Data Processing Agreement

SAMPLE — this copy shows the agreement without a client’s details. Logged in with an account that has accepted the current Terms and Conditions, this page shows your company’s details and the date the agreement was concluded.

1. Parties

Processor: TreeLab OÜ, registry code 17063252, VAT number EE102796911, registered address Ahtri 12, Tallinn, 10151, Estonia, operating the BOTS4.me service (“we”, “us”, the “Processor”). Contact for data protection matters: privacy@bots4.me (requests of Data Subjects) and dpo@bots4.me, or bots4.me/contact.

Controller: the client that holds the BOTS4.me account under which this agreement is concluded (the “Controller”, “you”):

Together the “Parties”. This agreement is concluded under Article 28(3) of Regulation (EU) 2016/679 (the “GDPR”) and governs the processing of personal data that the Processor carries out on behalf of the Controller when providing the BOTS4.me services ordered by the Controller (the “Services”), as described in the Terms and Conditions and the Privacy Policy.

2. Introductory provisions and definitions

1. The terms “personal data”, “processing”, “data subject”, “controller”, “processor”, “sub-processor”, “personal data breach” and “supervisory authority” have the meaning given to them in the GDPR.
2. The Controller declares that it uses, or intends to use, the Services, through which personal data of its customers, suppliers, employees and other persons (the “Data Subjects”) is processed on the Processor’s systems in connection with the Controller’s business activities.
3. The Controller determines the purposes and means of the processing by choosing which mailboxes, documents, ERP systems, cloud storages and other sources it connects to the Services and which functions it switches on. The Processor processes personal data only to provide the Services.
4. The payment for the processing under this agreement is included in the price of the Services. This agreement does not change the prices, the plans or the support terms of the Services.
5. Where this agreement and the Terms and Conditions differ on the processing of personal data, this agreement prevails.

3. Subject matter, duration, nature and purpose of the processing

1. Subject matter: the automated processing of e-mails, attachments, documents, ERP and accounting records, payment records, contact data, website and online-shop content and backups that the Controller connects to the Services (for example Mail2ERP, Mail2CLOUD, AutoSPAM, Pay2ERP, AutoCASH, Supplier2ERP, AutoERP, AutoSTOCK, AutoPURCHASE, ClientFACTORY, Mail2KNOW, AutoGEO and other BOTS4.me applications).
2. Duration: for as long as the Controller holds a BOTS4.me account with at least one connected source or an active subscription, and for the deletion period in section 9.
3. Nature: collection from the sources the Controller connected, reading, classification, extraction, translation, storage, forwarding to the Controller’s own systems (ERP, cloud storage, mailbox), backup, restoration and deletion, carried out by software with optional AI processing that the Controller switches on per application.
4. Purpose: to perform the Services the Controller ordered, and nothing else. The Processor never uses the Controller’s data for its own purposes, for marketing, for profiling or for training generalised or third-party AI models; per-account learning (for example learned product names or answer templates) is used only for that Controller’s own Services.
5. Types of personal data: identification data (names, user names), contact data (postal addresses, e-mail addresses, telephone numbers), business and contractual data (orders, quotations, invoices, payments, bank account identifiers and payment references, stock and purchase records), the content of e-mails and attachments, and any other personal data the Controller’s connected sources contain. The Processor does not require special categories of personal data (Article 9 GDPR); if the Controller’s sources contain them, the Controller remains responsible for the lawfulness of their processing.
6. Categories of Data Subjects: the Controller’s customers, prospects, suppliers, partners, employees and other persons who correspond with the Controller or appear in its business records.

4. Obligations of the Processor

The Processor shall:

1. Instructions: process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject; in such a case the Processor informs the Controller of that legal requirement before processing, unless that law prohibits it on important grounds of public interest. The Controller’s instructions are the Terms and Conditions, this agreement, and the settings the Controller makes in its BOTS4.me dashboard (which sources are connected, which functions and AI modes are on, retention periods, destinations). The Processor informs the Controller without delay if, in its opinion, an instruction infringes the GDPR or other data protection law.
2. Confidentiality: ensure that every person authorised to process the personal data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and give access only to the extent needed to provide the Services and support.
3. Security: implement and maintain the technical and organisational measures described in Annex B (Article 32 GDPR), review them regularly and improve them as technology develops. The measures include encryption of stored credentials and client data, encrypted transport, processing within the European Union, access control with two-factor authentication for administrative access, logging and monitoring.
4. Sub-processors: engage sub-processors only under the general authorisation in section 6, under a written contract that imposes the same data protection obligations as this agreement, and remain fully liable to the Controller for the performance of each sub-processor’s obligations.
5. Data Subject rights: taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures in responding to requests from Data Subjects to exercise their rights under Chapter III of the GDPR. Because the processed data is stored in the Controller’s own connected systems (mailboxes, ERP, cloud storage), the Controller can usually answer such requests directly; the Processor assists on request.
6. Assistance with Articles 32 to 36: assist the Controller in ensuring compliance with the obligations on security, personal data breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to the Processor.
7. Personal data breach: notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller’s personal data, with the information available at that time (nature of the breach, categories and approximate number of Data Subjects and records, likely consequences, measures taken or proposed), and supplement it as further information becomes available.
8. Deletion and return: at the end of the provision of the Services delete or return the personal data as set out in section 9, unless Union or Member State law requires storage.
9. Information and audits: make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Audits take place at most once a year (more often after a personal data breach or on request of a supervisory authority), with at least 30 days’ written notice, during business hours, without disturbing other clients’ data, and the Controller bears its own costs. The Processor may first answer by providing its documentation, certifications and the results of independent security assessments.
10. Records: keep a record of the categories of processing carried out on behalf of the Controller as required by Article 30(2) GDPR.
11. Staff: train the persons who have access to personal data on their obligations, and ensure that the confidentiality obligation continues after the end of their engagement.

5. Obligations of the Controller

1. The Controller is responsible for the lawfulness of the processing, in particular for having a legal basis for the personal data in the sources it connects to the Services, for informing the Data Subjects, and for the accuracy of its instructions.
2. The Controller connects only mailboxes, systems and storages it is entitled to use for this purpose, and keeps its account credentials, authenticator codes and connected accounts secure.
3. The Controller informs the Processor without undue delay of any change that affects the processing, and answers the Processor’s questions needed to comply with this agreement.
4. The Controller uses the deletion, export, backup and restore functions of the Services to meet its own retention and Data Subject obligations.

6. Sub-processors

1. The Controller gives the Processor a general authorisation to engage the sub-processors listed in Annex A, and to replace or add sub-processors under the conditions below.
2. The current list is maintained in the Privacy Policy (section “Sub-processors”). The Processor notifies clients at least 30 days before a new sub-processor begins processing personal data, by e-mail to the account e-mail or by a notice in the BOTS4.me dashboard.
3. The Controller may object to a new sub-processor on reasonable, documented data protection grounds within those 30 days. If the Parties cannot find a solution, the Controller may terminate the affected Services with effect from the date the new sub-processor starts; this is the Controller’s sole remedy for an objection.
4. AI providers process data only when the Controller switches on an AI mode for an application, receive only the content of the item being processed, are bound not to train models on it, and are used under zero-retention terms where the provider offers them.

7. Location of processing and international transfers

1. The Processor processes and stores personal data on servers located in the European Union (Annex A). Backups are encrypted before they leave the processing servers and are stored in the European Union.
2. The Controller’s own connected destinations (its mailbox provider, ERP system, Google Drive, Microsoft OneDrive, Dropbox, Box, SFTP or S3 storage) are chosen by the Controller; where the Controller selects a destination outside the European Economic Area, that transfer is the Controller’s own.
3. Where a sub-processor is established outside the European Economic Area, or may access data from outside it, the transfer is covered by an adequacy decision of the European Commission (including the EU-US Data Privacy Framework where the sub-processor is certified) or by the Standard Contractual Clauses adopted by the European Commission, as recorded in that sub-processor’s own data processing terms listed in Annex A.

8. Liability

1. Each Party is liable for the damage it causes by processing that infringes the GDPR, in accordance with Article 82 GDPR.
2. The limitations and exclusions of liability in the Terms and Conditions apply to this agreement, except where the GDPR does not allow them to be limited.

9. Term, termination, deletion and return

1. This agreement enters into force when the Controller accepts the Terms and Conditions of which it forms part, or, at the latest, when the Controller first connects a source to the Services, and lasts as long as the Services are provided to the Controller. It ends automatically when the Controller’s account is deleted.
2. The processed data lives in the Controller’s own connected systems and storages, so it stays with the Controller. Personal data held on the Processor’s systems (working copies, logs, cached items, settings) is deleted when the Controller disconnects a source, deletes an application or deletes its account, within the periods stated in the Privacy Policy, and encrypted backups are overwritten within the backup retention period, unless Union or Member State law requires longer storage.
3. On request before deletion, the Processor returns the personal data still held on its systems in a common machine-readable format, where the data is not already available to the Controller in its own connected systems.
4. The Processor publishes new versions of this agreement at this address with a new version date and informs clients of material changes at least 30 days in advance; the new version applies from its date unless the Controller terminates the Services before that date.

10. Governing law and signatures

1. This agreement is governed by the laws of Estonia and the GDPR. The courts of Tallinn, Estonia, have jurisdiction, without prejudice to the rights of Data Subjects and supervisory authorities under the GDPR.
2. The Processor signs this agreement by publishing it at bots4.me/dpa/ under its version date; it is binding on the Processor towards every client from that date, whether or not the Controller has signed it online.
3. The Controller concludes this agreement by accepting the Terms and Conditions, of which this agreement forms part; the acceptance (the account, the version of the Terms and Conditions and the time) is recorded on the account. No separate signature is needed. A Controller that needs a copy with its details downloads it from this page while logged in.

Annex A — Sub-processors and locations

The categories below are the authorised sub-processors at the version date; the named list with any change is kept in the Privacy Policy.

Annex B — Technical and organisational measures

A summary of the measures in force at the version date; the full description is on the Security page.

• Encryption at rest: connection credentials and client settings stored on the website are encrypted with an RSA-2048 public key whose private key lives on a separate isolated server; processing servers hold decrypted client data only in volatile memory; backups are encrypted with AES-256-GCM before leaving the processing servers.
• Encryption in transit: TLS 1.2 or higher for the website, the dashboard, the API and the connections to mailboxes, cloud storages and sub-processors, and to ERP systems where the Controller’s system supports it; mail server certificates are verified (a password mailbox whose server presents an invalid certificate is connected with a warning to the Controller).
• Access control: administrative access for the operator only, with two-factor authentication; client dashboards protected by login, optional two-factor authentication and authenticator-confirmed sensitive actions; OAuth connections scoped to the minimum (for example Google Drive drive.file, Microsoft App Folder).
• Isolation: every client is processed in its own folder and process on the processing servers with its own encrypted settings; no client can read another client’s data.
• Availability and recovery: monitored processing servers with automatic restart, encrypted backups at least daily on paid plans, documented restore and contingency procedures tested regularly.
• Logging and monitoring: processing and access logs, anomaly alerts to the Processor’s technical staff, no third-party analytics on the website.
• Data minimisation: AI providers receive only the text and attachments of the item being processed; no client data is used to train generalised or third-party models; zero-retention terms where offered.
• Deletion: working copies deleted after processing, logs and cached items after the periods in the Privacy Policy, account data on account deletion.
• Organisation: confidentiality obligations for staff, an incident response procedure with 48-hour client notification, sub-processor contracts with data protection terms, regular review of these measures.