Data Processing Agreement

A lawyer should review this page before release.

Version [PUBLICATION DATE] · Last updated: [PUBLICATION DATE]

This Data Processing Agreement ("DPA") forms part of the Terms of Service between [LEGAL ENTITY NAME] ("Processor", "we") and the customer who accepted those terms ("Controller", "you"). It governs our processing of personal data on your behalf and is entered into under Article 28 of Regulation (EU) 2016/679 ("GDPR").

You accept this DPA when you accept the Terms of Service. No signature is required, but we will sign a counterpart on request — write to [PRIVACY CONTACT EMAIL]. Where this DPA conflicts with the Terms of Service, this DPA prevails in respect of personal data.

1. Roles of the parties

For personal data contained in guest conversations, inquiries and related records (together, "Guest Data"), you are the controller and we are your processor. You decide that an assistant exists, what it knows, and what is done with the enquiries it collects.

We are an independent controller, not your processor, for the account data of your own users — names, email addresses, billing records and support conversations — and for our own service telemetry. That processing is described in our Privacy Policy and is outside this DPA.

Where you enable an optional integration that sends data outside the platform — for example Telegram notifications — you act as controller for that transfer and it falls outside this DPA. We tell you so at the point where the integration is configured.

2. Subject matter and details of processing

The subject matter, duration, nature, purpose, types of personal data and categories of data subjects are set out in Annex 1, as required by Art. 28(3).

3. Our obligations

We will:

• Process only on your documented instructions, including for international transfers, unless required otherwise by EU or Member State law — in which case we will tell you before processing, unless that law forbids it on important grounds of public interest. Your use of the platform's features, and this DPA, constitute your documented instructions. We will tell you if we believe an instruction infringes data protection law.
• Ensure confidentiality. Personnel authorised to process Guest Data are bound by confidentiality obligations and are granted access only where needed for their role.
• Implement the security measures described in Annex 2, appropriate to the risk, as required by Art. 32.
• Respect the sub-processor conditions in section 4.
• Assist you, by appropriate technical and organisational measures and insofar as possible, in responding to requests to exercise data subject rights (section 5).
• Assist you with your obligations under Arts. 32–36 — security, breach notification, data protection impact assessments and prior consultation — taking into account the nature of processing and the information available to us.
• Delete or return Guest Data at the end of the service, as set out in section 7.
• Make available the information needed to demonstrate compliance with Art. 28 and allow for audits, as set out in section 8.

4. Sub-processors

You give general written authorisation for us to engage sub-processors. The current list is in Annex 3.

We impose on each sub-processor data protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

We will give you at least 30 days' notice before adding or replacing a sub-processor, by email to your account address and by updating Annex 3. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may terminate the affected service and receive a pro-rata refund of prepaid fees for the unused period; that is your exclusive remedy.

5. Data subject rights

The platform is built so that you can satisfy most requests yourself: you can read, export and delete conversations and inquiries from your dashboard at any time, and export or delete the entire account.

Where a data subject contacts us directly about Guest Data, we will not respond substantively ourselves. We will refer them to you, or forward the request without undue delay, and assist you in answering it.

An important limitation, stated plainly: we hold nothing that identifies a guest independently. There is no guest account, and no IP address or user-agent string is stored against a conversation. A guest's session token is the only identifier that can locate their conversation. Where a request cannot be tied to a specific record, Art. 11(2) applies and neither of us is required to acquire additional data purely to enable identification.

6. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Guest Data. Notice will describe, so far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information.

We will provide reasonable assistance with your own notification duties under Arts. 33 and 34. Notifying us of a breach is not an admission of fault by either party.

7. Retention, deletion and return

Guest Data is deleted automatically by scheduled jobs, not on request:

• guest conversations and inquiries: 12 months from creation, for every account regardless of its status;
• an account that lapses or is cancelled: deleted 12 months later, with email warnings 60 and 30 days beforehand;
• an account you close yourself: deleted immediately, together with all Guest Data it holds.

On termination of the service, you may export Guest Data from the dashboard in a structured, machine-readable format at any time before deletion takes effect. After that we delete existing copies unless EU or Member State law requires us to keep them, in which case we will tell you what is retained and why.

Backups are deleted on their own rolling cycle; data in a backup is not restored to live systems and expires with that cycle.

8. Audits and information

On reasonable written request, no more than once in any 12-month period, we will provide the information reasonably necessary to demonstrate our compliance with Art. 28 — including responses to a standard security questionnaire.

Where that is genuinely insufficient for your compliance obligations, you may conduct an audit, subject to reasonable notice of at least 30 days, confidentiality undertakings, conduct during business hours, and no unreasonable interference with our operations or access to other customers' data. You bear your own costs and ours where an audit exceeds one per year, unless the audit reveals a material breach by us.

A supervisory authority exercising its own powers is not restricted by this section.

9. International transfers

Guest Data is stored in the European Economic Area. Certain sub-processors listed in Annex 3 process data outside the EEA, including in the United States.

Where a transfer is made to a country without an adequacy decision, it is made under the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module Three (processor to processor), which are incorporated into this DPA by reference and completed as follows: the optional docking clause applies; the audit and sub-processor terms of this DPA apply; the governing law and forum are those stated in the Terms of Service, being the law of an EU Member State; and Annexes 1, 2 and 3 of this DPA populate Annexes I, II and III of the Clauses.

We carry out transfer impact assessments where required and apply supplementary measures, including encryption in transit and data minimisation. A copy of the relevant safeguards is available on request.

10. Your obligations

• You warrant that you have a lawful basis for the Guest Data processed through your assistants, and that you have given data subjects the information required by Arts. 13 and 14.
• You are responsible for the accuracy, quality and legality of the content you place in your knowledge base, and for the instructions you give us.
• You must not use the service to process special categories of personal data (Art. 9) or criminal conviction data (Art. 10). The service is not designed for them and Annex 2 is not calibrated to that risk.
• You are responsible for access control within your own account, including who you allow to sign in and read conversations.

11. Liability, term and general

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where the GDPR does not permit that limitation.

This DPA takes effect when you accept the Terms of Service and continues while we process Guest Data on your behalf. Sections 7, 8 and 9 survive termination for as long as we hold any Guest Data. If a provision is held invalid, the remainder stands.

---

Annex 1 — Details of the processing

Annex 2 — Technical and organisational measures

Measures implemented under Art. 32, appropriate to the risk of the processing described in Annex 1. We may update them provided the level of protection is not reduced.

Data minimisation

The strongest control we apply is not collecting the data. Guest sessions carry no IP address and no user-agent field. An IP address is used only as a rate-limit key that expires within 24 hours and is never written to permanent storage, including audit logs. Retention is enforced automatically by scheduled deletion jobs rather than left to manual housekeeping.

Tenant isolation

Every dashboard request is checked against the owning account before any record is returned, and a mismatch produces "not found" rather than "forbidden" so that record identifiers cannot be confirmed by probing. Identifiers are random UUIDs and cannot be enumerated. Assistant knowledge retrieval is scoped to a single assistant, so two assistants in the same account cannot read each other's data, and a session token issued for one assistant is not valid against another.

Access control and authentication

Passwords are stored only as salted PBKDF2 hashes and are subject to strength validation; optional federated sign-in is available. Session cookies are Secure, HttpOnly and SameSite=Strict with a bounded lifetime. Administrative interfaces expose sensitive records to designated administrators only. Guest sessions are anonymous, bearer-token based with 256 bits of entropy, and expire after a fixed idle window.

Transmission and storage

Traffic is encrypted in transit using TLS, with HTTP Strict Transport Security enabled in production. Data at rest resides on managed infrastructure with encryption provided by the hosting platform. Web fonts and stylesheets are served from our own origin so that rendering a page does not disclose a visitor's address to a third party; third-party video embeds load only after the visitor chooses to play them.

Application hardening

A Content Security Policy restricts script, style, font and frame sources to an explicit allow-list. CSRF protection is applied to owner-facing forms, clickjacking protection to every response. User-generated content is escaped before rendering. Uploaded images are re-encoded and bounded to block decompression attacks.

Availability and abuse resistance

Layered rate limits apply per network, per conversation and per endpoint, together with per-account usage ceilings that degrade an assistant to a contact form rather than allowing unbounded consumption. Assistant input is screened for unsafe content and prompt-injection attempts before generation, and generated output is screened again before it reaches a guest.

Logging and accountability

Significant events — account changes, deletions, rate-limit trips, exports — are recorded in an append-only audit log that deliberately contains no client identifiers. Records of customers' acceptance of these terms are retained for the life of the account.

Organisational measures

Personnel with access to production data are bound by confidentiality obligations and are granted access on a need-to-know basis. Changes are reviewed before release and covered by an automated test suite. Sub-processors are assessed before engagement and bound by written data protection terms.

Annex 3 — Authorised sub-processors

The sub-processors engaged for Guest Data as at the version date of this DPA:

Our payment provider processes your own billing data as an independent controller and Merchant of Record; it is not a sub-processor of Guest Data. Optional integrations you enable yourself — such as Telegram notifications — are not our sub-processors either, as set out in section 1.

Questions about this DPA: [PRIVACY CONTACT EMAIL]. See also our Privacy Policy and Terms of Service.