Data Processing Addendum

1. Scope and roles

This Addendum applies when CustBot processes personal data for a customer through the Service, for example the messages the customer's own customers send to an AI agent. For that data the customer is the controller and CustBot is the processor. For account and billing data of the customer's own staff, CustBot acts as controller under the Privacy Policy.

It forms part of the Terms of Service. A countersigned copy for your records is available on request at [email protected].

2. Processing instructions

CustBot processes personal data only to provide the Service as described in the Terms and in the customer's configuration (agents, knowledge base, channels), and as the customer otherwise instructs in writing. If we believe an instruction breaks the law, we will tell the customer.

The subject matter is running AI agents for the customer's conversations. The duration is the life of the account plus the deletion period in Section 8. The data subjects are the customer's staff and the customer's own customers and leads. The data types are names, contact details, message content, files and recordings shared in conversations, order and appointment details, and technical identifiers.

3. Confidentiality

People at CustBot who can access customer personal data are bound by confidentiality duties and receive access only when needed to run, secure or support the Service.

4. Security

CustBot applies the technical and organisational measures described on the Security page, including encryption in transit, per-customer data isolation, access control, logging and backups before production changes. We review these measures as the platform changes and will not reduce the overall level of protection during the term.

5. Sub-processors

The customer gives general authorisation for CustBot to use sub-processors to provide the Service. Each is bound by written terms that protect the data. CustBot gives the current list on request and notifies account administrators by email before adding a sub-processor that processes customer personal data. The customer may object on reasonable data protection grounds within 14 days; if we cannot resolve the objection, the customer may stop using the affected part of the Service or close the account.

6. International transfers

Where personal data moves to a country without an adequate level of protection, CustBot uses a lawful transfer mechanism, such as standard contractual clauses, with the sub-processor concerned.

7. Assistance and personal data breaches

CustBot helps the customer answer requests from data subjects and carry out data protection assessments, taking into account the nature of the processing. The customer can export conversations, messages and contacts from the dashboard.

CustBot notifies the customer without undue delay after becoming aware of a personal data breach that affects the customer's data, and provides the information it has to help the customer meet its own duties.

8. Deletion and return

When the account ends, the customer can export its data and then delete the account from the dashboard. Deletion takes effect after a 30-day grace period, during which the account can be restored. After that CustBot deletes the data permanently, except records the law requires CustBot to keep, which stay protected and are not used for any other purpose.

9. Audits and information

CustBot gives the customer the information reasonably needed to show compliance with this Addendum, including answers to security questionnaires. Where the customer needs more, the parties will agree a reasonable scope and timing for an audit, at the customer's cost and without exposing other customers' data.

10. Order of precedence and contact

If this Addendum conflicts with the Terms of Service on the processing of personal data, this Addendum prevails. Contact: [email protected].