Skip to main content

Data Processing Addendum (DPA)

UK GDPR & EU GDPR Article 28 processor terms, UK IDTA / Addendum, and EU SCCs for transient LLM inference on bf16.ai

Effective Date: November 12, 2026 · Data Processor: MAGICFORGE LTD (England and Wales · Company No. 16211132) · Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

1. Scope, Parties & Statutory Framework

This Data Processing Addendum ("DPA") forms an integral part of the Terms of Service between Customer ("Controller") and MAGICFORGE LTD (registered in England and Wales under Company No. 16211132, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom; "Processor", operating bf16.ai). It governs Processor's transient processing of personal data contained in API, Playground, or Remote MCP inference payloads pursuant to Article 28 of the UK GDPR, the UK Data Protection Act 2018, and Article 28 of the EU GDPR.

2. Nature, Purpose & Zero-Persistence Architecture

  1. Subject Matter & Duration: Real-time routing, protocol translation (/v1/chat/completions, /v1/messages, /v1/responses, POST /mcp), and Server-Sent Events (SSE) streaming of open-weight language and vision model completions solely on Controller's documented API instructions during the term of service.
  2. Zero Disk Persistence: MAGICFORGE LTD processes prompt and completion buffers exclusively in volatile memory (RAM), never writes inference content to disk, databases, or logs, and purges volatile memory buffers immediately upon HTTP stream completion or socket closure.

3. Technical & Organizational Security Measures (TOMs)

Processor enforces TLS 1.3 transport encryption, AES-256-GCM encryption at rest for upstream provider credentials, SHA-256 / HMAC-SHA256 API key hashing, strict egress SSRF socket validation, automated prompt/header log redaction, role-based least-privilege access control, and rapid revoked-key stream termination.

4. Authorized Sub-Processors & International Transfers (uk_idta_scc)

Controller grants general written authorization for Processor to route transient inference payloads strictly to verified upstream compute sub-processors passing Processor's compliance gate (commercial_resale_permitted = true && zdr_no_training_verified = true), as disclosed per model on /models/$slug. Restricted cross-border transfers outside the UK or EEA automatically incorporate the EU Standard Contractual Clauses (Decision (EU) 2021/914, Module Two and Module Three) together with the UK International Data Transfer Agreement (IDTA) / UK International Data Transfer Addendum (uk_idta_scc) issued by the UK Information Commissioner's Office.

5. Personal Data Breach Notification, Deletion & Contacts

Processor shall notify Controller without undue delay (and in any event within 72 hours) after becoming aware of a confirmed personal data breach affecting transient Customer inference traffic, assist with statutory impact assessments, and delete any residual operational metadata upon contract termination unless retention is mandated by UK law. Enterprise DPA countersignature and inquiries: [email protected] · [email protected].