Data processing terms (DPA)

1. Roles and scope

1.1 For the personal data in Annex 1 (“Customer Personal Data”), the Customer is the controller and AgentPage is the processor. If the Customer itself acts as a processor for another controller, the Customer is responsible for having authority to give these instructions and for passing on the required terms.

1.2 The Customer’s account details are not Customer Personal Data. AgentPage is their controller, as the privacy policy describes.

1.3 Each party will comply with the data protection law that applies to it.

2. Instructions

2.1 AgentPage will process Customer Personal Data only on the Customer’s documented instructions, which are: the terms of service, these terms, and the Customer’s use of the AgentPage tools and settings. AgentPage will also process it where the law requires, and will tell the Customer first unless the law forbids that.

2.2 The Customer is responsible for the lawfulness of its instructions, for telling visitors about the processing, and for having a lawful basis for it. AgentPage will tell the Customer if it thinks an instruction breaches data protection law.

3. Confidentiality

AgentPage will make sure that the people it allows to process Customer Personal Data are bound by a duty of confidentiality, and will limit access to those who need it to run the service.

4. Security

AgentPage will take the technical and organisational measures required by Article 32 of the GDPR, including those in Annex 2, taking into account the state of the art, the costs, the nature of the processing and the risks. AgentPage may update its measures if it does not lower the overall level of protection.

5. Sub-processors

5.1 The Customer gives general written authorisation for AgentPage to use the sub-processors in Annex 3.

5.2 AgentPage will tell the Customer by email, or on its website, at least [30 days] before it adds or replaces a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may close its account, and its data will be deleted as set out in section 9.

5.3 AgentPage will bind each sub-processor by contract to data protection obligations no less protective than these terms, and remains responsible to the Customer for each sub-processor’s performance.

5.4 The platform that runs the chat is provided by Hello Umi, S.L. (“Landbot”). AgentPage uses it under Landbot’s data processing terms and its published sub-processor arrangements, which apply to the Customer Personal Data held there. [PENDING: Landbot’s written authorisation and DPA on file for AgentPage.]

6. International transfers

AgentPage will transfer Customer Personal Data outside the EEA or the UK only with a valid transfer mechanism in place, such as an adequacy decision, the EU-US Data Privacy Framework, or the standard contractual clauses (with the UK addendum where needed). Where the Customer is in a country that requires it, the parties agree that the standard contractual clauses, Module 2 (controller to processor), form part of these terms for any restricted transfer by the Customer to AgentPage, with the details in Annex 1 and Annex 3. [LAWYER TO CONFIRM clause choices, governing law and supervisory authority for the SCCs.]

7. Help with data subject requests and compliance

7.1 If AgentPage receives a request from a visitor about Customer Personal Data, it will not respond to the substance itself and will pass it to the Customer without undue delay, and in any case within [2 working days], unless the law requires otherwise.

7.2 Taking into account the nature of the processing, AgentPage will help the Customer with appropriate technical and organisational measures to respond to requests to exercise data subject rights. The Customer can ask [PRIVACY EMAIL] to find, export, correct or delete a visitor’s data in the chat records.

7.3 AgentPage will help the Customer with its duties under Articles 32 to 36 of the GDPR (security, breach notification, impact assessments and prior consultation), taking into account the information available to AgentPage.

8. Personal data breaches

AgentPage will tell the Customer by email without undue delay, and in any case within [24 hours], after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as AgentPage then knows, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken, and AgentPage will update it as it learns more. AgentPage will help the Customer to meet its duty to notify authorities and individuals. When a sub-processor tells AgentPage of a breach, AgentPage will start this period from that notice.

9. Deletion and return

While the account is open, Customer Personal Data is deleted automatically after the retention period set out in the privacy policy (by default 90 days). When the service ends, AgentPage will make an export of the leads available on request for [30 days] and will then delete Customer Personal Data, including copies held by sub-processors where it can, unless the law requires it to keep it. Backups expire within [30 days] after deletion. AgentPage will confirm deletion on request.

10. Information and audits

AgentPage will give the Customer the information needed to show compliance with Article 28 of the GDPR, such as security summaries and sub-processor documents. If that is not enough, the Customer may carry out an audit, no more than once a year unless there has been a breach or a regulator requires it, on at least [30 days] written notice, during working hours, without disrupting the service, subject to confidentiality and at the Customer’s cost. AgentPage may meet an audit request by giving a recent independent report where one exists.

11. Liability and order of precedence

Each party’s liability under these terms is subject to the limits in the terms of service, except where the law, or the standard contractual clauses where they apply, do not allow a limit. If these terms conflict with the terms of service about personal data, these terms apply. If they conflict with the standard contractual clauses, the clauses apply.

Annex 1: Details of the processing

Subject matter

Running a lead-capturing chat on the Customer’s website, storing the conversations and leads, and sending them to the Customer.

Duration

Until the service ends, plus the deletion period in section 9.

Nature and purpose

Collecting, recording, storing, structuring, summarising (including with the help of AI), transmitting by email, and deleting chat conversations and lead details, in order to provide the service to the Customer.

Types of personal data

Names, email addresses, telephone numbers, company names, the content of messages and answers given in the chat, the web page and language of the chat, and date and time. Technical data (such as IP address and browser details) is processed by the network and platform providers to deliver the chat. The chat is not designed to collect special-category data; visitors may nonetheless type it.

Categories of data subjects

Visitors to the Customer’s website who use the chat, and people they mention.

Frequency

Continuous, while the chat is live.

Competent supervisory authority (for the clauses)

[TO BE SET WITH THE LAWYER]

Annex 2: Security measures

• Encryption in transit (HTTPS) and at rest. [CONFIRM]
• Separation of data by customer, with the customer’s account checked on every read, write and send.
• Sign-in by one-time email link; OAuth with explicit consent for AI tools, short-lived tokens and the ability to revoke them.
• Secrets held in the hosting provider’s secret store; none in source code.
• Least-privilege access to production data for the people who run the service; access logged where the provider allows.
• Treating website text and visitor messages as data, never as instructions, and blocking requests to private network addresses when reading a customer’s site.
• Rate limits and caps to limit abuse.
• Automated retention deletion. Regular backups that expire on a fixed schedule. [CONFIRM backup and restore testing]
• Monitoring of the delivery of leads and reports, and a process for responding to incidents and notifying customers.

Annex 3: Sub-processors