Data Processing Agreement

1. Definitions

Terms used in this DPA have the meanings given in the GDPR, including:

• "Controller": the party that decides why and how personal data is processed (you).
• "Processor": the party that processes personal data on behalf of the Controller (CenoDigital).
• "Data Subject": the person the personal data relates to.
• "Sub-processor": a third party engaged by the Processor to process personal data.

2. Scope and Roles

You are the Controller of personal data contained in content you upload, conversations your chatbots have with your website visitors, and leads they submit. CenoDigital processes that data as your Processor.

CenoDigital is the Controller of your account and billing data, as described in our Privacy Policy.

3. Processing Details

Processing is carried out on the following basis:

• Subject matter: providing BizChat, a hosted AI chatbot service.
• Duration: the term of your subscription, plus the time needed to delete data afterwards.
• Nature and purpose: storing and indexing your content, generating chatbot answers, storing conversations and leads, live chat handoff, analytics and webhook delivery.
• Types of personal data: names, email addresses, phone numbers, conversation content, IP addresses, browser details, and any personal data contained in your uploaded content.
• Categories of Data Subjects: your website visitors, your team members, and people mentioned in your content.

4. Processor Obligations

CenoDigital will:

• Process personal data only on your documented instructions, which include these Terms and your use of the Service's settings.
• Ensure that people authorised to process personal data are bound by confidentiality.
• Implement the security measures described below.
• Help you respond to Data Subject requests, using the Service's self-service tools and, where needed, direct assistance.
• Notify you without undue delay after becoming aware of a personal data breach affecting your data.
• Delete personal data at the end of the Service, except where the law requires us to keep it.
• Make available information reasonably needed to show compliance with this DPA.

5. Security Measures

CenoDigital maintains these measures:

• Encryption of data in transit using HTTPS.
• Encrypted storage of AI provider API keys.
• Isolation of each customer's data from other customers.
• Role-based access control within each organisation (owner, admin, agent).
• An audit log of important account actions.
• HMAC-SHA256 signatures on webhook deliveries.
• Restricting internal access to customer data to what is needed to run and support the Service.

6. Sub-processors

You authorise CenoDigital to use the following sub-processors. We require each to protect personal data in line with this DPA.

• Our hosting provider: runs the Service and stores its data.
• OpenAI: AI processing to generate answers.
• Anthropic: AI processing to generate answers.
• Stripe: payment processing.
• PayHere: payment processing in Sri Lanka.
• Resend: transactional email.
• Google: optional sign-in with Google.
• Our CDN/DNS provider: content delivery and protection against attacks.

7. Changes to Sub-processors

We will update this page and notify you before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot address your concern, you may stop using the affected part of the Service or cancel your subscription.

8. International Data Transfers

CenoDigital is based in Sri Lanka and sub-processors may process data in other countries. Where personal data is transferred from the EEA, UK or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses.

9. Data Subject Requests

If we receive a request directly from one of your Data Subjects, we will pass it to you and will not respond ourselves unless you ask us to or the law requires it. You can export and delete data with the tools listed on our Your Data Rights page.

10. Return and Deletion

You can export your data and delete conversations or your whole organisation from the dashboard at any time. When your organisation is deleted, we delete the personal data we process on your behalf, except where the law requires us to keep it.

11. Liability

Liability under this DPA is subject to the limitations in the Terms of Service.

12. Contact

Data protection questions: [email protected]. CenoDigital (Pvt) Ltd, Sri Lanka.