Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is concluded between the Chativ customer ("Controller") and FOP Herasymiuk Nataliia Borysivna, 78/2 Myru Ave., apt. 1a, Khmelnytskyi 29015, Ukraine, RNOKPP 2871021324 ("Processor"), in accordance with Article 28 of the GDPR. It forms part of the Terms of Service and is accepted when the account is created; no separate signature is required.

The DPA applies to personal data of the Controller's customers that the Processor processes while providing the Service.

2. Subject matter, nature and duration

Subject matter: receiving and sending messages through connected channels, generating AI replies, storing conversation history and leads. Duration: for the term of the Terms of Service and until the data is deleted under section 9.

3. Categories of data and data subjects

Data subjects: the Controller's customers and website visitors who write to the Controller through connected channels; the Controller's staff who use the workspace.

• Contact data: name, username, phone number, email address — if provided by the data subject or by the channel
• Content of messages and attachments
• Channel identifiers (for example, Instagram or Facebook user ID) and technical data of the widget
• Lead data that the Controller collects through the AI agent

4. Processor obligations

• Process data only on the Controller's documented instructions, which are the Terms, this DPA and the settings made in the workspace
• Ensure that persons with access to the data are bound by confidentiality
• Apply the security measures described in section 6
• Assist the Controller in responding to data subject requests and in meeting its obligations under Articles 32–36 of the GDPR
• Inform the Controller if, in its opinion, an instruction infringes data protection law

5. Subprocessors

The Controller gives general authorisation to engage the subprocessors listed on the Subprocessors page. The Processor will announce new subprocessors on that page and by email at least 30 days in advance; the Controller may object on reasonable grounds and, if no solution is found, terminate the Service. The Processor imposes on subprocessors data protection obligations equivalent to this DPA and remains liable for them.

6. Security measures

• Encryption of all connections (TLS)
• Hashing of passwords; additional encryption of API keys and channel access tokens in the database
• Strict separation of data between workspaces; access only for authorised users with roles
• Hosting in the EU (Netherlands)
• Access of Processor staff to production data only when needed for support or maintenance

7. Personal data breaches

The Processor notifies the Controller of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it, providing the information available for the Controller's notification to the supervisory authority.

8. International transfers

Data is stored in the EU. Where subprocessors process data outside the EEA (for example, AI providers in the USA), the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

9. Deletion and return of data

During the term, the Controller can delete leads in the workspace and request export or deletion of any other data at [email protected]; the Processor fulfils such requests within 30 days. After the Service ends, the Processor deletes the Controller's data within 30 days, unless the law requires it to be kept, and on request provides an export before deletion.

10. Audits

On request, the Processor provides the information needed to demonstrate compliance with this DPA. On-site audits are possible with 30 days' notice, no more than once a year, at the Controller's expense, unless a breach has occurred.

11. Contact

Data protection questions: [email protected].