return Customer Personal Data at the end of the Service as described in Section 9
- Make available the information needed to demonstrate compliance with this DPA and allow audits as described in Section 11
6. Security
6.1 Measures
We maintain appropriate technical and organizational measures, including:
- Encryption in transit (HTTPS/TLS) and at rest for our database and file storage
- Hosted tool jobs run in isolated compute containers
- Sign-in through Clerk, workspace-based access controls, and role-based permissions
- Access to production systems limited to the people who need it
- Security monitoring, logging, and rate limiting
- Automated backups with a 30-day retention period
- Review of security practices when we choose providers
We may update these measures as long as the overall level of protection does not decrease.
6.2 Personal Data Breaches
If we become aware of a personal data breach affecting Customer Personal Data, we will notify Customer without undue delay, and where feasible within 48 hours. The notice will describe, as far as we know at the time, the nature of the breach, the data and data subjects affected, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available and cooperate with Customer's own notifications.
7. Subprocessors
7.1 Current Subprocessors
Customer gives ProteinIQ general authorization to engage Subprocessors. Our current Subprocessors for Customer Personal Data are:
| Subprocessor | Service | Location |
|---|---|---|
| Vercel, Inc. | Application hosting | United States |
| Prisma Data, Inc. | Database hosting (Prisma Postgres) | United States |
| Cloudflare, Inc. | File storage (R2) and content delivery | United States |
| Modal Labs, Inc. | Running hosted tool jobs | United States |
| Clerk, Inc. | Sign-in and workspace membership | United States |
| Resend, Inc. | Email notifications, such as job completion emails | United States |
| OpenRouter, Inc., and the AI model providers it routes to | AI Assistant and Studio replies, for content Customer submits to them | United States and other countries |
Some structure prediction tools send the protein sequences they receive to the public ColabFold MSA server, operated by researchers at Seoul National University in South Korea, as part of the tool's standard method. That service is not engaged under contract and is not a Subprocessor. Customer should not submit Customer Personal Data to those tools.
7.2 Subprocessor Obligations
We will impose data protection obligations on each Subprocessor that are no less protective than this DPA, as far as they apply to the services it provides. We remain responsible to Customer for our Subprocessors' performance of those obligations.
7.3 Changes
We will update the list above and, for Customers who have asked to be notified by writing to privacy@proteiniq.io, send an email at least 30 days before a new Subprocessor begins processing Customer Personal Data. Customer may object on reasonable data protection grounds within that period. If we cannot address the objection, Customer may terminate the affected Service and receive a refund of any prepaid fees for the unused period.
8. Data Subject Requests
If we receive a request from a data subject about Customer Personal Data, we will pass it to Customer and not respond ourselves unless Customer authorizes us to. The Service lets Customer access, export, correct, and delete User Content. Where Customer cannot fulfil a request with these features, we will provide reasonable assistance. We may charge a reasonable fee for assistance that requires significant work beyond the standard features.
9. Deletion and Return
Customer can export User Content at any time using the Service's export features. When Customer deletes User Content or its account or workspace, we delete the related Customer Personal Data from active systems within 30 days, and from backups when they expire after 30 days, unless the law requires us to keep it.
10. International Transfers
ProteinIQ is established in the European Union. When Subprocessors process Customer Personal Data outside the European Economic Area, we rely on the EU–U.S. Data Privacy Framework where the Subprocessor is certified, and otherwise on the European Commission's Standard Contractual Clauses (Module 3, processor to processor), together with supplementary measures such as encryption.
If Customer is located outside the European Economic Area and we transfer Customer Personal Data back to Customer, the Standard Contractual Clauses (Module 4, processor to controller) apply to that transfer where the GDPR requires them, and are incorporated into this DPA by reference.
11. Audits
On written request, and no more than once a year unless required by a supervisory authority or following a personal data breach, we will provide the information reasonably needed to demonstrate compliance with this DPA, such as descriptions of our security measures and relevant Subprocessor certifications. If that information is not sufficient, Customer may conduct an audit, itself or through an independent auditor bound by confidentiality, on at least 30 days' notice, during normal business hours, without disrupting the Service, and at Customer's cost.
12. Liability
Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Laws do not allow those limitations.
13. General
13.1 Precedence
If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.
13.2 Changes
We may update this DPA to reflect changes in Data Protection Laws, our Subprocessors, or our practices. We will give at least 30 days' notice of material changes. Changes will not reduce the protection of Customer Personal Data.
13.3 Governing Law
This DPA is governed by the law that governs the Terms of Service, except where Data Protection Laws or the Standard Contractual Clauses require otherwise.
14. Contact
Email: privacy@proteiniq.io Operator: Matic Broz s.p., trading as ProteinIQ Address: Veselova ulica 14, 3000 Celje, Slovenia
We have not appointed a data protection officer because we are not required to.