Data Processing Agreement (DPA)

1.Recitals

1. By accepting the General Terms and activating the service, the Customer accepts this DPA in full.
2. The processor declares that it has the experience, reliability and technical and organisational resources necessary to carry out the processing envisaged, in compliance with the GDPR and applicable national legislation.
3. Processing carried out by the processor in performance of the Agreement takes place solely on documented instructions from the controller, as set out in the Agreement, in this DPA, in the configurations made by the Customer in the console and in any further written instructions provided by the controller.
4. In the event of conflict, this DPA prevails over the other contractual provisions as regards personal data processing, without prejudice to the Privacy Policy, which is to be regarded as a complementary document.

2.Definitions

2.1 “Personal Data”: any information relating to an identified or identifiable natural person (Data Subject), processed by the processor on the controller’s behalf in performance of the Agreement.

2.2 “Special Categories of Data”: the data referred to in Article 9 GDPR.

2.3 “GDPR”: Regulation (EU) 2016/679.

2.4 “Garante Privacy”: the Italian Data Protection Authority.

2.5 “Data Subject”: the identified or identifiable natural person to whom the Personal Data relate. For the purposes of this DPA, Data Subjects are principally the Customer’s end users interacting with the chatbots and voice assistants deployed through Supportfast.ai.

2.6 “Processing”: any operation performed on Personal Data, whether or not by automated means.

2.7 “Sub-processor”: the third party engaged by the processor to carry out specific processing activities on the controller’s behalf, pursuant to Article 28(2), (3) and (4) GDPR.

2.8 “Personal Data Breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

2.9 “Customer Data”: the body of content, configurations, knowledge bases, conversation logs, audio recordings and all other data that the Customer or end users upload or generate through the platform.

2.10 “DPF”: the EU-U.S. Data Privacy Framework, the subject of the European Commission’s adequacy decision of 10 July 2023.

2.11 “SCC”: the standard contractual clauses adopted by the European Commission by Decision (EU) 2021/914.

3.Subject matter and scope of the appointment

3.1 By accepting the Agreement, the Customer appoints Stepcode SRL as data processor pursuant to Article 28 GDPR, authorising it to process the Personal Data on the controller’s behalf, solely for the purposes, in accordance with the instructions and within the limits defined by this DPA.

3.2 The subject matter of the processing comprises:

• Chat module: configuration, operation and management of the Customer’s chatbots on the website, WhatsApp Business, Instagram, Facebook Messenger and e-mail channels.
• Voice module (AI Switchboard): configuration, operation and management of voice assistants, including speech transcription, speech synthesis and conversational logic.
• Storage and logs: retention of conversations, configurations, knowledge base, audio recordings (where enabled) and operational metadata.
• Integrations: connection with third-party systems configured by the Customer.
• Reporting and analytics: generation of aggregate statistics on conversations.
• Technical support: assistance to the Customer, with any strictly necessary temporary access to Customer Data.

3.3 This DPA does not govern processing carried out by Stepcode SRL as an independent controller for its own purposes (account, invoicing, marketing to the Customer, systems security), which is governed by the Privacy Policy.

3.4 Reseller Customers. Where the Customer uses the Service on behalf of its own customers under the white-label programme, the Customer acts as processor on behalf of those customers (controllers) and Stepcode as a further processor pursuant to Article 28(2) and (4) GDPR. The Customer warrants: (a) that it has entered into an agreement under Article 28 GDPR with each controller, with obligations no less protective than this DPA; (b) that it has obtained from the controller authorisation to engage Stepcode and the Sub-processors listed in Annex A, and that it will notify the controller of changes to the list in good time for the exercise of the right to object; (c) that the instructions it gives to Stepcode correspond to those received from the controller; (d) that it will forward to the controller, without delay and in any event within 24 hours, the breach notifications received from Stepcode under Section 13. In dealings with reseller Customers, references to the “controller” in this DPA are to be read as references to the Customer in its capacity as processor, unless the context requires otherwise.

4.Categories of personal data and data subjects

4.1 The categories of Personal Data and of Data Subjects processed by the processor on the controller’s behalf are detailed in Annex C.

4.2 Special Categories of Data (Article 9 GDPR)

4.3 At the controller’s written request, the processor shall update, amend, correct or delete the Personal Data processed within 15 days of receipt of the request, unless legal obligations prevent it.

5.Purposes of the processing and instructions of the controller

5.1 The processor processes the Personal Data solely for the following purposes, strictly in performance of the Agreement:

1. Provision of the Supportfast.ai software and services as configured by the Customer.
2. Execution of the operational instructions given by the Customer through the console or in writing.
3. Provision of the technical support requested by the Customer.
4. Compliance with legal obligations to which the processor is subject, notifying the controller in advance unless prohibited by law.

5.2 The processor does not use Customer Data for its own purposes beyond those listed. In particular, Customer Data is not used for the training or improvement of artificial intelligence models (see Section 7).

5.3 The processor may process the Personal Data in aggregated and anonymised form, no longer attributable to any Data Subject, for internal statistical, security and operational improvement purposes.

5.4 Where the processor considers that an instruction from the controller infringes the GDPR or other applicable provisions, it shall immediately inform the controller and reserves the right to suspend execution of the instruction pending clarification.

6.Obligations of the processor

1. Comply in full with the GDPR and applicable data protection legislation.
2. Process the Personal Data solely on documented instructions from the controller, save for the legal obligations referred to in Article 28(3)(a) GDPR.
3. Ensure that persons authorised to process the data are bound by an obligation of confidentiality and receive periodic training.
4. Implement and maintain the technical and organisational measures described in Annex B, appropriate to ensure a level of security appropriate to the risk (Article 32 GDPR).
5. Maintain a record of the processing activities carried out on the controller’s behalf, pursuant to Article 30(2) GDPR.
6. Notify the controller of any Data Subject request relating to the exercise of the rights under Articles 15 to 22 GDPR, without delay and in any event within 5 business days.
7. Inform the controller of any challenge, investigation or proceedings brought by an authority in relation to the processing covered by this DPA.
8. Assist the controller in complying with the obligations under Articles 32 to 36 GDPR.
9. Select Sub-processors with due diligence and impose on them in writing obligations equivalent to those set out in this DPA.
10. Return or delete the Personal Data at the end of the Agreement, in the manner set out in Section 14.

7.Prohibition on use for training artificial intelligence systems

7.1 The processor engages exclusively artificial intelligence model providers configured so as to exclude the reuse of transmitted data for the training of their models (by way of contractual or technical opt-out from the reuse of data for training).

7.2 The processor warrants that the Sub-processors supplying AI models (currently OpenAI Ireland Limited for language models, Deepgram, Inc. for speech recognition and ElevenLabs Inc. for speech synthesis; any future suppliers will be notified with prior notice pursuant to Section 8) are contractually bound by the same prohibition and, where available, to the APIs or endpoints that exclude the use of transmitted data for training purposes.

7.3 The processor may nonetheless use aggregated and anonymised data, no longer attributable to any Data Subject, for service improvement purposes. Such use is limited to technical metrics, usage statistics and security analysis, and in no case involves the processing of Personal Data.

7.4 In BYOK mode (Section 8.7) the undertakings in points 7.1 and 7.2 do not extend to the AI provider chosen by the controller, whose terms the controller verifies independently.

8.Sub-processors and BYOK mode

8.1 By accepting this DPA, the controller grants the processor general authorisation to engage Sub-processors for the processing activities necessary to perform the Agreement, pursuant to Article 28(2) GDPR.

8.2 The current list of Sub-processors is publicly available at supportfast.ai/en/sub-processors and in Annex A to this DPA.

8.3 The processor selects Sub-processors on the basis of reliability, security and compliance criteria, and imposes on them in writing, by means of agreements under Article 28 GDPR, obligations equivalent to those set out in this DPA, including the prohibition on using Customer Data for AI training purposes under Section 7.

8.4 Notification of changes. The processor notifies the controller of any change to the list of Sub-processors (addition or replacement) with at least 30 days’ notice, by publication on the dedicated page, notice in the console and e-mail to the registered contact.

8.5 Right to object. The controller may object, on legitimate and documented grounds, to a change to the list of Sub-processors within the notice period. In that case the Parties shall negotiate in good faith a solution; failing agreement, the controller may terminate the Agreement without penalty.

8.6 The processor is liable to the controller for infringements of the GDPR committed by Sub-processors within the limits laid down in Article 28(4) GDPR.

8.7 Bring Your Own Key (BYOK) mode

8.7.1 The controller may choose to configure its Chatbots using an API key held in its own name with an artificial intelligence model provider (for example an OpenAI key from the controller’s account). In that mode, conversational data passes directly from the processor’s system to the AI provider using the controller’s credentials.

8.7.2 In BYOK mode, the controller:

• Is directly responsible for selecting the AI provider and for reviewing its terms of service, privacy policy and Article 28 GDPR agreement.
• Is directly answerable to Data Subjects for the processing carried out by the AI provider.
• Warrants that the legal basis for any transfer of data outside the EU to the AI provider has been verified and documented.
• Indemnifies the processor against third-party claims arising from processing carried out in BYOK mode at the AI provider chosen.

9.Transfers of data outside the European Union

9.1 The processor gives preference to Sub-processors with servers located in the European Economic Area (EEA). The principal application infrastructure and the storage of conversational data are hosted on servers located in EU territory (Hetzner DE, Amazon S3 eu-central-1 Frankfurt). The voice module uses LiveKit Cloud with EU region pinning (Belgium).

9.2 For Sub-processors processing data outside the EEA (in particular the voice model suppliers and the CDN; for language models the processing is entrusted to OpenAI Ireland Limited, with onward transfers on the basis of the SCC), the transfer takes place solely on the basis of:

Data Privacy Framework (DPF)

Standard Contractual Clauses (SCC)

9.3 At the controller’s written request, the processor shall make available, redacted where necessary for reasons of commercial confidentiality, a copy of the SCC executed with individual Sub-processors and a summary of the transfer impact assessments.

10.Technical and organisational security measures

10.1 The processor implements and maintains the technical and organisational measures listed in Annex B, appropriate to ensure a level of security appropriate to the risk, pursuant to Article 32 GDPR.

10.2 The measures include, without limitation: encryption in transit (TLS 1.2/1.3) and at rest, strong authentication with optional MFA, role-based access controls, audit logs of administrative access, logical segregation of data by Customer, periodic backups with disaster recovery procedures, continuous security monitoring, vulnerability management and staff training.

10.3 The processor periodically reviews and updates the security measures to take account of technological developments and of risk.

11.Assistance to the controller

11.1 The processor assists the controller, by appropriate technical and organisational measures, in particular as regards:

• Data subject rights: handling of requests for access, rectification, erasure, restriction, portability and objection. The processor makes tools available in the console for exporting and deleting data.
• Security and breaches: as set out in Section 13.
• Data protection impact assessment (DPIA): the processor provides the technical information reasonably necessary for the DPIA under Article 35 GDPR.
• Prior consultation: the processor assists the controller in any prior consultation with the Garante Privacy under Article 36 GDPR.

11.2 Assistance provided within the standard functionality of the platform is included in the fee under the Agreement. Additional or non-standard assistance activities may be charged to the controller, subject to a written quotation.

12.Audits and inspections

12.1 The processor makes available to the controller all information reasonably necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR.

12.2 Ordinary procedure. The controller is entitled to request, on at least 30 days’ written notice, a copy of the documentation relating to security measures, current certifications, internal audit reports and penetration test results, redacted where necessary for reasons of confidentiality.

12.3 On-site inspection. The controller may carry out, directly or through an independent auditor bound by confidentiality, one on-site audit per contract year, on at least 30 days’ written notice, during business hours. A further audit is permitted, on reasonable notice, following a Personal Data Breach or at the request of a supervisory authority. Costs are borne by the controller, unless a material breach of the DPA by the processor emerges.

12.4 The processor may discharge the obligations under this Section by sharing independent third-party audit reports (e.g. ISO 27001, SOC 2), where available.

13.Personal data breach

13.1 In the event of a Personal Data Breach affecting data processed on the controller’s behalf, including where caused by a Sub-processor, the processor shall:

1. Notify the controller without undue delay and in any event within 48 hours of becoming aware of the event, providing the information referred to in Article 33(3) GDPR insofar as known at the time.
2. Prepare and maintain an internal register of breaches pursuant to Article 33(5) GDPR, describing the nature of the breach, the categories and approximate number of Data Subjects concerned, the likely consequences and the measures taken.
3. Promptly take the technical and organisational measures necessary to contain the effects of the breach.
4. Cooperate with the controller and with any competent authorities, providing all reasonably necessary assistance.

13.2 Notification to the Garante Privacy under Article 33 GDPR and any communication to Data Subjects under Article 34 GDPR remain the responsibility of the controller. The processor provides the support necessary to enable the controller to discharge those obligations within the statutory deadlines.

13.3 The 48-hour period referred to in clause 13.1 is specific to the relationship between processor and controller and is shorter than the 72-hour period laid down in Article 33 GDPR for notification by the controller to the Garante, so as to enable the controller to meet that deadline.

14.Duration and end of processing

14.1 This DPA takes effect on the date of acceptance of the Agreement and remains in force for its duration. On termination of the Agreement, on any ground, the DPA automatically ceases to have effect, save for those provisions which by their nature are intended to survive (e.g. confidentiality, liability).

14.2 End of processing. On termination of the Agreement, the processor, subject to any different legal obligations:

1. Retains the Customer Data for a grace period of 30 days, during which the Customer may export its data using the tools available in the console or request assistance.
2. Once the grace period has elapsed, deletes the Customer Data from production environments and, within a further 90 days, from system backups, save for any copies necessary for legal requirements or for the defence of a legal claim.
3. At the controller’s express request made before expiry of the grace period, returns the Customer Data in a structured, commonly used format (e.g. JSON, CSV).

14.3 On request, the processor provides written confirmation of deletion at the end of the periods set out above.

15.Liability of the Parties

15.1 Each Party’s liability under this DPA is governed by Article 82 GDPR. Each Party is liable for damage caused by processing carried out in breach of the GDPR or of this DPA.

15.2 Save as mandatorily provided by law, the processor’s aggregate liability for damage arising under this DPA is subject to the same limitations of liability as are provided for in the Agreement, excluding damage caused by wilful misconduct or gross negligence.

15.3 The Customer, as controller, shall indemnify the processor against third-party claims arising from processing carried out on the controller’s instructions in breach of the GDPR, unless the breach is attributable to the processor.

16.Notices and amendments

16.1 Notices relating to this DPA shall be given in writing, to the addresses stated in the Agreement or to info@supportfast.ai for notices addressed to the processor.

16.2 The processor may amend this DPA to reflect regulatory developments, organisational changes or improvements in the safeguards afforded to the controller. Amendments are notified to the controller with at least 30 days’ notice by e-mail and by notice in the console. The controller may terminate the Agreement within that period if it considers the amendments prejudicial.

16.3 Purely formal updates, corrections of typographical errors or non-substantial regulatory alignments may be made without notice, with the change of version noted in the document header.

17.Governing law and jurisdiction

17.1 This DPA is governed by Italian law.

17.2 Any dispute relating to the validity, effectiveness, interpretation or performance of this DPA falls within the exclusive and mandatory jurisdiction of the Court of Verona.

Annex A: Sub-processors

Annex B: Technical and organisational security measures

B.1 – Encryption and data protection

• Encryption in transit: TLS 1.2 minimum, TLS 1.3 preferred, on all communication channels (HTTPS, API, webhooks). Certificates managed through Cloudflare SSL.
• Encryption at rest: databases and storage encrypted using industry-standard algorithms (AES-256 or equivalent).
• Key management: periodic rotation, separation of duties, secure storage.

B.2 – Access control

• Authentication: username and password with complexity requirements; multi-factor authentication (MFA) available.
• Authorisation: role-based access control (RBAC); principle of least privilege.
• Session management: secure tokens, automatic expiry, central revocation.
• Administrative access: limited to strictly necessary personnel, subject to audit logging.

B.3 – Data segregation

• Logical segregation of data by Customer; no cross-Customer access.
• Opaque identifiers for principal resources; no possibility of enumerating or accessing other Customers’ data by manipulating identifiers.

B.4 – Infrastructure security

• Servers operated on Hetzner infrastructure (Germany, EU).
• Network and application-level firewall (Cloudflare WAF); anti-DDoS protection.
• Continuous monitoring of services (uptime, performance, anomalies).
• Operating system hardening; removal of unnecessary services and ports.

B.5 – Vulnerability management

• Regular patching of operating systems, dependencies and libraries.
• Continuous monitoring of known vulnerabilities (CVEs) in the dependencies in use.
• Code review before release to production; separate staging environments.
• Periodic security testing.

B.6 – Logging and audit

• Audit logs of administrative access and critical operations.
• Application logs retained for 12 months in pseudonymised form.
• System administrator logs retained for a minimum of 6 months pursuant to the Garante’s measure of 27 November 2008.
• Security logs retained for up to 5 years in the event of incidents.

B.7 – Backup and disaster recovery

• Periodic automatic backups of production data.
• Backups retained for a limited period (maximum 90 days after deletion).
• Documented disaster recovery procedures, tested periodically.

B.8 – Personnel

• Formal designation of personnel authorised to process data pursuant to Article 29 GDPR.
• Contractual confidentiality undertakings for all employees and contractors.
• Periodic training on the GDPR, information security and incident handling procedures.
• Onboarding and offboarding procedures with prompt revocation of access.

B.9 – Incident management

• Documented internal procedure for handling Personal Data Breaches.
• Vulnerability reporting channels (info@supportfast.ai).
• Internal register of breaches pursuant to Article 33(5) GDPR.

B.10 – Sub-processors

• Selection of Sub-processors on the basis of documented security and compliance criteria.
• Agreements under Article 28 GDPR with all Sub-processors.
• Periodic review of the security of the principal Sub-processors.

Annex C: Categories of data and data subjects

C.1 – Nature and purposes of the processing

C.2 – Categories of Data Subjects

• The controller’s end users interacting with the chatbots and voice assistants (customers, prospective customers, suppliers, contacts).
• Visitors to the controller’s digital channels who use the bots.
• The controller’s staff authorised to access the console.

C.3 – Categories of Personal Data

C.4 – Special Categories of Data (Article 9 GDPR)

C.5 – Duration of the processing

• Chat conversation logs: 12 months by default, configurable.
• Voice audio (where recording is enabled): 30 days by default, configurable.
• Voice transcripts: 12 months by default, configurable.
• Configurations and knowledge bases: for the duration of the Agreement.