Skip to main content

Data Processing Addendum (DPA)

Applies ToTalos Cloud Enterprise B2B
Effective DateSeptember 21, 2026
Legal FrameworkEU SCCs / GDPR Art. 28
Breach SLA72 Hours Written Notice

This Data Processing Addendum ("DPA") supplements the Talos Terms of Service ("Agreement") entered into by and between Talos RPA Suite Inc. ("Talos") and the Customer. This DPA governs the processing of Personal Data in connection with the Customer’s use of the Talos RPA Suite (comprising Talos Cloud and Talos Agent).

1. PURPOSE & ROLES DEFINITION​

1.1 Scope​

This DPA applies when and to the extent that Talos processes Personal Data on behalf of Customer in the course of providing services under the Agreement, where such Personal Data is subject to Data Protection Laws (such as GDPR, CCPA, or UK Data Protection Act).

1.2 Roles of the Parties​

  • Customer as Data Controller: Customer acts as the Data Controller (or "Business" under the CCPA) with respect to the Personal Data processed. Customer is solely responsible for obtaining necessary consents, ensuring the legality of its collection, and establishing the legal basis for processing such Personal Data.
  • Talos as Data Processor: Talos acts as the Data Processor (or "Service Provider" under the CCPA) with respect to the Personal Data processed on behalf of Customer. Talos will process Personal Data strictly in accordance with Customer’s documented instructions, the Agreement, and this DPA.

2. STANDARD CONTRACTUAL CLAUSES (SCCS) & TRANSFERS​

2.1 Cross-Border Data Transfers​

Customer acknowledges that the processing of Personal Data under the Agreement may involve a transfer of data to jurisdictions outside of the European Economic Area (EEA), Switzerland, or the United Kingdom.

2.2 Incorporation of Standard Contractual Clauses​

To the extent that Personal Data is transferred from the EEA to a country not recognized as providing an adequate level of data protection, the parties hereby incorporate by reference the Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914, Module Two: Controller-to-Processor), as updated from time to time. For purposes of the SCCs:

  • Customer is the "data exporter."
  • Talos is the "data importer."
  • The governing law of the SCCs shall be the law of the Republic of Ireland.
  • The competent supervisory authority shall be the Irish Data Protection Commission.

3. TECHNICAL & ORGANIZATIONAL SECURITY MEASURES​

Talos shall implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These security measures include:

3.1 Network Security and Encryption​

  • TLS Encryption: All communications and data transfer between the central Talos Cloud dashboard and the local native Talos Agent endpoints are encrypted in transit using TLS 1.3 or higher.
  • AES Encryption: All customer data and process files stored at rest inside the Talos Cloud databases are encrypted using AES-256 or higher.

3.2 Access Controls & Authorization​

  • Principle of Least Privilege: Access to systems containing Personal Data is strictly restricted to authorized Talos employees and contractors who have a business need to know, are bound by written confidentiality obligations, and have undergone security training.
  • Multi-Factor Authentication (MFA): Multi-factor authentication is enforced across all cloud administrative consoles, database layers, and developer environments.

3.3 Security Assessments & Audits​

  • Vulnerability Scanning: Automated quarterly external vulnerability scanning and continuous internal security code analysis (SAST/DAST) are performed on all platform environments.
  • Intrusion Detection: Real-time intrusion detection and security monitoring systems (SIEM) are deployed across the Cloud cluster infrastructure.

3.4 Incident Response & Data Breach Notification​

In the event that Talos becomes aware of a confirmed security incident resulting in the unauthorized access, disclosure, alteration, or destruction of Customer Personal Data (a "Security Incident"), Talos will:

  1. Notification: Notify Customer in writing without undue delay, and in any event within seventy-two (72) hours of confirming the incident.
  2. Mitigation: Take immediate and reasonable steps to mitigate the impact of the Security Incident and prevent further unauthorized disclosures.
  3. Cooperation: Provide Customer with reasonable cooperation and information regarding the nature of the incident, the categories of data compromised, and the remediation efforts taken by Talos, enabling Customer to meet its disclosure obligations under Data Protection Laws.

4. SUBPROCESSORS​

Customer grants general written authorization to Talos to engage third-party subprocessors to perform specific processing activities on behalf of Talos. An up-to-date list of subprocessors is available in the Talos Privacy Policy.

4.2 Subprocessor Obligations​

Talos shall ensure that any subprocessor it engages is bound by written contracts requiring them to provide at least the same level of data protection and security controls as those required of Talos under this DPA. Talos remains fully liable to Customer for the performance of its subprocessors’ obligations.

4.3 Notification of Changes​

Talos will notify Customer of any intended changes or additions to its subprocessor list at least fifteen (15) days in advance by updating the Privacy Policy webpage or sending a direct system alert. Customer may object to the appointment of a new subprocessor on reasonable, data-protection-related grounds within ten (10) days of receiving such notification.

5. REPATRIATION & DELETION OF DATA​

5.1 Deletion upon Agreement Expiration​

Upon expiration or termination of the Agreement, Talos shall, at Customer's choice, securely delete or return all Customer Personal Data stored within the Talos Cloud database, unless applicable law or standard backup rotation cycles require the retention of certain records.

5.2 Backup Data Purge​

Personal Data retained in automated disaster-recovery backups will remain secure and encrypted and will be systematically overwritten in accordance with Talos's standard backup retention policies (typically within ninety (90) days).

6. LIMITATION OF LIABILITY​

For the avoidance of doubt, the total aggregate liability of either party and its Affiliates arising out of or in connection with this DPA, whether in contract, tort, or under any other theory of liability, shall be subject to the limitations and caps set forth in Section 12 (Limitation of Liability) of the Terms of Service.