Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between you, the customer using the Chattypie Service ("Customer" or "Controller"), and Chattypie ("Chattypie" or "Processor"). This DPA forms part of, and is subject to, the Terms of Service (the "Agreement").

Capitalized terms not defined here have the meanings given in the Agreement or in the EU General Data Protection Regulation 2016/679 ("GDPR") or equivalent applicable data protection laws ("Data Protection Laws"), including "Controller", "Processor", "Subprocessor", "Personal Data", "Data Subject", and "Processing".

This DPA applies where Chattypie processes Personal Data on behalf of Customer in the course of providing the Service. Where the Customer is established in, or directs the Service at, the European Economic Area ("EEA") or United Kingdom, GDPR and UK GDPR apply. Where the Customer processes Personal Data of California residents, the California Consumer Privacy Act ("CCPA") applies and Chattypie acts as a Service Provider as defined thereunder.

Subject matter: the provision of the Chattypie customer support platform, including messaging, AI features, contact management, automations, and related services.

Duration: for the duration of the Agreement, plus any period during which Chattypie retains Personal Data in accordance with Section 9 below.

Nature and purpose: Chattypie processes Personal Data only to provide, maintain, secure, and improve the Service in accordance with the Customer's documented instructions (which include the configuration choices the Customer makes in its workspace, such as enabling or disabling AI features).

Categories of Personal Data processed:

• Identifiers: name, email, phone, avatar URL
• Conversation content: messages exchanged between the Customer and its end-users through the chat widget, email, or other channels
• Technical data: IP address, browser and device information, access logs
• Any other Personal Data the Customer or its end-users choose to transmit through the Service

Categories of Data Subjects: the Customer's authorized users (agents, administrators), the Customer's end-users (visitors to the Customer's website or other touchpoints who interact with the chat widget), and any other individuals whose Personal Data the Customer chooses to submit through the Service.

Chattypie will:

• Process Personal Data only on the Customer's documented instructions, including as necessary to comply with applicable law (in which case Chattypie will notify the Customer before processing unless prohibited by law)
• Ensure that personnel authorized to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described on our Security page
• Assist the Customer, at Customer's expense where the request is unreasonable or repetitive, in responding to requests from Data Subjects exercising their rights under Data Protection Laws
• Assist the Customer with its obligations under Articles 32 to 36 of the GDPR (security of processing, breach notification, data protection impact assessments, prior consultation)
• Make available information reasonably necessary to demonstrate compliance with this DPA, subject to reasonable confidentiality obligations

Chattypie implements and maintains appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include encryption in transit and at rest, access controls, role-based permissions, and rate limiting. A current summary is published at /security, which is incorporated into this DPA by reference and may be updated from time to time to reflect improvements or changes in technology.

The Customer provides general authorization for Chattypie to engage subprocessors to process Personal Data, subject to the terms of this Section.

The current list of subprocessors is published at /subprocessors. Chattypie will provide at least 30 days' advance notice of the addition of any new subprocessor that processes Personal Data, by updating that page and notifying paying customers by email.

The Customer may reasonably object to the addition of a new subprocessor within the notice period by emailing [email protected]. The parties will work in good faith to resolve the objection; if no resolution is reached, the Customer may terminate the Agreement for the affected Service as its sole remedy.

Chattypie remains liable to the Customer for the acts and omissions of its subprocessors to the same extent Chattypie would be liable if performing the services directly under this DPA.

Where Personal Data originating in the EEA, United Kingdom, or Switzerland is transferred to a country that has not received an adequacy decision, the parties agree that such transfers will be governed by the Standard Contractual Clauses approved by the European Commission in Decision (EU) 2021/914 (Module Two: Controller to Processor), which are incorporated into this DPA by reference. The United Kingdom International Data Transfer Addendum applies to transfers subject to UK GDPR.

Chattypie will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data. The notice will include the information reasonably required by the Customer to meet its own obligations under Data Protection Laws, to the extent such information is then available.

Notification of a Personal Data Breach is not an acknowledgment by Chattypie of fault or liability.

Upon termination or expiry of the Agreement, Chattypie will delete or return all Personal Data processed on behalf of the Customer, at the Customer's option. The Customer may request export of its Personal Data by emailing [email protected]. Chattypie may retain Personal Data to the extent required by law, in which case Chattypie will continue to protect it in accordance with this DPA and will not process it for any other purpose.

Chattypie will make available to the Customer, on reasonable written request, information necessary to demonstrate compliance with this DPA. Where an audit is required by Data Protection Laws and the information already made available does not reasonably satisfy the Customer's audit rights, the parties will cooperate in good faith to agree audit scope, subject to reasonable confidentiality obligations and at the Customer's cost.

Each party's liability under or in connection with this DPA is subject to the limitations of liability set out in the Agreement.

In the event of a conflict between this DPA and any other part of the Agreement, this DPA controls with respect to the processing of Personal Data. The Standard Contractual Clauses incorporated by reference in Section 7 prevail over conflicting terms of this DPA to the extent required by Data Protection Laws.

Chattypie may update this DPA from time to time to reflect changes in the Service, in applicable law, or in Chattypie's practices. Material changes will be notified to paying customers by email with at least 30 days' advance notice. The "Effective" date at the top of this page reflects the most recent update.

Questions about this DPA, requests for a signed copy, and objections to new subprocessors should be directed to [email protected].