Data Processing Agreement

1. Purpose and scope

1.1This Data Processing Agreement (“DPA”) forms part of the agreement between the Customer and the Platform for the provision of the DeskClerk AI service (the “Service”). It applies where the Platform processes personal data on behalf of the Customer in the course of providing the Service.

1.2This DPA describes the subject matter, duration, nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the Customer. It does not replace the Customer's own obligations as a controller.

2. Definitions

2.1Terms such as “controller”, “processor”, “data subject”, “personal data”, “processing”, “personal data breach” and “supervisory authority” have the meanings given in applicable data-protection law. “Customer Personal Data” means personal data processed by the Platform on behalf of the Customer under the agreement. “Sub-processor” means a third party engaged by the Platform to process Customer Personal Data.

3. Roles and details of processing

3.1The Customer is the controller of Customer Personal Data and the Platform is the processor. The Customer determines the purposes and means of processing, including the content used by the assistant, the questions it asks and the contact details it collects.

3.2The subject matter of the processing is the provision of the Service. The duration is the term of the agreement plus the retention period described in this DPA. The nature of the processing includes storage, retrieval, text generation, contact-detail capture and transmission to the Customer's team. The purpose is to answer Visitor questions, capture leads and support human handoff.

3.3The categories of data subjects include Visitors to the Customer's website and the Customer's authorised users. The types of personal data may include names, email addresses, telephone numbers, messages and technical information, depending on how the Customer configures the Service. The Customer must not upload special-category data unless it has a lawful basis and has agreed additional safeguards with the Platform.

4. Processor obligations

4.1the Platform will process Customer Personal Data only on documented instructions from the Customer, including with regard to transfers, unless required to do otherwise by law. Where the Platform is required by law to process data for another purpose, it will inform the Customer unless prohibited by law.

4.2the Platform will ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations. The Platform will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

4.3the Platform will maintain records of its processing activities to the extent required by applicable law, including the categories of processing, transfers to third countries and the measures applied. These records are available to the Customer on reasonable request.

4.4the Platform will take reasonable steps to ensure that personnel who access Customer Personal Data receive appropriate training on data protection and confidentiality.

4.5the Platform will assist the Customer in responding to requests from data subjects and in ensuring compliance with the Customer's obligations under applicable data-protection law, taking into account the nature of the processing and the information available to the Platform.

5. Sub-processors

5.1The Customer authorises the Platform to engage sub-processors to provide the Service. A current list of sub-processors is available on request. The Platform will impose data-protection obligations on each sub-processor that are no less protective than those in this DPA.

5.2the Platform remains liable to the Customer for the performance of its sub-processors' obligations. Where a sub-processor fails to fulfil its data-protection obligations, the Platform will take reasonable steps to remedy the failure.

5.3the Platform will give the Customer notice of the addition or replacement of a sub-processor where required by law or by the agreement, giving the Customer an opportunity to object on reasonable data-protection grounds. If the Customer objects and the parties cannot resolve the matter, the Customer may terminate the affected subscription.

6. Security measures

6.1the Platform will implement and maintain technical and organisational measures designed to protect Customer Personal Data, including: tenant and site isolation; role-based access control; administrative audit logging; rate limiting and bot protection; encryption of data in transit; scheduled backups with a documented restore drill; and procedures for identifying and responding to security incidents.

6.2The measures are subject to technical progress and development. The Platform may update them provided that the overall level of protection is not reduced. The Customer is responsible for configuring its own access controls and for keeping credentials secure.

7. Data subject requests

7.1Taking into account the nature of the processing, the Platform will assist the Customer by appropriate technical and organisational measures in fulfilling the Customer's obligation to respond to requests from data subjects. The Platform will promptly inform the Customer if it receives a request directly from a data subject and will not respond to the request except on the Customer's instructions or as required by law.

7.2The console provides tools for exporting and deleting conversations and leads. The Customer is responsible for using those tools to respond to requests within the applicable time limits.

8. Assistance with impact assessments

8.1the Platform will provide reasonable assistance to the Customer in ensuring compliance with obligations relating to data-protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to the Platform.

8.2Where the Customer requires information about the Service's data flows or security measures for an assessment, the Platform will provide the relevant documentation on request.

9. Personal data breaches

9.1the Platform will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent then known, the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.

9.2the Platform will cooperate with the Customer and take reasonable steps to investigate, mitigate and prevent recurrence. Notification to the Customer is not an acknowledgement of fault or liability.

10. International transfers

10.1Where the processing involves a transfer of Customer Personal Data outside the European Economic Area, the United Kingdom or Switzerland, the Platform will ensure that appropriate safeguards are in place, including standard contractual clauses or an adequacy decision, together with supplementary measures where required.

10.2the Platform will provide information about the safeguards applied on request and will cooperate with the Customer in carrying out transfer impact assessments.

11. Return and deletion of data

11.1On termination of the agreement, the Platform will, at the Customer's choice, return or delete Customer Personal Data, except where retention is required by law. The Customer may export conversations and leads for thirty days after termination; after that period, the data is deleted in accordance with the Platform's retention practices.

11.2Deleting a site through the console removes its knowledge base, conversations and associated vectors. The Customer is responsible for exporting any data it wishes to keep before deletion.

11.3Where the Customer requests return of Customer Personal Data, the Platform will provide it in a structured, commonly used and machine-readable format, such as JSON or CSV, within a reasonable period after the request.

11.4If the Customer does not request return or deletion, the Platform will delete Customer Personal Data in accordance with its retention practices, except where retention is required by law or where the data remains in rolling backups for a limited period.

12. Audit and information

12.1the Platform will make available information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, by the Customer or an auditor mandated by the Customer, subject to reasonable notice, confidentiality obligations and scope limitations to protect the security of the Service and the data of other customers.

12.2Audits will be conducted during normal business hours and at the Customer's cost, unless the audit reveals a material breach of this DPA. The Customer will not have access to data of other customers, and the scope will be limited to the systems and processes relevant to the Service.

12.3Where a third-party audit report or certification is available, the Platform may satisfy an audit request by providing that report, subject to confidentiality obligations and the scope of the report.

13. Customer obligations

13.1The Customer must ensure that it has a lawful basis for the processing of Customer Personal Data and that its instructions to the Platform comply with applicable data-protection law. The Customer is responsible for the content it uploads, the questions the assistant asks and the contact details it collects.

13.2The Customer must not instruct the Platform to process special-category data or data relating to criminal convictions unless it has a lawful basis and has agreed additional safeguards in writing. The Customer must configure the Service appropriately for its industry and must provide an appropriate privacy notice to Visitors.

13.3The Customer must notify the Platform promptly if it becomes aware of a breach affecting Customer Personal Data for which it is responsible, and must cooperate with the Platform in responding to the incident.

14. Storage locations and data localisation

14.1Customer Personal Data is stored on infrastructure operated by the Platform and its sub-processors. The primary storage location is described in the security documentation available on request. Backups may be stored in a different location within the same provider's network.

14.2Where the Customer requires data to remain in a specific jurisdiction, the parties may agree additional arrangements in writing. The Platform will confirm whether the requested arrangement is technically and legally feasible before it takes effect.

14.3the Platform will inform the Customer of any material change to the primary storage location that affects the safeguards described in this DPA.

15. Security incident management

15.1the Platform maintains procedures for detecting, investigating and responding to security incidents. Incidents are classified by severity, assigned an owner and tracked to resolution. Where an incident affects Customer Personal Data, the breach notification provisions of this DPA apply.

15.2the Platform will provide the Customer with a summary of the incident and the remedial actions taken, subject to confidentiality and legal restrictions. The Customer is responsible for determining whether it must notify a supervisory authority or affected data subjects.

15.3the Platform will take reasonable steps to prevent recurrence, including changes to configuration, access controls or monitoring where appropriate.

16. Order of precedence

16.1If there is a conflict between this DPA and the main agreement, this DPA prevails with respect to the processing of Customer Personal Data. If there is a conflict between this DPA and the standard contractual clauses incorporated into the agreement, the standard contractual clauses prevail to the extent of the conflict.

16.2Nothing in this DPA varies the commercial terms of the agreement, including fees, liability caps and termination rights, except where expressly stated.

17. Confidentiality

17.1the Platform will treat Customer Personal Data as confidential information and will not disclose it except as permitted by this DPA or required by law. Personnel access is limited to those who need it to provide, secure or support the Service.

17.2Where the Platform receives a request from a public authority for access to Customer Personal Data, it will, unless prohibited by law, notify the Customer and provide reasonable assistance to challenge or narrow the request.

18. Liability and term

18.1The liability of each party under this DPA is subject to the limitations and exclusions set out in the agreement, except where applicable law provides otherwise. Nothing in this DPA limits the rights of data subjects under applicable data-protection law.

18.2This DPA remains in effect for as long as the Platform processes Customer Personal Data on behalf of the Customer. It terminates automatically when the processing ends, subject to the retention and deletion provisions above.

19. Governing law and contact

19.1This DPA is governed by the law specified in the agreement, unless mandatory data-protection law requires otherwise. Questions about this DPA can be sent using the contact details published on this platform.

19.2If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force and effect, and the parties will replace the invalid provision with one that achieves the intended purpose to the extent permitted by law.

19.3This DPA is a draft for the prototype and must be reviewed by qualified counsel before it is relied upon.