Data Processing Agreement
Draft for legal review. Version 2026-10-22. This agreement (Article 28 GDPR) forms part of the Terms of Service between the Customer (controller) and [Company legal name] (processor, "Agentik").
1. Subject and duration
Agentik processes personal data of the Customer's website visitors to provide the chat agent and related features, for as long as the Customer uses the service, and deletes it as set out in section 8.
2. Nature and purpose
Receiving visitors' messages through the widget, generating answers with an AI model from the Customer's knowledge, storing conversations and leads, showing them to the Customer, exporting and deleting them on the Customer's instruction.
3. Types of data and data subjects
- Data subjects: visitors of the Customer's website who use the chat.
- Data: message content; contact details a visitor chooses to leave (name, email, phone, message); the page address; technical data (pseudonymous visitor id stored only after the visitor opens the chat, IP address used for abuse limits, browser language).
- No special categories are intended. The Customer instructs its agent not to request them.
4. Instructions
Agentik processes the data only on the Customer's documented instructions, which are these terms and the Customer's settings in the app (for example its retention period), unless EU or member-state law requires otherwise; Agentik will inform the Customer of such a requirement unless that law forbids it.
5. Confidentiality and security
Persons authorized to process the data are bound to confidentiality. Agentik maintains the technical and organizational measures described in "Security and Incident Response", including encryption in transit, tenant isolation enforced in the database, access control and audit logging. Agentik staff access the Customer's account and data only for support, security and abuse handling: read only, for a limited time, and every access is logged.
6. Subprocessors
The Customer authorizes the subprocessors in the Subprocessor List. Agentik will announce new or replaced subprocessors at least [30] days in advance; the Customer may object on reasonable data protection grounds and, if no solution is found, terminate. Agentik imposes the same data protection obligations on each subprocessor.
7. Assistance
Agentik helps the Customer answer data subjects' requests (the app finds, exports and deletes a visitor's data by email or phone), and with security, breach notification, impact assessments and prior consultation, taking into account the nature of the processing.
8. Deletion and return
Conversations and leads are deleted automatically after the retention period the Customer sets, and on the Customer's request. On termination Agentik deletes the Customer's data after 30 days, unless law requires storage; the Customer can export everything before. Backups are overwritten within [the backup retention period].
9. Personal data breaches
Agentik notifies the Customer without undue delay, and where feasible within [48] hours, after becoming aware of a personal data breach affecting the Customer's data, with the information Article 33(3) requires as it becomes available.
10. Audits
Agentik makes available the information necessary to demonstrate compliance and allows for reasonable audits, [on 30 days' notice, at most once a year, at the Customer's cost, unless after a breach].
11. International transfers
Where subprocessors process data outside the EU/EEA, transfers rely on [an adequacy decision or the EU Standard Contractual Clauses], listed per subprocessor.