Data Processing Addendum

1. Processing details

The subject matter is provision of Agents24x7 services. Processing continues for the term of the customer account and any period required to complete deletion or return. The nature and purpose are hosting customer content and running AI agents, including the Support Agent, at the customer's documented request.

Personal data may include site visitors' chat messages and contact details they submit; connected website content; Search Console and Analytics data; and account details for customer staff. On Shopify sites, it may also include shoppers' order references and connected store content. Data subjects may include the customer's visitors and staff and, on Shopify sites, shoppers.

2. Customer instructions

We process customer personal data only on the customer's documented instructions, including instructions given through the service, unless EU or Member State law requires otherwise, in which case we inform the customer before processing unless that law prohibits it. We tell the customer if, in our opinion, an instruction infringes data protection law. The customer is responsible for providing lawful instructions, establishing a lawful basis, giving required notices and obtaining permissions from visitors and staff.

3. Our duties

We ensure people authorised to process customer data are subject to confidentiality duties. We maintain the technical and organisational measures below. Taking account of the nature of processing and the information available to us, we assist the customer with data subject requests, security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR. We notify the customer of a personal data breach affecting customer data without undue delay, and in any event within 48 hours, after becoming aware of it, with the information then available to us. At the customer's choice, we delete or return customer data at the end of the service, subject to legal retention duties. We make available the information necessary to demonstrate compliance with Article 28 GDPR. We answer audit requests first through documentation; if that is not enough, we allow an audit or inspection by the customer or an independent auditor it mandates, on at least 30 days' notice, during business hours, under confidentiality terms and no more than once a year unless a supervisory authority requires it.

4. Sub-processors

The customer authorises use of the providers listed at /subprocessors. We will give 14 days' notice of an intended addition or replacement of a sub-processor by updating that page and notifying customer admins by email or in the application. The customer may object on reasonable data protection grounds during that period; if we cannot resolve the objection, the customer may terminate the affected service. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for our sub-processors' performance of their data protection obligations.

5. International transfers

Customer data is hosted in Frankfurt, Germany. Files, generated images and backups are stored in the United States, and some sub-processors process data outside the European Economic Area, as shown on the sub-processor list. For each such transfer we rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses (module three, processor to processor) included in the sub-processor's terms, with the UK addendum where UK data protection law applies.

6. Technical and organisational measures

• Encryption of connected service credentials at rest.
• Authentication, role checks and organisation-scoped access to customer data.
• Redaction of email addresses from Support Agent visitor messages before model processing.
• Automated retention and deletion jobs for data with configured retention periods.
• Encrypted backups.
• Operational logs are designed to record event metadata and error classes without message text.

7. Contact

Contact [email protected] about this DPA. This DPA is governed by the governing law clause in the Terms of Service.