# Data Processing Agreement

**Last Updated:** {{effective_date}}
**Version:** {{version}}

## 1. Introduction

This Data Processing Agreement ("DPA") forms part of the agreement between General Bots ("Processor," "we," "us") and you ("Controller," "Customer") for the provision of services ("Agreement").

This DPA reflects the parties' commitment to comply with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and other applicable data protection legislation.

## 2. Definitions

**"Personal Data"** means any information relating to an identified or identifiable natural person.

**"Processing"** means any operation performed on Personal Data, including collection, storage, modification, retrieval, disclosure, or deletion.

**"Data Subject"** means the individual to whom Personal Data relates.

**"Sub-processor"** means any third party engaged by the Processor to process Personal Data.

**"Data Breach"** means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

## 3. Scope and Roles

### 3.1 Controller and Processor

- The Customer acts as the Controller of Personal Data
- General Bots acts as the Processor of Personal Data
- Each party shall comply with its respective obligations under applicable data protection laws

### 3.2 Subject Matter and Duration

- **Subject Matter:** Provision of conversational AI and automation services
- **Duration:** For the duration of the Agreement plus any retention period
- **Nature of Processing:** Storage, retrieval, analysis, and transmission of data
- **Purpose:** To provide the services described in the Agreement

### 3.3 Types of Personal Data

Personal Data processed may include:
- Contact information (names, email addresses, phone numbers)
- Account credentials and authentication data
- Communication content and metadata
- Usage data and interaction logs
- Any other data uploaded by the Customer

### 3.4 Categories of Data Subjects

Data Subjects may include:
- Customer employees and contractors
- Customer's end users and customers
- Any individuals whose data is processed through the Service

## 4. Processor Obligations

### 4.1 Processing Instructions

The Processor shall:
- Process Personal Data only on documented instructions from the Controller
- Inform the Controller if any instruction infringes data protection law
- Not process Personal Data for any purpose other than providing the services

### 4.2 Confidentiality

The Processor shall:
- Ensure all personnel processing Personal Data are bound by confidentiality obligations
- Limit access to Personal Data to personnel who need access to provide the services
- Ensure personnel receive appropriate training on data protection

### 4.3 Security Measures

The Processor shall implement appropriate technical and organizational measures, including:

**Technical Measures:**
- Encryption of Personal Data in transit (TLS 1.3)
- Encryption of Personal Data at rest (AES-256)
- Access controls and authentication mechanisms
- Regular security testing and vulnerability assessments
- Intrusion detection and prevention systems
- Regular backups and disaster recovery procedures

**Organizational Measures:**
- Information security policies and procedures
- Employee security awareness training
- Incident response procedures
- Business continuity planning
- Regular security audits and assessments

### 4.4 Sub-processors

The Processor shall:
- Not engage Sub-processors without prior authorization from the Controller
- Maintain a list of approved Sub-processors
- Ensure Sub-processors are bound by equivalent data protection obligations
- Remain liable for Sub-processor compliance

**Current Sub-processors:**
| Sub-processor | Purpose | Location |
|--------------|---------|----------|
| Amazon Web Services | Cloud infrastructure | EU/US |
| Google Cloud | AI/ML services | EU/US |
| Stripe | Payment processing | US |
| Qdrant | Vector database | EU |

The Controller hereby provides general authorization for the use of Sub-processors, subject to:
- 30 days' notice before engaging new Sub-processors
- The Controller's right to object on reasonable grounds

### 4.5 Data Subject Rights

The Processor shall assist the Controller in responding to requests from Data Subjects to exercise their rights, including:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to data portability
- Right to object

The Processor shall:
- Notify the Controller of any Data Subject requests received
- Not respond directly unless authorized by the Controller
- Provide necessary technical assistance

### 4.6 Data Breach Notification

In the event of a Data Breach, the Processor shall:
- Notify the Controller without undue delay (within 72 hours)
- Provide all information necessary for the Controller to meet notification obligations
- Cooperate with the Controller in investigating and mitigating the breach

Notification shall include:
- Description of the nature of the breach
- Categories and approximate number of Data Subjects affected
- Categories and approximate number of records affected
- Likely consequences of the breach
- Measures taken or proposed to address the breach

### 4.7 Data Protection Impact Assessments

The Processor shall provide reasonable assistance to the Controller in conducting Data Protection Impact Assessments (DPIAs) where required, including providing:
- Information about processing operations
- Technical and organizational measures
- Risk assessments

### 4.8 Audit Rights

The Processor shall:
- Make available information necessary to demonstrate compliance
- Allow for and contribute to audits conducted by the Controller or an auditor
- Provide access to facilities, records, and personnel upon reasonable notice
- Cooperate with supervisory authorities

## 5. Controller Obligations

The Controller shall:
- Ensure lawful basis for processing Personal Data
- Provide clear instructions to the Processor
- Ensure Data Subjects are informed of processing
- Respond to Data Subject requests
- Notify the Processor of any changes affecting processing

## 6. International Data Transfers

### 6.1 Transfer Mechanisms

For transfers of Personal Data outside the EEA/UK, the parties shall use:
- Standard Contractual Clauses (SCCs) as approved by the European Commission
- Other legally recognized transfer mechanisms as appropriate

### 6.2 Additional Safeguards

Where required, additional safeguards may include:
- Encryption of data in transit and at rest
- Pseudonymization or anonymization
- Supplementary contractual measures
- Technical measures preventing access by foreign authorities

## 7. Data Retention and Deletion

### 7.1 Retention Period

The Processor shall retain Personal Data only for as long as necessary to provide the services, unless:
- Longer retention is required by law
- The Controller provides alternative instructions

### 7.2 Deletion and Return

Upon termination of the Agreement or upon request, the Processor shall:
- Return all Personal Data to the Controller in a standard format
- Delete all copies of Personal Data in its possession
- Certify deletion in writing upon request

Deletion shall occur within 90 days of termination unless otherwise agreed.

## 8. Liability and Indemnification

### 8.1 Liability

Each party shall be liable for damages caused by processing that infringes applicable data protection laws or this DPA, in accordance with the allocation of liability in the Agreement.

### 8.2 Indemnification

Each party shall indemnify the other against any costs, claims, damages, or expenses arising from:
- Breach of this DPA
- Non-compliance with data protection laws
- Third-party claims related to data processing

## 9. Term and Termination

### 9.1 Term

This DPA shall remain in effect for the duration of the Agreement.

### 9.2 Survival

Obligations relating to confidentiality, data deletion, and liability shall survive termination.

## 10. Miscellaneous

### 10.1 Amendments

This DPA may be amended by mutual written agreement of the parties.

### 10.2 Conflict

In case of conflict between this DPA and the Agreement, this DPA shall prevail regarding data protection matters.

### 10.3 Severability

If any provision is found invalid, the remaining provisions shall continue in effect.

### 10.4 Governing Law

This DPA shall be governed by the same law as the Agreement, or by EU law for GDPR-related matters.

##