Eden Gen Data Processing Agreement
Version 1.1. Effective 10 November 2026. Data Processing Agreement under Article 28 GDPR for business customers. It applies automatically to every workspace as part of the Terms of Service, and is attached to every Agency Master Services Agreement.
Parties
Customer (controller): the business named in the workspace or the Agency Order Form. Eden makers s.r.o., IČO 24518344, VAT CZ24518344, Plzeňská 3352/156, 150 00 Praha 5, Czech Republic (processor, "Eden makers").
This DPA forms part of the Eden Gen Terms of Service or the Agency Master Services Agreement (the "Agreement").
1. Subject and duration
1.1 Eden makers processes personal data contained in Customer Data on behalf of the Customer, only to provide Eden Gen under the Agreement. Details are in Annex 1.
1.2 This DPA lasts as long as Eden makers processes Customer Data.
2. Instructions
2.1 Eden makers processes Customer Data only on documented instructions from the Customer. The Agreement, the Customer's use of the Service (for example choosing a model and route, running a request, deleting a file) and this DPA are the Customer's instructions.
2.2 Eden makers will tell the Customer if it believes an instruction breaks data protection law.
2.3 When the Customer selects a route, the Customer instructs Eden makers to send the request, including any personal data in prompts and reference files, to the provider of that route.
3. Customer obligations
The Customer is responsible for the lawfulness of Customer Data, including a legal basis and, where needed, consent of people shown or heard in images, video and audio, and for not sending special category data unless necessary and lawful.
4. Confidentiality
Eden makers ensures that people authorised to process Customer Data are bound by confidentiality.
5. Security
Eden makers implements the technical and organisational measures in Annex 2 and may update them if the level of protection does not decrease.
6. Subprocessors
6.1 The Customer gives general authorisation to use the subprocessors in the Eden Gen Subprocessor List.
6.2 Eden makers will announce new subprocessors at least 14 days in advance on the list page and by email to workspace owners. The Customer may object on reasonable data protection grounds. If no solution is found, the Customer may terminate the affected service and receive a refund of unused prepaid fees for that service.
6.3 Eden makers imposes data protection obligations on subprocessors that are no less protective than this DPA, as far as the subprocessor's standard terms allow. For upstream AI providers, those are their standard business or API data processing terms.
6.4 BYOK Routes: when the Customer uses its own provider key, that provider processes data under the Customer's own contract with it. That provider is not a subprocessor of Eden makers.
7. International transfers
Some subprocessors process data outside the EEA (see the Subprocessor List). Eden makers relies on adequacy decisions (including the EU-US Data Privacy Framework where the recipient is certified) or Standard Contractual Clauses with those subprocessors.
8. Assistance
Eden makers helps the Customer, taking into account the nature of the processing, to respond to data subject requests, and with data protection impact assessments and prior consultations, where the Customer cannot do so with the Service's own tools.
9. Personal data breach
Eden makers notifies the Customer without undue delay and at the latest 48 hours after becoming aware of a personal data breach affecting Customer Data, with the information available at the time.
10. Deletion and return
Customer files (uploaded inputs and generated outputs) are deleted automatically 60 days after creation, or earlier when the Customer deletes them, unless an Agency Order Form sets another period. On termination, Eden makers deletes remaining Customer Data within 30 days, and deleted data rolls out of backups within 30 further days, unless law requires retention (for example invoices). The Customer can download outputs before that. Records that Eden makers keeps as controller for safety, security and accounting (moderation records, the provider call log, the request log and invoices) are kept for the periods in Section 6 of the Privacy Policy and are not covered by this deletion period.
11. Audits
Eden makers makes available the information needed to show compliance with Article 28 GDPR. The Customer may audit once per year with 30 days' notice, at its own cost, by a bound-to-confidentiality auditor, first by reviewing documents. An on-site audit is possible only where the documents do not reasonably show compliance.
12. Model training
Eden makers does not use Customer Data to train AI models. Upstream providers process Customer Data under their own API terms, which govern whether and how they may use and retain it. Eden makers gives no commitment about provider practices beyond those terms.
13. Liability and precedence
Liability follows the Agreement. If this DPA conflicts with the Agreement on data protection, this DPA prevails.
Annex 1: Details of processing
| Item | Description |
|---|---|
| Subject | Providing Eden Gen: routing generation requests to AI providers, storing and delivering inputs and outputs, billing |
| Nature | Collection, storage, transmission to providers, retrieval, deletion |
| Data subjects | People whose data appears in Customer prompts, uploaded references and outputs; Customer's workspace members |
| Categories of data | Images and video of people, audio and voice recordings, names or descriptions in prompts, any personal data the Customer includes; member email addresses |
| Special categories | Not intended. Biometric data may appear in images of faces and in voice recordings, but Eden Gen does not process it to identify people. |
| Duration | Term of the Agreement plus deletion period. Files: 60 days from creation. |
| Location | European Union for hosting, database and file storage, plus the providers listed in the Subprocessor List |
Annex 2: Technical and organisational measures
- Access: sign-in with a password (stored only as a salted scrypt hash), with a one-time email link (single use, 15 minutes, stored as hash) or with a Google or Apple account; a workspace owner can require Google sign-in for the workspace's own email domain; repeated failed sign-ins are locked out for a time; sessions last up to 30 days and end after 14 days without use; the admin console requires a second factor (time-based one-time code); roles owner and producer; API keys per use case with optional expiry and monthly caps; OAuth grants for MCP clients are limited to one project and a monthly cap, with access tokens valid for 1 hour and refresh tokens valid for 30 days; an API key reported to us as leaked is revoked at once and the workspace owners are told.
- Encryption: customer provider keys (BYOK) encrypted at rest with AES-256-GCM and decrypted only in the job worker. Data in transit is protected with TLS.
- Separation: data separated per workspace in every query.
- Logging: admin actions logged in an append-only audit table; API requests logged without request bodies.
- Abuse prevention: automated moderation of prompts and uploaded images, suspension rules, route and member kill switches.
- Pseudonymisation: providers receive a hashed end-user ID, not the email address.
- Availability: managed database with automated backups; backups roll off within 30 days.
- Deletion: files deleted 60 days after creation by an automatic job; storage bucket lifecycle rule as a second safeguard; API download links signed and valid 24 hours.
- Staff: confidentiality obligations; least privilege for production access; admin access is limited to named, verified accounts.
- Incident response: documented internal procedure; breach notice per Section 9.
Annex 3: Subprocessors
See the Eden Gen Subprocessor List, current version at edengen.ai/subprocessors.