Data Processing Agreement (DPA)

1. Definitions

For the purposes of this DPA:

2. Scope and Application

This DPA applies to all processing of Personal Data by Chat24Plus on behalf of the Customer in connection with the provision of our Services. The subject matter, duration, nature and purpose of the processing, and the types of Personal Data and categories of Data Subjects are set out in Annex A to this DPA.

3. Customer's Responsibilities

The Customer warrants and represents that:

• It has obtained all necessary consents and rights to allow Chat24Plus to process Personal Data as described in this DPA;
• It has complied and will continue to comply with all applicable Data Protection Laws;
• Its instructions for the processing of Personal Data comply with Data Protection Laws;
• It has provided clear notice to Data Subjects about the processing activities carried out by Chat24Plus.

4. Chat24Plus's Responsibilities

Chat24Plus shall:

• Process Personal Data only on documented instructions from the Customer, unless required to do so by applicable law;
• Ensure that persons authorized to process Personal Data have committed themselves to confidentiality;
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk;
• Assist the Customer in responding to requests from Data Subjects to exercise their rights under Data Protection Laws;
• Assist the Customer in ensuring compliance with data security, breach notification, and impact assessment obligations;
• Delete or return all Personal Data to the Customer upon termination of Services, unless required by law to retain it;
• Make available to the Customer all information necessary to demonstrate compliance with this DPA.

5. Sub-processors

The Customer provides general authorization for Chat24Plus to engage Sub-processors to process Personal Data. Chat24Plus shall:

• Maintain a current list of Sub-processors available at https://chat24plus.com/sub-processors;
• Provide at least 30 days' notice of any intended changes concerning the addition or replacement of Sub-processors;
• Ensure that Sub-processors are bound by data protection obligations equivalent to those in this DPA;
• Remain fully liable to the Customer for the performance of any Sub-processor's obligations.

The Customer may object to the appointment of a new Sub-processor within 30 days of notice, in which case the parties shall work together in good faith to find a commercially reasonable solution.

6. Security Measures

Chat24Plus implements and maintains appropriate technical and organizational measures to protect Personal Data, including:

• Encryption of Personal Data in transit and at rest;
• Regular security assessments and penetration testing;
• Access controls and authentication mechanisms;
• Regular backups and disaster recovery procedures;
• Employee training on data protection and security;
• Incident response and breach notification procedures.

Details of our security measures are available upon request and are subject to Chat24Plus's confidentiality obligations.

7. Data Breach Notification

Chat24Plus shall notify the Customer without undue delay upon becoming aware of a Personal Data breach affecting the Customer's Personal Data. The notification shall include:

• A description of the nature of the breach;
• The categories and approximate number of Data Subjects and Personal Data records concerned;
• The likely consequences of the breach;
• The measures taken or proposed to address the breach and mitigate its effects.

Chat24Plus shall provide reasonable cooperation and assistance to the Customer in investigating and remediating the breach.

8. Data Subject Rights

Taking into account the nature of the processing, Chat24Plus shall assist the Customer by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Customer's obligations to respond to requests from Data Subjects exercising their rights under Data Protection Laws, including:

• Right of access;
• Right to rectification;
• Right to erasure ("right to be forgotten");
• Right to restriction of processing;
• Right to data portability;
• Right to object.

If a Data Subject submits a request directly to Chat24Plus, Chat24Plus shall promptly forward the request to the Customer and shall not respond to the request except on the Customer's documented instructions.

9. Data Transfers

Chat24Plus may transfer Personal Data to countries outside the European Economic Area (EEA) or Australia only if:

• The transfer is to a country deemed to provide an adequate level of protection by the European Commission or relevant authority;
• Appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission;
• The Customer has provided explicit consent to the transfer; or
• Another lawful transfer mechanism under Data Protection Laws applies.

10. Audits and Inspections

Chat24Plus shall make available to the Customer information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

The Customer shall provide reasonable advance notice of any audit request, conduct audits during normal business hours, and ensure minimal disruption to Chat24Plus's operations. Audits shall not occur more than once per year unless required by Data Protection Laws or following a Personal Data breach.

11. Return and Deletion of Data

Upon termination of the Services or upon the Customer's request, Chat24Plus shall, at the Customer's choice:

• Return all Personal Data to the Customer in a commonly used and machine-readable format; or
• Securely delete all Personal Data in accordance with Chat24Plus's data deletion procedures.

Chat24Plus may retain Personal Data to the extent required by applicable law, provided that Chat24Plus shall ensure the confidentiality of such Personal Data and only process it as necessary to comply with legal obligations.

12. Liability and Indemnification

Each party's liability arising out of or related to this DPA shall be subject to the limitation of liability provisions set out in the Terms of Service.

The Customer shall indemnify and hold harmless Chat24Plus from any claims, losses, or damages arising from the Customer's breach of its obligations under this DPA or its violation of Data Protection Laws.

13. Term and Termination

This DPA shall remain in effect for as long as Chat24Plus processes Personal Data on behalf of the Customer. Upon termination:

• Chat24Plus shall cease all processing of Personal Data;
• Chat24Plus shall return or delete Personal Data as instructed by the Customer;
• The parties' confidentiality obligations shall survive termination.

14. Governing Law and Disputes

This DPA shall be governed by the same laws as the Terms of Service. Any disputes arising from this DPA shall be resolved in accordance with the dispute resolution provisions in the Terms of Service.

15. Changes to this DPA

Chat24Plus may update this DPA from time to time to reflect changes in Data Protection Laws or our data processing practices. We will notify Customers of any material changes via email or through our Services.

Continued use of the Services after such notification constitutes acceptance of the updated DPA.

Annex A: Details of Processing

Contact Us

If you have any questions about this Data Processing Agreement, you can contact us: