Data Processing Agreement

Version 2026-10-06

1. Parties and roles

1.1. Controller. The business that uses Assistant Workshop through its owner account (the "Client"). The Client decides why and how the personal data of its customers and staff are processed.

1.2. Processor. [Legal name of the operator], [registered address], [registration number] (the "Provider"), which operates Assistant Workshop and processes personal data only on behalf of the Client.

1.3. This Data Processing Agreement (the "Agreement") is part of the terms of service between the Client and the Provider. Where the two conflict on the protection of personal data, this Agreement prevails.

1.4. The Agreement applies the EU General Data Protection Regulation (GDPR) as the reference standard, together with the data protection law of the country of the Client (for example the Law of Georgia on Personal Data Protection). Where a local law sets a stricter rule, the stricter rule applies.

2. Subject matter, nature and purpose

2.1. The Provider supplies an AI front-line assistant that answers the Client's customers on the Client's behalf in chat (the website widget, Telegram, WhatsApp, Instagram and Messenger) and by phone, takes bookings and requests, passes conversations to the Client's staff, notifies staff, shows reports in the Client's cabinet and bills the subscription. To keep the answers correct, it checks the quality of a small sample of real conversations, unless the Client turns this off (Settings, Privacy).

2.2. Processing consists of collecting, recording, storing, structuring, retrieving, using, transmitting to the sub-processors listed in section 8, restricting and erasing personal data, as needed for the purpose in 2.1.

2.3. The Provider processes personal data only on the documented instructions of the Client. The Client's settings in the cabinet (assistant knowledge, channels, retention period, staff contacts) and its use of the service are its instructions. The Provider does not use the Client's personal data for its own purposes, does not sell it, and does not use it to train AI models.

2.4. The Provider tells the Client without delay if, in its opinion, an instruction breaks data protection law.

3. Data subjects and categories of personal data

3.1. Data subjects:

• the Client's customers and visitors who write to or call the assistant;
• the Client's owners, staff and managers who use the cabinet or receive notifications.

3.2. Categories of personal data:

• contact details: name, phone number, messenger user identifiers, e-mail address when given;
• content of conversations: chat messages, call transcripts and, where the Client turns recording on and callers are told about it, call recordings;
• booking and request details: dates and times, number of guests, chosen services, notes, budget and similar details the customer gives;
• technical data: channel identifiers, time stamps, IP addresses of cabinet users, records of the audit log;
• staff data: name, phone number, e-mail address, Telegram chat identifier.

3.3. The service is not designed to collect special categories of personal data (for example data concerning health). Where the Client's business (for example a clinic) may receive such data, the Client configures the assistant not to ask for it and is responsible for a legal basis for any such data its customers volunteer. [Additional safeguards for special categories, if any.]

4. Duration

4.1. The Agreement applies while the Client uses the service and until all personal data are returned or deleted under section 13.

5. Obligations of the Client

5.1. The Client ensures it has a legal basis for the processing and informs its customers about it, in particular through a privacy notice on its website and channels and, where calls are recorded, a recording notice at the start of each call.

5.2. The Client keeps the information given to the assistant accurate and gives the Provider only the personal data the service needs.

5.3. The Client answers the requests of its data subjects, using the tools of section 11.

6. Obligations of the Provider

6.1. The Provider:

• processes personal data only as described in this Agreement;
• ensures that persons authorised to process personal data are bound by confidentiality;
• applies the security measures of section 9;
• engages sub-processors only under section 8;
• assists the Client with data subject requests (section 11), security, breach notification (section 12), data protection impact assessments and prior consultations, taking into account the information available to it;
• keeps a record of processing activities and makes available to the Client the information needed to demonstrate compliance (section 10).

7. Location of data and transfers

7.1. The Client's data are stored in the European Union: the application and its database run in Frankfurt, Germany. The language model is used through an EU data residency project and the voice agent through an EU residency environment, as listed in section 8.

7.2. Personal data are transferred outside the European Economic Area only when a sub-processor in section 8 requires it (for example a messenger the customer chose to write in) and only with appropriate safeguards: an adequacy decision, the EU Standard Contractual Clauses or an equivalent mechanism under the law of the Client's country.

8. Sub-processors

8.1. The Client authorises the Provider to use the following sub-processors.

8.2. The Provider imposes on each sub-processor data protection obligations no less protective than this Agreement and remains responsible to the Client for them.

8.3. The Provider informs the Client of any intended addition or replacement of a sub-processor at least [30] days in advance, in the cabinet or by e-mail. The Client may object on reasonable data protection grounds; if the parties cannot agree, the Client may end the subscription before the change takes effect.

9. Security measures

9.1. The Provider applies technical and organisational measures appropriate to the risk, including:

• encryption of all traffic over the internet (TLS), with strict transport and security headers on the API and the cabinet;
• encryption at rest of the access tokens of the Client's channels and of authenticator secrets, under keys that are rotated; call recordings, media files and full data exports are encrypted with a key of their business;
• separation of every Client's data in the database (row-level security keyed by the business), in addition to checks in the application;
• sign-in with one-time codes, with limits per destination, per network and per attempt and a bot check for unusual requests;
• two-factor sign-in with an authenticator app and single-use recovery codes: required for the Provider's administrators and, at the Client's choice, for its team; removing or replacing a factor takes effect on every signed-in device;
• a fresh confirmation, at most 10 minutes old, before sensitive actions: data exports and erasure, changes of the team, the channels and the privacy settings;
• sessions that end after a period without use and at an absolute limit, a list of signed-in devices that can be ended remotely, and a notice of every sign-in from a new device;
• roles of owner and staff; billing, settings and requests about customers' data only for owners;
• access by the Provider's support only with a stated reason, for at most 60 minutes and read-only unless the Client allows changes; the Client sees it in the cabinet and it is recorded in the audit log;
• an audit log of operations on personal data (views, exports, erasures, changes of the team, support access), shown to the Client in the cabinet;
• a full export of the Client's data opens only through a one-time link that is valid for 10 minutes, works only for the owner who asked for it, allows at most three downloads of an export, and every download is announced to all owners;
• automatic deletion of conversations, records of language model calls and call recordings after the periods the Client sets;
• checks of the assistant's replies before they are sent: no contact details of another customer, prices and promises only from the Client's facts, text from outside marked as untrusted; test conversations kept apart from real ones;
• personal data reaches a sub-processor only for the purposes section 8 names for it; the service does not start when its settings would send data elsewhere;
• daily encrypted backups of the database kept in the EU (30 daily and 12 monthly copies), with regular restore drills;
• confidentiality obligations and least-privilege access for the Provider's personnel with a quarterly access review, error monitoring, and regular updates and automated security scans of the software.

10. Audits

10.1. The Provider makes available all information needed to demonstrate compliance with this Agreement. The Client may audit compliance, itself or through an independent auditor bound by confidentiality, once a year with at least [30] days' notice and at its own cost. Reports and certifications of the Provider or its sub-processors may be used instead where they answer the Client's questions.

11. Data subject requests

11.1. The cabinet lets an owner of the Client find a customer and:

• export everything stored about that customer as a machine-readable file (right of access and data portability);
• erase that customer's personal data (right to erasure): messages, call transcripts and recordings are deleted, and bookings, requests and conversations remain only as anonymous business records.

11.2. An owner can also export all of the Client's data at once as one archive (Settings, Data protection); how the archive is protected is described in section 9.

11.3. Every export and erasure is recorded in the audit log. The Provider helps with requests the tools cannot answer within [10] working days. A request the Provider receives directly is passed to the Client without undue delay.

12. Personal data breaches

12.1. The Provider notifies the Client without undue delay, and in any case within [48] hours after becoming aware of a personal data breach affecting the Client's data. The notice describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

12.2. The Provider cooperates with the Client so that the Client can notify the supervisory authority (under the GDPR within 72 hours) and the data subjects where required.

13. Retention, return and deletion

13.1. Call recordings are deleted automatically after the retention period the Client sets in its settings, 90 days by default.

13.2. A conversation that has been quiet for the period the Client sets in Settings, Privacy (from 30 days to 10 years, 2 years by default) loses its messages, the team's notes and its call transcripts and recordings; the bookings, requests and handoffs it produced keep only what is not personal. Records of language model calls are deleted after at most 30 days (the Client may choose fewer). Billing records are kept as long as tax law requires.

13.3. When the subscription ends, the Client may export its data for [30] days. After that the Provider's staff delete the Client's personal data at the Client's request through support (the cabinet does not offer this yet) and confirm the deletion. Copies in encrypted backups disappear when those backups expire: daily copies after 30 days, monthly copies after 12 months.

14. Liability and governing law

14.1. Liability is governed by the terms of service. This Agreement is governed by [the law of ...]; disputes are settled by [the courts of ...].

15. Acceptance and changes

15.1. An owner of the Client accepts this Agreement electronically in the cabinet (Settings, data protection). The acceptance records the version, the account, the time and the IP address.

15.2. A new version of the Agreement is shown in the cabinet, and owners are asked to accept it within 30 days of its date. Until an owner accepts the version in force, the assistant keeps working, but a new version of it cannot be published.