Data processing agreement
This agreement applies when Bon.do (CVR 43473425, Denmark, the "Processor") processes personal data on behalf of a customer (the "Controller") through the Qualihelp service. It forms part of the terms of service and meets Article 28 of Regulation (EU) 2016/679 (GDPR).
1. Subject, nature and purpose
The Processor processes personal data to provide the service the Controller has ordered: storing and indexing the Controller's content, answering visitors' questions with an AI assistant, keeping conversation records, metering usage and operating the Controller's workspace. Processing lasts as long as the Controller's workspace exists, plus the return or deletion period in section 9.
2. Data and data subjects
- Data subjects: the Controller's staff who use the portal; the Controller's website visitors and customers who talk to the assistant; people named in documents the Controller uploads.
- Data types: names, work email addresses and roles; the content of questions and answers; an optional visitor reference supplied by the Controller; technical data such as IP address and timestamps; any personal data contained in uploaded documents.
- The Controller shall not upload special categories of data (Article 9) unless it has told the Processor in writing and the parties have agreed additional safeguards.
3. Instructions
The Processor processes personal data only on the Controller's documented instructions, which are these terms, the Controller's use of the service and its configuration, unless law requires otherwise. The Processor will tell the Controller if it believes an instruction breaches data protection law.
4. Confidentiality
People authorised to process the data are bound by confidentiality, and access is limited to what their work requires.
5. Security
The Processor applies appropriate technical and organisational measures, including: separation of every customer's data from every other customer's; role-based access; encryption of connections and of stored secrets; an audit trail of sensitive actions; and controlled deployment and monitoring. The measures are reviewed as the service develops.
6. Subprocessors
The Controller gives general authorisation for the following subprocessors, each bound by terms no less protective than these:
- Scaleway (France): infrastructure hosting, managed database and object storage, in the European Union (Amsterdam, the Netherlands).
- Cloudflare (USA, with EU presence): delivery of the website, customer portal and chat widget.
- AI model gateway and model providers: generating answers from a visitor's question and extracts of the Controller's content.
- Stripe: payment processing for subscriptions (billing contact and payment data only).
- Email delivery provider: sending service emails.
The Processor will give the Controller at least 30 days' notice by email of a new or replacement subprocessor. The Controller may object on reasonable data protection grounds within that time; if the parties cannot resolve the objection, the Controller may end the affected service.
7. Transfers outside the EEA
Where a subprocessor processes personal data outside the European Economic Area, the Processor relies on an adequacy decision or the European Commission's standard contractual clauses with supplementary measures where needed.
8. Assistance and personal data breaches
The Processor will help the Controller answer data subjects' requests (access, correction, deletion, restriction, portability, objection), carry out impact assessments and consult authorities, taking account of the nature of the processing. The Processor will notify the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach, with the information the Controller needs to meet its own obligations.
9. Return and deletion
When the service ends, or earlier on written request, the Processor will delete the Controller's personal data or return it in a common format, at the Controller's choice, and delete remaining copies within a reasonable period, except where law requires a record to be kept.
10. Audit
The Processor will give the Controller the information needed to show compliance with Article 28 and will allow and contribute to audits, including inspections, by the Controller or an auditor it appoints, on reasonable notice, no more than once a year unless a breach or an authority requires otherwise, and without disclosing other customers' data.
11. Liability and law
The liability terms of the terms of service apply to this agreement. Danish law governs it.
Contact
Data protection questions and signed copies on request: m@bon.do.