Data Processing Agreement

This Data Processing Agreement (“DPA”) is between the customer who signs up for the Vosaire AI Chatbot at app.vosaire.com (“Customer”, the controller) and Vosaire, a partnership firm under Indian law, at Kanwali Dahina, Rewari, Haryana 123411, India(“Vosaire”, the processor). It forms part of our Terms of Serviceand applies automatically when Vosaire processes personal data on the Customer's behalf. If this DPA and the Terms conflict on data protection, this DPA wins.

It covers the EU GDPR, the UK GDPR, the Swiss FADP and India's DPDP Act where they apply. It does not cover the Vosaire Shopify app, which is governed by Shopify's terms and our Privacy Policy.

Vosaire processes the Customer's visitors' data only to provide the chatbot: answering visitors on the Customer's website, collecting leads, and showing conversations, leads and analytics to the Customer. Duration: for as long as the Customer uses the service, plus the deletion periods in Section 9. Details are in Annex I.

• Process personal data only on the Customer's documented instructions, which are this DPA, the Terms and the settings the Customer chooses in the product. We tell the Customer if we think an instruction breaks data protection law.
• Make sure everyone who can access the data is bound to confidentiality.
• Apply the security measures in Annex II, and keep them at least as protective as they are today.
• Never sell the data or use it for our own purposes, including training AI models.

The Customer gives general authorisation for the sub-processors listed on our sub-processors page(Annex III). We bind each one to data protection terms at least as strict as this DPA, and remain responsible for them. We email account owners at least 14 days before adding or replacing one. The Customer can object on reasonable data protection grounds within that time; if we can't resolve it, the Customer can end the affected service and get a pro-rata refund of prepaid fees.

The product lets the Customer answer data subject requests directly: find all data held about a visitor by email, download it, delete it, delete single conversations and leads, and set automatic deletion of conversations after 30, 90, 180 or 365 days. If a visitor contacts Vosaire directly, we pass the request to the Customer without undue delay and don't answer it ourselves unless the Customer asks us to. We also give reasonable help with data protection impact assessments and consultations with supervisory authorities.

We notify the Customer without undue delay, and in any case within 48 hours of confirming a personal data breach affecting the Customer's data. We give the information the Customer needs to meet its own duty to notify within 72 hours (what happened, the data and people likely affected, likely consequences, and what we are doing about it), and update it as we learn more.

On request, we provide the information needed to show we comply with this DPA: this agreement, our security measures, our sub-processor list, and written answers to a reasonable security questionnaire once a year. An on-site or third-party audit is available only where a data protection authority requires it or after a personal data breach affecting the Customer, with at least 30 days' notice, during business hours, at the Customer's cost and under confidentiality.

The main database and servers are in Germany. Where personal data goes to a sub-processor outside the EEA, UK or Switzerland, we rely on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses (2021/914), with the UK International Data Transfer Addendum and Swiss amendments where needed. These clauses are incorporated into this DPA by reference: Module 2 (controller to processor) between the Customer and Vosaire, and Module 3 (processor to processor) between Vosaire and its sub-processors. For the clauses, the law and courts of Ireland apply (Clauses 17 and 18), and the competent supervisory authority is the one for the Customer's establishment. Everything else in this DPA follows the governing law in the Terms.

Vosaire has no establishment in the EU or UK and hasn't yet appointed a representative under Article 27 GDPR or Article 27 UK GDPR. Customers, individuals and authorities in the EU and UK can contact us directly at privacy@vosaire.com.

The Customer can download its data at any time (Settings → Download my data) and from the Leads page. When the Customer deletes its account, deletion is scheduled for 30 days later and can be cancelled until then; after that, all of the Customer's bots, knowledge, conversations, leads and account data are permanently deleted from our live systems. Copies in backups expire on the schedule below and are never restored except to recover from a disaster.

• Daily backups for 16 days, weekly for 8 weeks and monthly for 4 months, then deleted — never longer than 12 months. Deleted data disappears from backups on this schedule.

Liability under this DPA follows the limits in the Terms, except where the law doesn't allow a limit. This DPA lasts as long as Vosaire processes personal data for the Customer. Privacy contact: privacy@vosaire.com. Vosaire isn't required to appoint a Data Protection Officer; the founders handle privacy matters.