Data Processing Addendum

1. Subject matter and duration

The Processor processes personal data to provide the Service for as long as the Controller has an account, plus the deletion period in the Privacy Policy.

2. Nature, purpose, data and subjects

• Purpose: hosting conversations, generating AI answers, delivering messages over connected channels, providing the inbox, analytics and integrations.
• Data: conversation content, visitor identifiers, phone numbers, email addresses, names and any other data the Controller's end users provide; knowledge files; team member account data.
• Data subjects: the Controller's customers, website visitors, callers and staff.

3. Processor obligations

• Process personal data only on the Controller's documented instructions, which include the Service's settings and features, unless the law requires otherwise.
• Ensure staff with access are bound by confidentiality.
• Apply appropriate technical and organisational measures: TLS in transit, encryption of credentials at rest, access control, audit logging, backups and least-privilege administration.
• Assist the Controller with data subject requests, security, impact assessments and consultations, in so far as the Service allows.
• Notify the Controller without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting the Controller's data.
• Delete or return personal data at the end of the Service, unless retention is required by law.
• Make available the information needed to demonstrate compliance and allow audits, on reasonable notice and no more than once a year unless required by a supervisory authority.

4. Sub-processors

The Controller authorises the following categories of sub-processors: cloud hosting; Stripe for payments; the AI model providers configured for the platform (for example OpenAI, Anthropic); speech-to-text and text-to-speech providers for voice (Deepgram, ElevenLabs); messaging and telephony networks the Controller connects (Meta, Twilio, Slack, Telegram, email providers); transactional email. The current list is available on request at privacy@agentpro.chat. The Processor will give at least 14 days' notice of new sub-processors; the Controller may object on reasonable data-protection grounds, in which case the parties will seek a solution and, failing that, the Controller may terminate the affected Service.

5. International transfers

Where personal data subject to the GDPR or UK GDPR is transferred to a third country, the Processor relies on an adequacy decision or the EU Standard Contractual Clauses (and the UK Addendum) with the relevant sub-processor.

6. Controller obligations

The Controller is responsible for the lawfulness of the data it collects through its chatbots and channels, for providing privacy notices to its end users, for obtaining any consents required (including for recorded voice calls where applicable), and for configuring retention and chatbot behaviour appropriately.

7. Liability and precedence

Liability under this addendum is subject to the limitations in the Terms of Service. In case of conflict, this addendum prevails over the Terms for matters of personal data processing.