Data processing agreement

1. Parties and precedence

• This agreement is entered into between the customer as controller ("you") and BotTellMe, company reg. no. (CVR) 28003439, Fuglegårdsvej 20A, 2820 Gentofte, Denmark, as processor ("we"), when you use BotTellMe Chatbots.
• The agreement is part of BotTellMe's terms of business (bottellme.com/en/terms) and is accepted when the organisation is created. It meets Article 28(3) of the General Data Protection Regulation (GDPR).
• In matters of personal data, this agreement takes precedence over the terms.

2. The processing

• Purpose: to provide the chatbot on your website, that is, to answer visitors' questions from your content, forward enquiries to you, show conversations and statistics in the portal and provide support.
• Nature of the processing: collection, storage, search, processing with language models, forwarding by email, display and deletion.
• Types of personal data: visitors' messages and the chatbot's answers (messages may contain whatever the visitor writes), time, page, language, conversation ID and rating; name, email and phone when a visitor asks to be contacted; and personal data in the content you give the chatbot (websites, texts and files), such as names and contact details of employees.
• Data subjects: visitors on your website who use the chatbot, and people mentioned in your content.
• Sensitive personal data is not processed deliberately. The chatbot does not ask for it, and you must not instruct it to collect it.
• Duration: as long as you use BotTellMe Chatbots and until deletion under section 10.

3. Instructions

• We only process the personal data on your documented instructions. The instructions are this agreement, the terms and the choices you make in the portal, such as the language model and the recipient of enquiries.
• If EU or Danish law requires us to process the data otherwise, we inform you first, unless the law prohibits it.
• If we believe an instruction infringes data protection rules, we tell you immediately.
• Our staff may read conversations when needed for support, troubleshooting, start configuration and improving your chatbot.

4. Confidentiality

Only people who need it have access to the personal data, and they are bound by confidentiality.

5. Security

We take appropriate technical and organisational measures under Article 32. Among other things, all traffic is encrypted, access to conversations is enforced in the database so that only your users and BotTellMe's administrators have access, access keys exist only in the server environment, and conversations are deleted automatically after the retention period.

6. Sub-processors

• You give general authorisation for us to use the sub-processors listed at the end of this agreement.
• We impose the same data protection obligations on them as we have, and we are liable to you for their processing.
• We give at least 30 days' notice of new or replaced sub-processors by email to the organisation's owner. You can object. If we cannot accommodate the objection, you can terminate the subscription before the change takes effect.

7. Transfers outside the EU

• Personal data is only transferred outside the EU to the sub-processors listed at the end, on the basis of the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.
• If you choose OpenAI as the language model, conversations are processed outside the EU. If you choose Mistral, they are processed in the EU. The choice is part of your instructions.

8. Assistance

• We help you respond to requests from data subjects, such as access or erasure. You can see and export conversations in the portal yourselves, and we delete on your request.
• We help you with security, personal data breaches, impact assessments and consultation of the supervisory authority (Articles 32-36), taking into account the nature of the processing and the information available to us.
• We may charge for assistance beyond the usual at the time spent.

9. Personal data breaches

We notify you without undue delay after becoming aware of a breach, with the information we have, so you can report it to the supervisory authority within 72 hours.

10. Deletion

• Conversations and enquiries are deleted automatically after the chatbot's retention period, which is 90 days unless otherwise agreed.
• When the agreement ends, you can have your data handed over for 30 days, as set out in the terms. After that, we delete the personal data within 60 days, unless the law requires us to keep it. Backups are deleted in their normal cycle.

11. Documentation and audits

We give you the information needed to demonstrate that we comply with Article 28 and allow for audits, including inspections, by you or an auditor you have mandated. Audits are announced at least 30 days in advance, take place at most once a year unless a breach or an authority requires it, and are paid for by you.

12. Liability, duration and governing law

The liability provisions in the terms also apply to this agreement, to the extent the GDPR allows. The agreement applies as long as we process personal data for you. Danish law and the venue in the terms apply.

Sub-processors

• Supabase Inc.: database, login and files. Frankfurt, Germany.
• Render Services, Inc.: servers for the chatbot, reading content and sending enquiries. Frankfurt, Germany.
• Cloudflare, Inc.: network and protection of the connection to the chatbot. Global network.
• OpenAI (OpenAI Ireland Ltd. and OpenAI, L.L.C.): language model and search for chatbots on OpenAI, and grading in Quality and security for all chatbots. United States.
• Mistral AI SAS: language model and search for chatbots on Mistral. EU.
• Microsoft Ireland Operations Ltd.: sending enquiries by email. EU and United States.