Data Processing Agreement
Last updated
ABNI AI LTD · Company number 17088144
Registered office: The Old Ale House High Street, Shirrell Heath, Southampton, England, SO32 2JN
Data Officer: Emma Humphrey · DSR & privacy queries: privacy@abni.ai
This DPA applies where Abni processes personal data on behalf of a client. It is written to comply with UK GDPR and the Data Protection Act 2018, and should be read alongside our Privacy Policy and Security Overview.
1. Roles
- Client = Data Controller
- Abni = Data Processor
The client determines what data is submitted to the platform: which users have access, what brand assets are uploaded, what prompts are entered, and whether personal data is included in content. Clients remain responsible for ensuring they have appropriate lawful grounds, permissions and consents for any personal data they provide to Abni.
Abni acts as a data controller in its own right for a limited set of data needed to run the business — client account records, billing data, contact details and support correspondence. That processing is covered by our Privacy Policy, not this DPA.
2. Scope and details of processing
Abni processes personal data only to provide the platform and related services: generating, adapting and checking brand-compliant content on the client’s instructions.
Categories of data may include:
- user identity data — names, email addresses, company, role
- client content — prompts, brand briefs, uploaded reference images, brand assets, generated outputs
- usage data — activity, generation history, credit and API usage
- technical data — IP addresses, device information, system logs
Data subjects are the client’s authorised users, and any individuals whose personal data the client chooses to include in uploaded content or prompts.
Abni does not intentionally request special category data. Clients must not upload special category data unless they have a lawful basis, have obtained any required consent, and have assessed the risks.
Duration: processing continues for as long as Abni provides the services to the client, plus the retention and deletion periods described in section 9.
3. Instructions
Abni processes data only on documented instructions from the client, including use of the platform. Abni will not use client personal data for any other purpose unless otherwise agreed or required by law.
We do not train AI models — ours or any third party’s — on your data.
4. Confidentiality
Internal access to client data is restricted to authorised Abni operators on a least-privilege basis. All operators are trained in how to handle client data, avoid unnecessary exposure, and report incidents.
[TO CONFIRM — pending]: written confidentiality undertakings are being put in place for all personnel; this section will state them once signed.
5. Security
Abni implements appropriate technical and organisational measures, including:
- encryption in transit (HTTPS/TLS) and at rest
- access controls, with MFA on operational accounts
- secure hosting on AWS (EU region)
- separation of development and production environments
- monitoring, logging and alerting on failures
See our Security Overview for more detail.
6. Sub-processors
Abni uses the following sub-processors to deliver the service:
- AWS — hosting, storage and compute (eu-north-1, Stockholm); transactional email via SES
- Stripe — payments and subscriptions
- Google Cloud — AI processing: Gemini text and image models, Imagen and Document AI. Google approved a Zero Data Retention exception for Abni on 14 May 2026, so content sent to these services is not retained.
- Anthropic — AI processing (Claude API, used by auxiliary text agents)
- KIE.ai — image generation, as a live production fallback; prompts and reference images are sent when the fallback is used
- FAL.ai — image generation, as a live production fallback; prompts and reference images are sent when the fallback is used
Full details of what each AI provider receives and retains are in section 5 of our Privacy Policy.
Abni assesses each sub-processor before sending personal data, seeks data processing agreements or equivalent contractual protections from them where appropriate, and keeps this list under review as providers change.
Where Abni adds or replaces a sub-processor, the change will be posted on this page (and in the sub-processor list in our Privacy Policy) at least 30 days before the new sub-processor processes client personal data. Clients may object to the change within that 30-day window by contacting privacy@abni.ai.
7. International transfers
Several sub-processors are based outside the UK and EEA, primarily in the United States. Where personal data is transferred internationally, Abni relies on the following safeguards:
- Standard Contractual Clauses (SCCs) — the European Commission’s 2021 modules, for transfers from the EEA
- the UK International Data Transfer Agreement (IDTA), or the SCCs combined with the UK Addendum, for transfers from the UK
- where a sub-processor offers them, equivalent contractual clauses in their own data-processing terms
For a copy of the safeguards in place for a specific provider, contact privacy@abni.ai.
8. Data subject rights
Abni will assist clients in responding to data subject requests — access, correction, deletion, restriction, objection and portability — taking into account the nature of the processing.
Requests are verified before any data is disclosed, and Abni will respond to valid requests within one month of receipt. Where requests are complex or numerous, this may be extended by up to two further months where the law permits.
9. Data breach
Abni will notify the client of a personal data breach affecting the client’s data without undue delay, and in any event within 72 hours of becoming aware of it. Notification will include:
- the nature of the incident
- the systems and categories of data affected
- containment actions taken
- recommended client actions
- when the next update will follow
As controller, the client is responsible for any onward notification to regulators and affected individuals; Abni will support that reporting. Where Abni itself is required to report, it will notify the ICO within 72 hours of becoming aware of a reportable breach.
10. Deletion and return
Upon termination, or on request, Abni will delete or return the client’s personal data.
- Deletion follows a staged process: data is disabled, held for a short grace period (normally 30 days) in case deletion was accidental, then permanently deleted.
- Clients can request an export of their data before deletion.
- Billing and tax records may be retained where the law requires (typically 6 years in the UK).
- Where a sub-processor supports deletion, Abni will request or trigger it; where it doesn’t, Abni relies on the provider’s documented retention periods.
- Data deleted from live systems may persist in backups until backup rotation removes it.
See section 9 of our Privacy Policy for the full retention and deletion process.
11. Audits
On written request, Abni will provide reasonable information and documentation to demonstrate compliance with this DPA.
12. Duration
This DPA applies for as long as Abni processes personal data on behalf of the client, and continues to apply to any personal data held during the retention and deletion periods in section 10.
This DPA is governed by the laws of England & Wales, mirroring our Terms & Conditions. It forms part of the client agreement; on data-protection matters, this DPA takes precedence over the Terms.
Contact
For DPA enquiries or to request a signed copy, email team@abni.ai.