> ## Documentation Index > Fetch the complete documentation index at: https://docs.tuqui.com/llms.txt > Use this file to discover all available pages before exploring further. # Data Processing Agreement (DPA) > How Tuqui processes personal data on behalf of your company ยท Last updated: October 26, 2026 This agreement is part of the [Terms of Service](https://docs.tuqui.com/en/terms.md) between Tuqui LLC ("Tuqui", the processor) and the company that subscribes to Tuqui ("you", the customer, the controller). It applies when Tuqui processes, on your behalf, personal data subject to the EU General Data Protection Regulation (GDPR), the UK GDPR, or the Swiss Federal Act on Data Protection (nFADP). You accept it when you accept the terms. Terms not defined here have the meaning given to them by the GDPR or, in Switzerland, by the nFADP. ## 1. Subject matter and duration * **Subject matter:** providing you with the service described in the terms. * **Data we process on your behalf:** what the assistant reads from your Odoo and from the apps you connect, your company profile, and your workspace's conversations, attachments, memories, and artifacts. * **Data subjects:** the members of your workspace and the people whose data you hold in Odoo or in the connected apps, such as employees, customers, suppliers, and contacts. * **Categories of data:** whatever you hold in those systems, usually identification and contact, commercial, accounting, and employment data. You decide what data is in them; if it includes special categories, it is up to you to have a legal basis to process them. * **Operations:** querying, storing, displaying, and transmitting the data to the providers needed to answer, as described in the [Privacy Policy](https://docs.tuqui.com/en/privacy.md). * **Duration:** while you use the service, plus the deletion period in section 8. ## 2. Your instructions We process your data only on your documented instructions: the terms, this agreement, and what you configure in your workspace (what you connect, which Odoo models you enable for writing, which actions you approve). If an instruction seems to us to infringe data protection law, we tell you. If the law requires us to process your data otherwise, we tell you first, unless that law prohibits it. ## 3. Confidentiality Only the Tuqui people who need it for the purposes in section 7 of the [Privacy Policy](https://docs.tuqui.com/en/privacy.md) access your data, and all of them are bound by confidentiality. ## 4. Security We apply the technical and organizational measures in section 10 of the [Privacy Policy](https://docs.tuqui.com/en/privacy.md): encryption in transit, encrypted credentials, isolation between companies at the database level, private files served through signed links, isolated code execution, human approval to write to Odoo, and restricted access to production. We may improve them, but not lower the level of protection. ## 5. Subprocessors You authorize us to use the providers in the table in section 4 of the [Privacy Policy](https://docs.tuqui.com/en/privacy.md), which is the current list of subprocessors. * **Prior notice:** before adding or replacing a subprocessor, we notify you by email at least 30 days in advance and update the table. * **Right to object:** within that period you can object on reasonable data protection grounds. If we cannot find an alternative, you can cancel the subscription without penalty before the change takes effect. * **Same obligations:** we contractually impose on each subprocessor data protection obligations equivalent to those in this agreement, and we remain liable to you for their compliance. ## 6. Assistance with data subject rights We help you respond to data subject requests (access, rectification, erasure, portability, objection, and restriction), mainly through the product's features: deleting messages, conversations, attachments, and memories, or deleting accounts and workspaces. If a data subject writes to us about data we process on your behalf, we forward the request to you and do not answer it ourselves. We also give you the reasonable information you need for a data protection impact assessment or a prior consultation with an authority. ## 7. Personal data breaches If we suffer a breach that affects your data, we notify you without undue delay and no later than 48 hours after becoming aware of it. The notice states what we know at that point: what happened, which data and approximately how many data subjects, the likely consequences, and the measures we took. We complete the information as it becomes available. ## 8. Deletion and return at the end When you delete the workspace or the contract ends, we delete your data within 90 days at most, including from file storage and backups, unless the law requires us to keep something. If you want a copy first, request it at [hello@tuqui.com](mailto:hello@tuqui.com) before deleting the workspace and we return it in a commonly used format. ## 9. Audits We make available the information needed to demonstrate compliance with this agreement: we answer a reasonable security questionnaire and give you the independent audit reports we hold or that our main providers publish. If that is not enough, or if an authority requires it, we agree on an audit with reasonable prior notice, without disrupting the service and without access to other customers' data. ## 10. International transfers Tuqui and several of its subprocessors are outside the European Economic Area, the United Kingdom, and Switzerland. For those transfers, this agreement incorporates by reference: * **The Standard Contractual Clauses** of Implementing Decision (EU) 2021/914: **Module 2** (controller to processor) when you are the controller, and **Module 3** (processor to processor) when you process the data on behalf of a third party. The annexes are completed by this agreement: Annex I by section 1, Annex II by section 4, and Annex III by the subprocessor table in section 5. * **The UK Addendum** (the ICO's International Data Transfer Addendum) for data subject to the UK GDPR. * **The Swiss adaptation** for data subject to the nFADP: the competent authority is the Federal Data Protection and Information Commissioner (FDPIC), references to the GDPR are read as references to the nFADP, and data subjects habitually resident in Switzerland can exercise their rights before the Swiss courts. When a subprocessor is certified under the Data Privacy Framework, the transfer to that subprocessor may rely on that certification. ## 11. Precedence If anything in this agreement conflicts with the Standard Contractual Clauses, the clauses prevail. If it conflicts with the terms, this agreement prevails as regards the protection of personal data. ## 12. Contact For any question about this agreement: [hello@tuqui.com](mailto:hello@tuqui.com) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.