ETHUX
Sign inGet an API key

Online Services Terms

For the console, the LLM API, GPU instances and Sandboxes. Advice and custom work fall under the NLdigital Voorwaarden.

Version 1.0, 24 October 2026. The Dutch version prevails.

General Terms for Online Services

This is a translation of the Dutch version. If the versions differ, the Dutch version prevails.

1. Who we are

1.1 ETHUX is a sole proprietorship of Gijsbert Westeneng. Chamber of Commerce (KvK) 95784756. VAT NL005174579B17. Address: Lupine 43, 2231 PH Rijnsburg, the Netherlands. Email: support@ethux.net.

1.2 In these terms "ETHUX" or "we" means ETHUX. "Customer" or "you" means the party that enters into an agreement with ETHUX.

2. Who and what these terms apply to

2.1 These terms apply to ETHUX's online services: the console, the LLM API, GPU instances and Sandboxes, and to every offer and agreement about them. Advice, development and other custom work fall under the NLdigital Voorwaarden, unless agreed otherwise in writing.

2.2 ETHUX supplies businesses, professionals and consumers in the European Union. For consumers the rules in article 15 also apply and prevail.

2.3 Purchase terms or other terms of the customer do not apply, unless ETHUX accepts them in writing.

2.4 Some services also have additional terms:

  • the API and GPU Service Terms, for the LLM API, GPU instances and Sandboxes;
  • the Data Processing Agreement, when ETHUX processes personal data for the customer;
  • the Erebus Pro Licence, for Erebus Pro.

2.5 If documents conflict, this order applies:

  1. the Data Processing Agreement, for anything about personal data;
  2. a written agreement or quote that both ETHUX and the customer have accepted;
  3. the additional terms for the service;
  4. these general terms.

Article 15 prevails over 2 to 4.

3. Offers and agreement

3.1 An offer from ETHUX is not binding, unless it states a validity period.

3.2 An agreement exists as soon as:

  • the customer creates an account on console.ethux.net and accepts the terms; or
  • the customer accepts a quote in writing; or
  • ETHUX starts delivering at the customer's request.

3.3 Anyone who creates an account for an organisation confirms that they may bind that organisation.

3.4 How the agreement is formed: you create an account, choose whether you become a customer as a business or as a private individual, and accept these terms. Before you buy credit you see an overview you can still change; you only buy when you press the pay button. The current version is always on this page. You can contract in Dutch or English; if they differ, Dutch prevails. ETHUX has not signed up to a code of conduct.

4. Prices

4.1 Prices are listed on the website or in the console, unless agreed otherwise. For business customers prices exclude VAT; for consumers we show prices including VAT (article 15). Prices are on the pricing page.

4.2 The LLM API is charged per million tokens. There is no minimum and no subscription; the customer pays with prepaid credit (article 5). For other services the price is in the additional terms or the quote.

4.3 ETHUX may change prices. ETHUX announces a price increase at least 30 days in advance by email or in the console. The customer may stop before the new price applies, and then gets its unused paid credit back (article 5.6).

5. Credit and payment

5.1 The customer pays in advance. It buys credit in the console and pays for it straight away, with one of the payment methods the console offers. Each credit purchase is a separate agreement. Use is deducted from the credit at the prices in article 4. This applies unless agreed otherwise in writing.

5.2 The customer pays VAT on every credit purchase. ETHUX sends an invoice for each purchase; invoices are in the console. The credit is the amount excluding VAT.

5.3 Credit does not expire.

5.4 When the credit runs out, the services stop until the customer tops up. Use that was already in progress when the credit ran out can take the balance slightly below zero. The customer pays that shortfall; ETHUX deducts it from the next credit purchase.

5.5 Credit that ETHUX grants for free, for example to try the service, has no cash value. It is not refunded, and ETHUX may set an end date for it.

5.6 ETHUX refunds unused credit the customer paid for, on request. The customer asks in the console or by email to the address in article 1.1. ETHUX first deducts anything the customer still owes (article 5.4). ETHUX refunds within 14 days, including the VAT on that credit, to the payment method used to buy that credit. If that is not possible, ETHUX refunds to an account in the customer's name once the customer has shown the account is theirs. If there are concrete indications that a payment was not made or authorised by the account holder, ETHUX may hold the refund until this is cleared up, and tells the customer. Used credit and free credit (article 5.5) are not refunded. Use is deducted from free credit first, then from paid credit, oldest first. ETHUX always corrects its own billing errors.

5.7 Refunds go through ETHUX. If the customer has a problem with a payment or wants money back, it asks ETHUX first (article 5.6, and for consumers article 15). The customer does not have a payment reversed through its bank or card issuer (chargeback), unless ETHUX refuses a refund the customer is entitled to or does not pay it within 14 days. This does not limit the customer's rights for a payment it did not make or authorise.

5.8 If the customer has a payment reversed anyway, ETHUX may remove the credit from that payment straight away and suspend the service until the shortfall is paid. If that credit was partly used, the customer still pays for that part. A business customer also pays the fee the payment provider charges ETHUX for the reversal. This article does not apply if the reversal was justified.

5.9 If the customer does not pay an amount it owes ETHUX on time, ETHUX sends a reminder. If the customer still does not pay, statutory commercial interest and reasonable collection costs are due. For consumers, article 15.6 applies.

5.10 The customer reports an objection to a deduction or an invoice within 60 days; after that, ETHUX assumes the billing is correct. For consumers, article 15.6 applies.

5.11 Credit is a prepayment for ETHUX services. It is not a payment account or electronic money, earns no interest and can only be used with ETHUX. Credit belongs to the organisation it was bought for; the customer cannot transfer or sell it to anyone else.

6. Use and suspension

6.1 The customer uses the services in line with the law, these terms and the additional terms.

6.2 ETHUX may suspend a service in whole or in part if:

  • the customer does not pay an amount it owes after a reminder, or reverses a payment (article 5.8);
  • the customer breaches these terms or the additional terms;
  • the use harms, or threatens to harm, the service, other customers or third parties;
  • the law, a court or a government requires it.

6.3 ETHUX announces a suspension in advance where reasonably possible, and otherwise as soon as possible afterwards. ETHUX lifts the suspension as soon as the cause is gone.

6.4 During a suspension the customer still pays for what it has already used.

7. Liability

7.1 ETHUX's total liability is limited to the higher of €500 and the amount the customer paid ETHUX in the 12 months before the event that caused the damage. For consumers, article 15.6 applies.

7.2 ETHUX is not liable for indirect damage. This includes consequential damage, lost profit, lost savings, loss of or damage to data, and damage from business interruption.

7.3 The limits in this article do not apply in case of intent or deliberate recklessness by ETHUX, nor to damage from death or personal injury.

7.4 The customer reports damage in writing as soon as possible. A claim lapses if the customer has not reported it within 24 months of discovery.

7.5 Output from AI models can be wrong. The customer checks output before relying on it. ETHUX is not liable for decisions the customer makes based on output.

7.6 A business customer indemnifies ETHUX against third-party claims, including reasonable defence costs, arising from content it or its users process or distribute through the services, or from use that breaks the law or these terms. This does not apply to the extent ETHUX caused it. ETHUX reports such a claim promptly and does not settle without consulting the customer.

7.7 ETHUX does not warrant that output does not infringe the rights of others, and does not indemnify the customer against this. The customer checks this before publishing output or using it in a product. For consumers, article 15.6 applies.

8. Force majeure

8.1 ETHUX does not have to perform an obligation if force majeure prevents it.

8.2 Force majeure includes: power grid failures, outages at internet or network parties outside ETHUX, fire, natural disasters, war, pandemics, government measures, and attacks such as DDoS that ETHUX could not reasonably prevent.

8.3 If force majeure lasts longer than 60 days, either party may end the agreement in writing. What has already been delivered is paid for. ETHUX then refunds the unused paid credit.

9. Intellectual property

9.1 ETHUX keeps all rights in its services, software, documentation and brand. The customer only gets a right of use for the term of the agreement.

9.2 The customer keeps all rights in its data, prompts and other input. Output belongs to the customer. To the extent ETHUX has any rights in output, it hereby transfers them to the customer; where that is not possible, the customer gets an exclusive, perpetual, free right of use. ETHUX processes input and output only as far as needed to provide the service. Output is not unique: other customers may receive the same or similar output, and that output is not the customer's.

9.3 Open source software is covered by its own licence. AI models can also have their own licence; ETHUX lists it per model in the documentation.

9.4 The customer warrants that it has the right to provide its input to the service.

9.5 If the customer gives ETHUX feedback or suggestions, ETHUX may use them freely and at no cost. This gives ETHUX no right to prompts or output attached to the feedback.

10. Confidentiality

10.1 Both parties keep the other party's confidential information secret. Information is confidential if this was stated or follows from its nature.

10.2 This does not apply if the information was already public, or if the law or a court requires disclosure.

10.3 Confidentiality continues for 5 years after the agreement ends.

11. Term and termination

11.1 The agreement runs for an indefinite period, unless agreed otherwise.

11.2 The customer may stop at any time. It revokes its API keys, stops its machines and asks for its account to be closed via the email address in article 1.1. The agreement ends once ETHUX has closed the account. Use up to that moment is deducted from the credit. Unused paid credit is refunded on request (article 5.6).

11.3 ETHUX may terminate the agreement with 30 days notice. ETHUX then refunds the unused paid credit. For consumers, article 15.6 applies.

11.4 Either party may end the agreement with immediate effect if the other party:

  • fails to meet a material obligation and does not fix this within a reasonable period after written notice;
  • goes bankrupt, is granted a suspension of payments, or stops its business.

11.5 After the end, ETHUX deletes the customer's data as described in the Data Processing Agreement and the additional terms. ETHUX keeps what the law requires, such as its accounting records.

11.6 Articles that by their nature continue, stay in force after the end. For example liability, confidentiality and payment.

12. Changes to these terms

12.1 ETHUX may change these terms. ETHUX announces a change at least 30 days before it takes effect, by email or in the console.

12.2 If the customer does not agree with the change, it may stop before the change takes effect. If the customer keeps using the service after that, it accepts the change.

12.3 Changes required by law, or changes only in the customer's favour, may take effect immediately.

13. Other provisions

13.1 If a provision is invalid, the others remain in force. The parties replace the invalid provision with a valid one that is as close to it as possible.

13.2 ETHUX communicates with the customer by email and through the console. A message by email counts as written.

13.3 The customer may not transfer its rights and obligations without ETHUX's written consent.

13.4 ETHUX may transfer the agreement to a legal entity that continues ETHUX's business, such as the owner's BV. ETHUX gives at least 30 days' notice by email. Credit, terms and Data Processing Agreement transfer unchanged. If the customer objects, it may stop before the transfer and gets its unused paid credit back (article 5.6).

13.5 The customer confirms that neither it nor anyone who owns or controls it is on an EU or UN sanctions list. It does not use the services in breach of sanctions or export rules, nor lets others do so. If it does, ETHUX may suspend the service immediately or end the agreement. ETHUX refunds unused paid credit unless the law forbids it.

14. Applicable law and disputes

14.1 Dutch law applies to these terms and to every agreement with ETHUX. The Vienna Sales Convention (CISG) does not apply.

14.2 The parties first try to resolve a dispute together.

14.3 If that fails, the competent court in the district where ETHUX is established decides. For consumers, article 15.6 applies.

15. Additional rules for consumers

15.1 This article applies if the customer is a consumer: a natural person not acting for their trade or profession. It prevails over the rest of these terms and the additional terms. Nothing in these terms limits a consumer's mandatory rights. A consumer who lives in another EU country keeps the protection of that country's mandatory rules.

15.2 Prices for consumers are shown including VAT.

15.3 The consumer may withdraw from any credit purchase within 14 days of buying it, without giving a reason, by sending the model form in the annex or any other clear statement to the email address in article 1.1. ETHUX confirms the withdrawal by email straight away, stating its content and the time ETHUX received it.

15.4 If the consumer wants to use the credit straight away, they expressly ask ETHUX to start at purchase, and acknowledge that they lose the right of withdrawal once the credit from that purchase is fully used. If they did not make that request and withdraw within the 14 days, they pay nothing for what they already used. ETHUX confirms every purchase by email straight away, with: the price including VAT; the request to start straight away and the acknowledgement of losing the right of withdrawal, if given; the withdrawal information with the model form; and the address for complaints.

15.5 If the consumer withdraws after making that request, they pay for the credit from that purchase they have already used. ETHUX refunds the rest, including VAT, within 14 days of the withdrawal, to the same payment method, at no cost. That credit can then no longer be used.

15.6 By way of exception, for consumers:

  • a. the last sentence of article 5.8, on payment provider fees, does not apply;
  • b. on late payment the statutory interest (article 6:119 Dutch Civil Code) is due, and collection costs only as the law allows, after a reminder giving 14 days to pay;
  • c. articles 5.10 and 7.4 do not apply; the consumer reports an error or defect within a reasonable time after discovering it, without losing rights by doing so;
  • d. ETHUX suspends only for non-payment, a payment reversal, a serious breach of these terms, danger to the service or others, or where the law requires it;
  • e. ETHUX provides the service with the care of a good service provider and is liable as the law provides. ETHUX is not liable for damage that could not reasonably be foreseen when the agreement was made, or for damage caused by force majeure. The consumer's statutory rights for a defective service (repair, price reduction and termination) always apply;
  • f. ETHUX's measurements are the starting point for usage; the consumer may dispute them;
  • g. ETHUX terminates only with two months' notice when it stops a service or has another serious reason, and then refunds unused credit;
  • h. ETHUX changes these terms, prices or models only because of new law, security, a model that is no longer supported, increased costs or new features. ETHUX gives at least 30 days' notice by email. If the change makes the service worse for the consumer, they may terminate free of charge within 30 days of the notice or of the change, whichever is later, and get their unused credit back;
  • i. disputes go to the court that has jurisdiction by law;
  • j. "no SLA" in the Service Terms does not affect the statutory requirements for a digital service.

15.7 The consumer reports complaints, as fully and clearly as possible, to the email address in article 1.1. ETHUX acknowledges receipt and answers within 14 days. If it cannot, ETHUX says within those 14 days when the consumer will get a full answer.

15.8 ETHUX is not a member of a disputes committee or other out-of-court dispute resolution body and does not take part in one. If a complaint does not resolve the dispute, the consumer may go to court (article 15.6(i)).

Annex: model withdrawal form

(Only complete and return this form if you wish to withdraw from the agreement.)

  • To: ETHUX, address and email address in article 1.1
  • I hereby give notice that I withdraw from my agreement for the supply of the following service: credit for the ETHUX API, purchase [invoice number]
  • Purchased on: …
  • Name: …
  • Address: …
  • Signature (only on paper): …
  • Date: …

API and GPU Service Terms

This is a translation of the Dutch version. If the versions differ, the Dutch version prevails.

These service terms are part of the ETHUX General Terms. They apply to the LLM API, GPU instances and Sandboxes.

1. The services

1.1 LLM API. An OpenAI-compatible API at https://api.ethux.net/v1. The available models are listed on the models page.

1.2 GPU instances. Virtual machines with SSH access. Coming soon.

1.3 Sandboxes. Isolated containers. Coming soon.

1.4 The rules for GPU instances and Sandboxes in article 9 apply from the moment ETHUX offers those services.

1.5 All hardware is owned by ETHUX and located in the Netherlands, in its own racks. There is no cloud provider in between. Prompts and data are processed in the Netherlands. The infrastructure is subject to Dutch law. ETHUX has no parent or sister company outside the EU. ETHUX discloses customer data only under an order valid under Dutch or EU law, discloses no more than needed, and tells the customer unless the law forbids it. ETHUX follows an order from outside the EU only through a treaty, such as a mutual legal assistance treaty.

2. Account and organisation

2.1 The customer manages its services in the console at console.ethux.net. There it manages organisations, API keys, usage and invoices.

2.2 The customer provides correct and current details and keeps them up to date.

2.3 The customer decides who has access to its organisation. It is responsible for what those people do.

3. API keys

3.1 API keys are secret. The customer stores them securely and does not share them outside its organisation and the agents it has connected.

3.2 The customer is responsible for all use of its API keys, also when someone else misuses a key. That use is deducted from the credit of the organisation the key belongs to.

3.3 If the customer suspects a key has leaked, it revokes the key in the console straight away and reports this to support@ethux.net.

3.4 ETHUX may block a key that appears leaked or is being misused. ETHUX informs the customer.

3.5 The customer can connect an AI agent in the console. The agent acts with the rights granted by the person who connects it. The customer is responsible for what the agent does, including the API keys it creates.

4. Reselling

4.1 The customer may only resell the services using the reseller feature in the console or with ETHUX's written permission.

4.2 A reseller:

  • a. remains the customer itself; its clients have no agreement with ETHUX;
  • b. pays for all its clients' use from its own credit;
  • c. imposes at least article 3, article 5 and the model licences on its clients and is responsible for their use;
  • d. concludes a data processing agreement with its clients itself where needed; ETHUX is then a sub-processor on the terms of the Data Processing Agreement;
  • e. is itself responsible for consumer rules if it sells to consumers.

4.3 ETHUX may block a client's key as in articles 3.4 and 5.4, and informs the reseller.

5. Acceptable use

5.1 The customer does not use the services, and does not let them be used:

  • a. for anything that breaks the law, or to create, store or spread illegal content;
  • b. for sexual abuse, exploitation or sexualisation of minors. ETHUX reports this to the competent authorities;
  • c. to develop, produce or acquire weapons or explosives, including chemical, biological, radiological and nuclear weapons;
  • d. to disrupt or break into critical infrastructure (such as energy, water, healthcare, telecom or transport);
  • e. for attacks on ETHUX or third parties, such as hacking, unauthorised scanning, DDoS, phishing, spam, or creating or spreading malware;
  • f. to threaten, harass or discriminate against people, or to incite violence or terrorism;
  • g. for fraud or scams, or to impersonate someone;
  • h. for disinformation campaigns or fake accounts, or to influence elections or other democratic processes by deception;
  • i. to collect personal data without a legal basis or to track people, or to create sexual or intimate content about a real person without their consent;
  • j. to decide on or advise people in health, law, finance, credit, insurance, employment, housing, education or benefits without meaningful review by a qualified human;
  • k. to present output as human-made where that misleads or the law requires disclosure;
  • l. to get around security, rate limits or billing, or to try to access other customers' data, including through the model or the cache;
  • m. in a way that disrupts the service for other customers.

5.2 The customer does not use the services for practices prohibited under article 5 of the AI Act.

5.3 The customer is responsible for how it uses output, including under the AI Act where it applies to the customer.

5.4 If the customer breaches this article, ETHUX may suspend the service as described in the General Terms.

6. Availability and rate limits

6.1 ETHUX does its best to keep the services available and fast. There is no SLA and no availability guarantee, unless agreed otherwise in writing.

6.2 ETHUX may interrupt the services temporarily for maintenance. ETHUX announces planned maintenance in advance by email where reasonably possible.

6.3 ETHUX sets rate limits per organisation or per key and may change them. The customer does not get around them. The customer requests a higher limit via the email address in article 1.1 of the General Terms.

7. Models

7.1 ETHUX may add, update or retire models.

7.2 ETHUX announces the retirement of a model at least 30 days in advance by email or in the console.

7.3 If a change is needed for security or by law, ETHUX may act faster. ETHUX announces this as soon as possible.

7.4 Model output can be wrong, incomplete or inappropriate. The customer checks output before relying on it.

8. Data

8.1 ETHUX does not use the customer's prompts and output to train models.

8.2 ETHUX does not sell or share prompts and output with third parties, unless the law or a court requires it. ETHUX informs the customer of such a request where allowed.

8.3 ETHUX does not write the content of prompts and output to disk and does not log it. Tokens may stay in the model's in-memory cache for up to one hour after last use, so repeated input is faster and billed at the cached rate; after that they are gone. ETHUX logs only what security and billing need: time, IP address, endpoint, status, duration, model, token counts and key ID. Logs are deleted after 14 days.

8.4 Usage data needed for invoicing, such as token counts and hours, is kept for as long as Dutch tax law requires.

8.5 If ETHUX processes personal data for the customer, the Data Processing Agreement applies.

9. GPU instances and Sandboxes

This article applies once ETHUX offers these services.

9.1 The customer has full access to its instance or sandbox. ETHUX does not manage what runs on it.

9.2 The customer is responsible for everything that runs on its instances and sandboxes. This includes security, updates, software licences and backups.

9.3 ETHUX does not back up instances or sandboxes, unless agreed in writing.

9.4 A stopped instance or sandbox keeps its data until the customer deletes it. When the customer deletes an instance or sandbox, ETHUX wipes its data immediately.

9.5 ETHUX may stop an instance or sandbox that harms the platform, other customers or third parties, or if the customer breaches article 5. ETHUX announces this in advance where reasonably possible, and otherwise as soon as possible afterwards.

9.6 Not allowed on GPU instances and Sandboxes: mining cryptocurrency, scanning other people's networks or IP addresses, using spoofed source IP addresses, and running open mail relays or open proxies.

10. Billing

10.1 The LLM API is charged per million tokens, according to the price list. Input and output tokens each have their own rate.

10.2 GPU instances and Sandboxes are charged per started hour.

10.3 ETHUX's measurements determine usage, unless the customer shows they are wrong.

10.4 There is no minimum and no subscription. Use is deducted from prepaid credit, as described in article 5 of the General Terms. When the credit runs out, API keys stop working until the customer tops up. Prices exclude VAT.

11. Stopping

11.1 The customer can stop at any time. It disconnects its agents, revokes its API keys and stops its machines in the console.

11.2 Use up to the moment of stopping is deducted from the credit. Unused paid credit is refunded on request (General Terms article 5.6).

Data Processing Agreement

These are the European Commission's standard contractual clauses between controllers and processors (Commission Implementing Decision (EU) 2021/915, Article 28(7) GDPR). The clauses are unchanged; the options are resolved (GDPR; general authorisation of sub-processors with 30 days' notice) and Annexes I to IV are completed. In case of conflict, the Dutch version prevails.

ANNEX

STANDARD CONTRACTUAL CLAUSES

SECTION I

Clause 1

Purpose and scope (a) The purpose of these Standard Contractual Clauses (the Clauses) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. (b) The controllers and processors listed in Annex I have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 and/or Article 29 (3) and (4) Regulation (EU) 2018/1725. (c) These Clauses apply to the processing of personal data as specified in Annex II. (d) Annexes I to IV are an integral part of the Clauses. (e) These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. (f) These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

Clause 2

Invariability of the Clauses (a) The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them. (b) This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.

Clause 3

Interpretation (a) Where these Clauses use the terms defined in Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively, those terms shall have the same meaning as in that Regulation. (b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively. (c) These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 4

Hierarchy In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 5 - Optional

Docking clause (a) Any entity that is not a Party to these Clauses may, with the agreement of all the Parties, accede to these Clauses at any time as a controller or a processor by completing the Annexes and signing Annex I. (b) Once the Annexes in (a) are completed and signed, the acceding entity shall be treated as a Party to these Clauses and have the rights and obligations of a controller or a processor, in accordance with its designation in Annex I. (c) The acceding entity shall have no rights or obligations resulting from these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 6

Description of processing(s) The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

Clause7

Obligations of the Parties 7.1. Instructions (a) The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented. (b) The processor shall immediately inform the controller if, in the processor’s opinion, instructions given by the controller infringe Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or the applicable Union or Member State data protection provisions.

7.2. Purpose limitation The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.

7.3. Duration of the processing of personal data Processing by the processor shall only take place for the duration specified in Annex II.

7.4. Security of processing (a) The processor shall at least implement the technical and organisational measures specified in Annex III to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects. (b) The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The processor shall ensure that persons authorised to process the personal data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.5. Sensitive data If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the processor shall apply specific restrictions and/or additional safeguards.

7.6 Documentation and compliance (a) The Parties shall be able to demonstrate compliance with these Clauses. (b) The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses.
(c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. At the controller’s request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.
(d) The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice. (e) The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.

7.7. Use of sub-processors (a) The processor has the controller’s general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object. (b) Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the data processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. (c) At the controller’s request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secret or other confidential information, including personal data, the processor may redact the text of the agreement prior to sharing the copy. (d) The processor shall remain fully responsible to the controller for the performance of the sub-processor’s obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations. (e) The processor shall agree a third party beneficiary clause with the sub-processor whereby - in the event the processor has factually disappeared, ceased to exist in law or has become insolvent - the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

7.8. International transfers (a) Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725. (b) The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7. for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.

Clause 8

Assistance to the controller (a) The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller. (b) The processor shall assist the controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller’s instructions (c) In addition to the processor’s obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor: (1) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a ‘data protection impact assessment’) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons; (2) the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk; (3) the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated; (4) the obligations in Article 32 Regulation (EU) 2016/679. (d) The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.

Clause 9

Notification of personal data breach In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 Regulation (EU) 2016/679 or under Articles 34 and 35 Regulation (EU) 2018/1725, where applicable, taking into account the nature of processing and the information available to the processor.

9.1 Data breach concerning data processed by the controller In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller: (a) in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant/(unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons); (b) in obtaining the following information which, pursuant to Article 33(3) Regulation (EU) 2016/679, shall be stated in the controller’s notification, and must at least include:
(1) the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (2) the likely consequences of the personal data breach;
(3) the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay. (c) in complying, pursuant to Article 34 Regulation (EU) 2016/679, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

9.2 Data breach concerning data processed by the processor In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach. Such notification shall contain, at least: (a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned); (b) the details of a contact point where more information concerning the personal data breach can be obtained; (c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects. Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay. The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller’s obligations under Articles 33 and 34 of Regulation (EU) 2016/679.

SECTION III – FINAL PROVISIONS

Clause 10

Non-compliance with the Clauses and termination (a) Without prejudice to any provisions of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason. (b) The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if: (1) the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension; (2) the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725; (3) the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. (c) The processor shall be entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1 (b), the controller insists on compliance with the instructions. (d) Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

ANNEX I: LIST OF PARTIES

Controller: the customer, as identified in its ETHUX account (name, address, contact person and contact details as registered there). Data protection officer, if any: as registered by the customer. Signature and accession date: these Clauses are accepted when the customer accepts the ETHUX API and GPU Service Terms, on that date.

Processor: ETHUX, a sole proprietorship of Gijsbert Westeneng. Chamber of Commerce (KvK) 95784756. Address: Lupine 43, 2231 PH Rijnsburg, the Netherlands. Contact person: Gijsbert Westeneng, owner, support@ethux.net. ETHUX has not appointed a data protection officer. Signature and accession date: on acceptance by the customer, as above.

ANNEX II: DESCRIPTION OF THE PROCESSING

Categories of data subjects whose personal data is processed Any natural person whose personal data the controller includes in prompts, files or other input sent to the ETHUX API, or stores on ETHUX GPU instances or Sandboxes. ETHUX does not determine these categories.

Categories of personal data processed Whatever personal data the controller includes in input, and the model output generated from it. On GPU instances and Sandboxes: whatever the controller stores there.

Sensitive data processed (if applicable) and applied restrictions or safeguards ETHUX does not ask for special categories of personal data. If the controller includes them, the safeguards in Annex III apply to all input alike: input and output are not written to disk or logged, the derived cache lives in memory only and is deleted within one hour of its last use, nobody at ETHUX reads input or output, and nothing is used to train or evaluate any model.

Nature of the processing Receiving requests, computing model output in GPU memory and returning it (inference). A prefix cache derived from input is kept in GPU memory and RAM to make repeated input faster and cheaper; every entry is deleted within one hour of its last use and the shared cache tier is wiped every hour. On GPU instances and Sandboxes: hosting the controller's own virtual machines or containers and their storage.

Purpose(s) for which the personal data is processed on behalf of the controller Solely to provide the API, GPU instances and Sandboxes to the controller as agreed in the ETHUX API and GPU Service Terms.

Duration of the processing For the term of the agreement. Input and output: the duration of each request. Derived cache: at most one hour after its last use. GPU instance and Sandbox data: until the controller deletes it, and in any case immediately on the controller's request.

For processing by (sub-) processors No sub-processor processes input or output of the API. See Annex IV.

ANNEX III: TECHNICAL AND ORGANISATIONAL MEASURES

Measures of pseudonymisation and encryption of personal data All public endpoints are served over TLS only. Input and output are not stored, so there is nothing to encrypt at rest for the API.

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services Hardware owned by ETHUX in a data centre in the Netherlands. Services run on a highly available Kubernetes cluster; every application runs in its own namespaces with its own credentials and cannot read another application's secrets. Public traffic enters through a web application firewall (CrowdSec with the OWASP Core Rule Set) that fails closed: if the firewall is unavailable, requests are refused, not passed through. Internal services are not reachable from the internet.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident Input and output are not stored, so restoring them does not apply. The service runs on several inference engines; one failing does not stop the service. Configuration is kept in version control and restored from it.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures Every change goes through a reviewed merge request and an automated pipeline, first to a staging environment, then to production. Changes to the cache-expiry behaviour are tested on a separate test engine before they reach the serving engines.

Measures for user identification and authorisation API access requires a personal API key per customer; keys are stored in a secrets manager (OpenBao) and can be revoked by the customer at any time. Administrative access to ETHUX systems is limited to the owner and uses keys only, no passwords.

Measures for the protection of data during transmission TLS on every public endpoint, with certificates from Let's Encrypt.

Measures for the protection of data during storage Input and output are never written to disk. The derived cache is held in GPU memory and RAM only; the servers that hold it have no swap and write no cache to disk. Secrets are kept in OpenBao, never in source code.

Measures for ensuring physical security of locations at which personal data are processed The hardware is colocated at BIT in Ede, the Netherlands, through Xyphen IT. They provide space, power, network and physical security; neither has access to the data.

Measures for ensuring events logging Request logs contain time, IP address, endpoint, status, duration, model, token counts and API key ID, never input or output. They are kept for 14 days.

Measures for ensuring system configuration, including default configuration All configuration is declared in version control and applied automatically (GitOps); manual changes are overwritten by the declared state.

Measures for internal IT and IT security governance and management ETHUX is run by its owner, who is the only person with access to production systems. ETHUX has no employees or contractors with access to customer data.

Measures for certification/assurance of processes and products ETHUX holds no SOC 2 or ISO 27001 certification. These measures are described as they are actually implemented.

Measures for ensuring data minimisation Only what is needed to answer a request is processed. For billing, ETHUX keeps token counts, timestamps and API key ID, no content.

Measures for ensuring data quality ETHUX does not alter input; output is produced by the model the controller selects.

Measures for ensuring limited data retention Input and output: not retained. Derived cache: at most one hour after last use, plus an hourly wipe of the shared tier. Request logs: 14 days. Billing records: 7 years, as Dutch tax law requires; they contain no input or output.

Measures for ensuring accountability Changes and deployments are recorded in version control and the deployment pipeline.

Measures for allowing data portability and ensuring erasure GPU instance and Sandbox data is deleted immediately when the controller deletes it; other data processed for the controller is deleted immediately on the controller's request. The controller can export its own data from GPU instances and Sandboxes at any time.

Assistance to the controller ETHUX forwards any request from a data subject to the controller without undue delay, notifies the controller of a personal data breach without undue delay after becoming aware of it, and provides the information listed in Clause 9 as far as it has it.

ANNEX IV: LIST OF SUB-PROCESSORS

Under Clause 7.7(a) (general written authorisation), the controller authorises the following sub-processors. None of them processes input or output of the API.

  1. TransIP B.V., Leiden, the Netherlands. Email hosting for support@ethux.net: correspondence the controller sends to ETHUX.
  2. Proton AG, Geneva, Switzerland. Email hosting for ethux.nl addresses: correspondence the controller sends to ETHUX. Switzerland is recognised by the European Commission as providing an adequate level of data protection.