Data processing addendum

This Data Processing Addendum (the "DPA") is part of the Terms of service between the customer that holds an ASDK account ("Customer") and [TBD: legal entity name] ("ASDK"). It applies whenever ASDK processes personal data on Customer's behalf while providing the Service.

Customer accepts this DPA by accepting the Terms or using the Service; no signature is needed for it to apply. If Customer needs a record of its acceptance, an owner or admin can accept this DPA in the dashboard at app.asdk.com (Settings, then Privacy), which records the version, the time, the person, their IP address and browser, and gives a printable copy with Customer's details filled in. Customer can also request a signed copy at [TBD: privacy contact email]. Both have the same content as this page.

At a glance

• Customer decides why and how its visitors' data is used (Customer is the controller). ASDK processes that data only to provide the Service on Customer's instructions (ASDK is the processor).
• ASDK keeps the data confidential, protects it with the measures in Annex 2, and never uses it to train foundation models or to serve another customer.
• ASDK uses the subprocessors listed on the Subprocessors page and gives at least 30 days' notice before adding a new one.
• If a personal data breach affects Customer's data, ASDK tells Customer without undue delay and in any case within 72 hours after becoming aware of it.
• Conversations are kept for 12 months by default, or for the period Customer sets. When Customer closes its account, ASDK deletes Customer's data within 30 days.
• Transfers out of the EEA, the UK and Switzerland are covered by the EU Standard Contractual Clauses, which this DPA incorporates, the UK Addendum, and the EU-US Data Privacy Framework where a provider is certified.

1. Definitions

In this DPA:

• "Data Protection Laws" means all laws on privacy and personal data that apply to the processing under this DPA, including the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (the "FADP"), and US state privacy laws such as the California Consumer Privacy Act (the "CCPA"), each as amended from time to time.
• "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom.
• "Customer Personal Data" means personal data contained in Customer Content or Conversations that ASDK processes on Customer's behalf in providing the Service.
• "controller", "processor", "data subject", "personal data", "processing", "personal data breach" and "supervisory authority" have the meanings given in the GDPR, and include the equivalent terms in other Data Protection Laws (for example, "business" and "service provider" under the CCPA).
• "Subprocessor" means a third party that ASDK engages to process Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by ASDK or its Subprocessors.
• "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of June 4, 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as revised under its terms.
• "Restricted Transfer" means a transfer of Customer Personal Data to a country that has not been recognized as providing an adequate level of protection, where Data Protection Laws require a transfer mechanism.

Terms used but not defined here, such as "Service", "Customer Content", "Conversations", "Visitors" and "Users", have the meanings given in the Terms.

2. Roles and scope

2.1 Customer as controller. For Customer Personal Data, Customer is the controller and ASDK is the processor. If Customer is itself a processor acting for another controller, for example an agency acting for its clients, ASDK is Customer's subprocessor. In that case Customer confirms that its instructions, including the engagement of ASDK and its Subprocessors, have been authorized by the controller, and Customer remains ASDK's only point of contact.

2.2 ASDK as controller. ASDK processes the account details of Customer's Users and billing contacts, and Usage Data, for its own purposes as an independent controller, as described in the Privacy policy. This DPA does not apply to that processing.

2.3 Details of processing. The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.

2.4 Services Customer connects. When Customer connects a CRM, calendar, webhook, automation tool or other service, ASDK sends that service Customer Personal Data on Customer's instructions. These services are Customer's own providers, not ASDK's Subprocessors, and ASDK is not responsible for how they process data.

3. Customer's instructions

3.1 Processing only on instructions. ASDK processes Customer Personal Data only on Customer's documented instructions, including with regard to international transfers, unless the law to which ASDK is subject requires otherwise. In that case, ASDK will inform Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

3.2 What counts as instructions. Customer's documented instructions are: the Terms and this DPA; Customer's configuration of the Service, such as the websites and files it connects, the Agents it switches on, the integrations it connects and the retention period it sets; Customer's API requests; and any other written instructions that ASDK agrees to. Instructions outside the scope of the Service require ASDK's agreement.

3.3 Instructions that may break the law. ASDK will tell Customer immediately if, in ASDK's opinion, an instruction infringes Data Protection Laws. ASDK is not required to carry out a legal review of Customer's instructions.

4. Customer's responsibilities

4.1 Lawful basis and notices. Customer is responsible for having a lawful basis for the processing, for giving data subjects the information the law requires (including a privacy notice that describes the use of ASDK), for obtaining any consent the law requires (including for the browser storage the widget uses, as explained in our Cookie policy), and for meeting its own duties as a deployer of AI systems, such as AI transparency duties.

4.2 Sensitive data. The Service is not designed for special categories of personal data (GDPR Article 9) or data about criminal convictions and offenses (GDPR Article 10). Customer will not configure Agents to request such data, government identification numbers, payment card numbers or passwords, unless the law allows it, Customer has told ASDK in writing and ASDK has agreed. Visitors may still volunteer such data in free-text messages; ASDK processes it only as part of the Conversation.

4.3 Retention settings. Customer is responsible for choosing a retention period for Conversations that fits its own obligations. Until Customer changes it, the default is 12 months.

5. ASDK's obligations

5.1 Confidentiality. ASDK ensures that every person it authorizes to process Customer Personal Data is bound by an obligation of confidentiality and has access only to the extent needed for their role.

5.2 Security. ASDK implements the technical and organizational measures described in Annex 2 to protect Customer Personal Data, as required by GDPR Article 32. ASDK may update these measures as technology and risks change, as long as the overall level of protection is not reduced.

5.3 Purpose limitation. ASDK will not use Customer Personal Data for its own purposes. In particular, ASDK will not use it to train foundation models or other general-purpose AI models, will not use one customer's data to provide the Service to another customer, and will not sell it.

5.4 Records. ASDK keeps a record of its processing activities on behalf of its customers, as required by GDPR Article 30(2).

5.5 Cooperation with authorities. ASDK will cooperate with competent supervisory authorities in the performance of their tasks, as the law requires.

6. Subprocessors

6.1 General authorization. Customer gives ASDK general written authorization to engage Subprocessors. The current Subprocessors are listed on the Subprocessors page, which forms Annex 3 of this DPA.

6.2 Subprocessor contracts. ASDK engages each Subprocessor under a written contract that imposes data protection obligations no less protective than those in this DPA, including sufficient guarantees that it will implement appropriate technical and organizational measures.

6.3 Responsibility. ASDK remains fully liable to Customer for the performance of each Subprocessor's obligations.

6.4 Notice of new Subprocessors. ASDK will give at least 30 days' notice before a new Subprocessor starts processing Customer Personal Data, by updating the Subprocessors page and emailing the owner of Customer's account.

6.5 Objections. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing [TBD: privacy contact email] within the notice period. The parties will work in good faith to resolve the objection, for example by ASDK explaining the safeguards in place or suggesting a configuration that avoids the Subprocessor for Customer's data. If the objection can't be resolved, Customer may stop using the affected part of the Service, or close its account, before the change takes effect. This Section 6 is the notice and objection procedure for Clause 9(a) of the SCCs.

6.6 Copies of Subprocessor terms. On request, ASDK will provide a copy of the data protection terms it has with a Subprocessor. ASDK may remove commercial information or replace the copy with a summary where needed to protect confidential information.

7. Requests from data subjects

7.1 Customer's tools. The Service gives Customer tools to find, export and delete Conversations and leads and to delete Customer Content. Where a tool is not yet available in the dashboard, ASDK carries out the action at Customer's request. Customer uses these tools to respond to data subjects.

7.2 Requests made to ASDK. If ASDK receives a request from a data subject about Customer Personal Data, ASDK will not respond to it directly, except to tell the data subject to contact Customer, and will forward the request to Customer without undue delay where the data subject identifies Customer.

7.3 Assistance. Taking into account the nature of the processing, ASDK will assist Customer with appropriate technical and organizational measures, insofar as possible, in responding to requests from data subjects to exercise their rights.

8. Assistance with security, impact assessments and consultations

Taking into account the nature of the processing and the information available to it, ASDK will assist Customer in meeting its obligations under GDPR Articles 32 to 36: security of processing, notification of personal data breaches, data protection impact assessments and prior consultation with supervisory authorities. ASDK does this mainly by providing this DPA, Annex 2, the Security page and reasonable answers to Customer's questions.

9. Security incidents

9.1 Notice. ASDK will notify Customer without undue delay, and in any case within 72 hours after becoming aware of a Security Incident.

9.2 How and what. ASDK sends the notice to the email address of the owner of Customer's account and may also show it in the dashboard. The notice describes, to the extent the information is available: the nature of the Security Incident, including the categories and approximate number of data subjects and records concerned; its likely consequences; the measures taken or proposed to address it and limit its effects; and a contact point for more information. Where not all information is available at once, ASDK will provide it in phases as it becomes available.

9.3 Response. ASDK will promptly take reasonable steps to contain and investigate the Security Incident and limit its effects, and will keep Customer informed of material developments.

9.4 Customer's notifications. Customer is responsible, as controller, for any notifications to supervisory authorities and data subjects. ASDK will provide reasonable help.

9.5 No admission. ASDK's notice of a Security Incident is not an acknowledgment of fault or liability.

9.6 Unsuccessful attempts. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, blocked attacks or failed sign-in attempts, are not Security Incidents.

10. Deletion and return of data

10.1 During the subscription. Customer can delete Customer Personal Data through the dashboard or by asking ASDK. ASDK deletes it from its live systems within 30 days of the deletion request. Conversations are deleted automatically at the end of the retention period Customer has set, which is 12 months by default.

10.2 When the account closes. Before closing its account, Customer can export its Conversations and leads. After the account is closed, ASDK deletes all Customer Personal Data from its live systems within 30 days. Copies in encrypted backups expire within a further 30 days. If the law requires ASDK to keep some of the data, ASDK keeps it confidential and processes it only for the purpose the law requires. On request, ASDK will confirm the deletion in writing.

11. Audits and information

11.1 Information. ASDK will make available to Customer the information necessary to demonstrate compliance with GDPR Article 28 and this DPA. This includes this DPA, Annex 2, the Security page and written answers to a reasonable security and privacy questionnaire, normally once a year.

11.2 Certifications. ASDK does not currently hold third-party security certifications such as SOC 2 or ISO 27001. If ASDK obtains independent audit reports or certifications, it will provide them to Customer on request, under confidentiality.

11.3 Audits. If the information under Section 11.1 is not enough to demonstrate compliance, or a supervisory authority requires it, Customer may audit ASDK's compliance with this DPA, itself or through an independent auditor bound by confidentiality who is not a competitor of ASDK. Customer must give at least 30 days' notice and agree the scope in advance. Audits take place during normal business hours, no more than once a year unless a Security Incident has occurred or a supervisory authority requires otherwise, at Customer's cost, and in a way that does not give access to other customers' data or put the security of the Service at risk.

11.4 SCC audits. Audits under Clause 8.9 of the SCCs are carried out in line with this Section 11.

12. International transfers

12.1 Where data is processed. Customer Personal Data may be processed in the European Union, the United States and the other locations shown on the Subprocessors page.

12.2 Transfers to Subprocessors. ASDK ensures that every Restricted Transfer to a Subprocessor is covered by a valid transfer mechanism under Data Protection Laws, such as an adequacy decision (including the Subprocessor's certification under the EU-US Data Privacy Framework, its UK Extension or the Swiss-US Data Privacy Framework) or the SCCs (Module 3), with the UK Addendum for UK data.

12.3 Transfers from Customer to ASDK: EU SCCs. To the extent that the transfer of Customer Personal Data from Customer to ASDK is a Restricted Transfer under the GDPR, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor. Customer is the data exporter and ASDK is the data importer.
• Clause 7 (docking clause) applies.
• Clause 9(a): Option 2 (general written authorization) applies, with the notice period in Section 6.4.
• Clause 11(a): the optional language does not apply.
• Clause 13: the competent supervisory authority is determined in line with Clause 13(a).
• Clause 17: Option 1 applies, and the SCCs are governed by the law of Ireland.
• Clause 18(b): disputes are resolved by the courts of Ireland.
• Annex I.A (parties): Customer, with the details in its account, as data exporter; ASDK, with the details in Section 16, as data importer. Annex I.B (description of the transfer): Annex 1 of this DPA. Annex I.C (competent supervisory authority): as set out under Clause 13 above. Annex II (technical and organizational measures): Annex 2 of this DPA. Annex III (Subprocessors): the Subprocessors page.

12.4 Transfers from the United Kingdom. For Restricted Transfers under the UK GDPR, the UK Addendum is incorporated into this DPA by reference. Table 1 is completed with the parties' details in Section 12.3; Table 2 with the modules and options selected in Section 12.3; Table 3 with Annexes 1 to 3 of this DPA; and in Table 4, neither party may end the UK Addendum under its Section 19.

12.5 Transfers from Switzerland. For Restricted Transfers under the FADP, the SCCs apply as set out in Section 12.3, with these changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and the term "Member State" does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence.

12.6 If ASDK is established in the EEA. If the ASDK entity named in Section 16 is established in the EEA, the transfer from Customer to ASDK is not a Restricted Transfer under the GDPR and Section 12.3 does not apply to it. Section 12.2 still applies to ASDK's onward transfers to Subprocessors outside the EEA.

12.7 Change of transfer mechanism. If a transfer mechanism that ASDK or a Subprocessor relies on is invalidated or no longer applies, for example if the EU-US Data Privacy Framework is invalidated, ASDK will rely on the SCCs or another valid mechanism, and the parties will cooperate to put it in place without undue delay.

12.8 Requests from public authorities. If ASDK receives a legally binding request from a public authority for access to Customer Personal Data, ASDK will, unless the law prohibits it: promptly notify Customer; review the legality of the request and challenge it where, after careful assessment, there are reasonable grounds to consider it unlawful; and disclose only the minimum information the request requires. ASDK will document its assessment.

12.9 Precedence of the SCCs. If there is a conflict between the SCCs or the UK Addendum and this DPA or the Terms, the SCCs or the UK Addendum apply.

13. US state privacy laws

13.1 Role. For Customer Personal Data that is personal information under the CCPA or similar US state laws, ASDK acts as Customer's "service provider" or "processor", and Customer discloses the personal information to ASDK only for the limited and specified business purpose of providing the Service described in the Terms and in Annex 1.

13.2 Restrictions. ASDK will not:

• sell or share the personal information, as those terms are defined in the CCPA;
• retain, use or disclose it for any purpose, including any commercial purpose, other than providing the Service and the other business purposes the CCPA allows;
• retain, use or disclose it outside the direct business relationship between Customer and ASDK; or
• combine it with personal information it receives from other sources or collects from its own interactions with the consumer, except as the CCPA and its regulations allow.

13.3 Compliance and notice. ASDK will comply with the obligations that apply to it under the CCPA and provide the same level of privacy protection the CCPA requires of businesses. ASDK will notify Customer if it determines that it can no longer meet these obligations. Customer may then take reasonable and appropriate steps to stop and remediate unauthorized use, including by exercising its rights under Sections 6, 10 and 11.

13.4 Certification. ASDK confirms that it understands and will comply with the restrictions in this Section 13.

14. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations of liability in the Terms, except where Data Protection Laws or the SCCs do not allow those limitations, for example with respect to the rights of data subjects under the SCCs.

15. Term, precedence and changes

15.1 Term. This DPA applies for as long as ASDK processes Customer Personal Data, including after the Terms end until the data is deleted under Section 10.

15.2 Precedence. For the processing of Customer Personal Data, the SCCs and the UK Addendum (where they apply) take precedence over this DPA, and this DPA takes precedence over the rest of the Terms.

15.3 Changes. ASDK may update this DPA as described in the Terms. An update will not reduce the overall level of protection for Customer Personal Data, unless the law requires the change.

15.4 Governing law. This DPA is governed by the law that governs the Terms, except that the SCCs are governed by the law chosen in Section 12.3.

16. Contact

ASDK: [TBD: legal entity name], [TBD: registered office address]. Data protection questions: [TBD: privacy contact email]. Security Incidents and security questions: security@asdk.com.

Annex 1: Details of processing

Annex 2: Technical and organizational measures

ASDK maintains the following measures. They are described in plain language on our Security page.

Encryption

• Data in transit between browsers, the widget, ASDK and its Subprocessors is encrypted with TLS 1.2 or higher.
• Data at rest is encrypted, including databases, object storage and backups.
• Secrets that Customer gives ASDK, such as access tokens for connected services and API keys, are additionally encrypted at the application level with AES-GCM, with encryption keys kept separate from the data they protect.

Access control

• Access to production systems and Customer Personal Data is based on least privilege: only personnel who need it for their role get access, and only to the extent needed.
• Every person uses an individual account, and multi-factor authentication is required for production systems and for the administration consoles of Subprocessors.
• Access rights are reviewed regularly and removed promptly when no longer needed, including when someone leaves.
• ASDK personnel access Customer Content or Conversations only to provide support Customer asks for, to investigate security or abuse, or when the law requires it.

Separation between customers

• Each customer site's knowledge base is stored in its own namespace in the vector database, and Agents retrieve content only from the namespace of the site they serve.
• Every database query for customer data is scoped to the customer account it belongs to.
• Development and test environments are separate from production and do not use Customer Personal Data.

Application and infrastructure security

• Code changes are reviewed before they are deployed.
• Dependencies are kept up to date and checked for known vulnerabilities.
• Visitor messages and website content are treated as untrusted input.
• The crawler fetches only public internet addresses, which prevents it from being used to reach internal systems.
• Rate limiting and protection against denial-of-service attacks and malicious bots are applied at the network edge and in the application.
• Databases and internal services are not exposed directly to the internet.

Logging and monitoring

• Security-relevant events, such as sign-ins and administrative actions, are logged. Logs are kept for up to 90 days.
• Errors are monitored, and error reports are configured to remove sensitive fields where possible. Error reports are kept for up to 90 days.

Backups and resilience

• The database is backed up regularly. Backups are encrypted and expire on a rolling basis within 30 days.
• Restore procedures are documented.

Incident response

• ASDK follows a documented incident response process: detection, containment, investigation, notification and follow-up.
• Customers are notified of Security Incidents without undue delay and in any case within 72 hours after ASDK becomes aware of them (Section 9).
• Security issues can be reported to security@asdk.com.

Personnel

• Everyone with access to Customer Personal Data is bound by confidentiality obligations and receives security and privacy training.

Subprocessor management

• ASDK reviews the security and data protection practices of each Subprocessor before engaging it and has a data protection agreement with each one.

Data minimization and retention

• Customer can set how long Conversations are kept (12 months by default) and delete data at any time.
• Data is deleted within the periods in Section 10.

Certifications

• ASDK does not yet hold certifications such as SOC 2 or ISO 27001. If it obtains any, it will list them on the Security page.

Annex 3: Subprocessors

The list of Subprocessors, with their purpose, data, location and transfer mechanism, is published on the Subprocessors page and forms part of this DPA.