Data processing agreement

This data processing agreement ("DPA") is part of the terms of service between the merchant that holds a ChatPuff account (the "Controller") and Nikolaos Sarafoudis, 8 Nikolaou Plastira Str, 56334, Thessaloniki, Greece (the "Processor", "ChatPuff"). It applies whenever ChatPuff processes personal data on the Controller's behalf, as Article 28 of Regulation (EU) 2016/679 (the "GDPR") requires. The Controller accepts it by accepting the terms of service; a signed copy is available on request.

1. Roles

• For the personal data of the Controller's shop customers and the conversations with them, the Controller is the controller and ChatPuff is the processor.
• For the accounts of the Controller's team, billing and the security of the Service, ChatPuff is a controller in its own right, as described in the privacy notice. This DPA does not cover that processing.
• The Controller's staff who use the Service act on the Controller's behalf. The Controller decides who gets access to which shop.

2. Details of the processing

3. Instructions

• ChatPuff processes personal data only on the Controller's documented instructions. The terms of service, this DPA and the settings the Controller makes in the dashboard are those instructions. ChatPuff processes data for no purpose of its own, and never for advertising or for training AI models.
• ChatPuff informs the Controller if it considers an instruction to infringe the GDPR or other data-protection law, and may suspend the instruction until it is clarified.
• Where EU or member-state law requires ChatPuff to process the data otherwise, ChatPuff informs the Controller before processing, unless the law forbids it.

4. Confidentiality and staff

ChatPuff limits access to personal data to the people who need it to provide the Service, binds them to confidentiality, and trains them in data protection. Access to production systems by ChatPuff's own administrators requires multi-factor authentication and is logged. Access to the Controller's conversations for support is read-only, limited to one shop and to 24 hours, and requires a documented reason; every conversation opened is logged and shown to the Controller's owners in the dashboard. Bug reports that the Controller's staff send from the dashboard, with their screenshots, are read by ChatPuff's administrators only, to fix the problem reported, and are kept for a year after the report is closed.

5. Security

ChatPuff implements the technical and organizational measures of Annex 2 and keeps them current with the state of the art, the risks and the nature of the data (Article 32 GDPR). ChatPuff may change them, but never in a way that lowers the overall level of protection.

6. Sub-processors

• The Controller gives ChatPuff general authorization to engage the sub-processors listed in Annex 3 and to replace or add sub-processors.
• ChatPuff announces a new or replaced sub-processor at least 30 days before it processes the Controller's data, by email to the Controller's owners and on the sub-processor list at chatpuff.com. The Controller may object on reasonable data-protection grounds within that period. If ChatPuff cannot accommodate the objection, the Controller may terminate the affected service without penalty for the remaining period.
• ChatPuff binds every sub-processor by a written contract to data-protection obligations that are at least as protective as this DPA, and remains liable to the Controller for the sub-processor's performance.

7. Assistance

• Data subject rights: the Service lets the Controller view, export and delete conversations. ChatPuff passes on to the Controller, without undue delay, any request it receives from a data subject about the Controller's data, and assists the Controller in answering requests under Articles 12 to 22 GDPR.
• Personal data breaches: ChatPuff notifies the Controller without undue delay, and at the latest 48 hours after becoming aware of a breach affecting the Controller's data, with the information Article 33(3) GDPR requires as far as it is available, and updates it as more becomes known.
• Impact assessments and consultations: ChatPuff provides the information it holds that the Controller reasonably needs for a data-protection impact assessment or a prior consultation with a supervisory authority (Articles 35 and 36 GDPR).

8. Deletion and return

• During the contract, the Controller deletes conversations itself, or sets a retention period after which ChatPuff deletes them. The default is 6 months after a conversation is resolved.
• A newsletter sign-up collected in the chat and never confirmed is deleted 7 days after the box was ticked, and an unsubscribed address 30 days after it left; a confirmed sign-up stays until the Controller's account ends, and the Controller removes it from its own mailing tool.
• When the contract ends, the Controller may export its conversations in a machine-readable format for 14 days. After that period ChatPuff deletes all personal data processed on the Controller's behalf, including in backups as they expire within 30 days, unless EU or member-state law requires ChatPuff to keep it. ChatPuff confirms the deletion on request.
• A data subject's valid erasure request, passed on by the Controller, is carried out ahead of the normal schedule.
• Where the law requires ChatPuff to preserve data, for example for a legal claim or at an authority's request, ChatPuff pauses the deletion of the Controller's data for as long as the requirement lasts, records the reason, and resumes deletion when it ends.

9. Audits

• ChatPuff makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR: this DPA, the measures of Annex 2, the sub-processor list, and any certifications or third-party audit reports ChatPuff obtains.
• Where that information is not enough to demonstrate compliance, the Controller may audit ChatPuff once in any 12 months, with 30 days' written notice, during business hours, without disrupting the Service, at the Controller's cost, by itself or by an independent auditor bound to confidentiality. A supervisory authority may audit at any time as the law provides.

10. International transfers

• ChatPuff stores and processes personal data in the European Union (Germany). It transfers data outside the European Economic Area only through the sub-processors of Annex 3, on the basis of an adequacy decision (including the EU–US Data Privacy Framework for certified organizations) or the European Commission's standard contractual clauses, with supplementary measures where needed.
• Where a sub-processor offers processing within the EU, ChatPuff selects it.

11. Liability, term and law

• Each party is liable towards the other as the terms of service provide; the limitation of liability in the terms applies to this DPA, except where Article 82 GDPR or mandatory law provides otherwise.
• This DPA lasts as long as ChatPuff processes personal data for the Controller. It prevails over the terms of service where they conflict on data protection.
• Greek law governs this DPA. Where the GDPR requires it, the law of the Controller's member state applies to the Controller's obligations.
• The Greek version of this DPA is the authoritative text. The versions in other languages, English included, are translations: if one of them differs from the Greek version, the Greek version prevails.

Annex 1 — Instructions in the dashboard

The Controller instructs ChatPuff through these settings, per shop: the retention period for conversations; whether AI answers are enabled and which model provider is used; whether customers may send files; whether missed-reply emails are sent; whether the team sees what customers type before sending it; the knowledge sources the AI may use; whether the newsletter sign-up box is offered in the chat, and the export of its sign-ups and unsubscribes to the Controller's mailing tool; the team members who may access the shop's conversations; and the deletion of individual conversations, of a shop or of the whole organization.

Annex 2 — Technical and organizational measures

• Hosting: dedicated servers at Hetzner Online GmbH in Germany (ISO 27001-certified data centers), with a documented server configuration and separate system users for the application.
• Encryption: TLS 1.2 or later for all traffic; backups encrypted with AES-256 before they leave the server; passwords stored only as salted hashes; secrets stored outside the code and never in the source repository.
• Access control: every request checks the caller's role and the shop's scope on the server; shops of different organizations are isolated by database constraints and access checks; sessions are revocable and expire; staff access from a shop's back office is limited to that installation's shops and to 15-minute tokens; the native apps sign in through revocable sessions with 15-minute tokens, keep the recent conversations in the app's private storage on the phone for reading offline, and delete them at sign-out.
• Administrator access: named administrators only, SSH keys, an authenticator app for the platform administration, whose sessions end after 30 minutes without activity, no shared accounts; access to a merchant's conversations for support is read-only, limited to one shop and to 24 hours, requires a documented reason, and is logged and shown to the merchant's owners.
• Logging and audit: administrative actions are recorded in an append-only audit log with actor, action, time and IP address; technical logs never contain message texts, names, email addresses or credentials; production errors are reported to ChatPuff's administrator by email with the error and a request reference, without personal data; logs are kept 30 days, audit records 6 months.
• Availability and backups: continuous database backups with point-in-time recovery and daily backups of files and settings, encrypted, to separate storage in Germany, kept 30 days; restore procedures documented and tested; monitoring and alerting of the servers and services.
• Input and abuse controls: rate limits on every public endpoint, signed requests from shop integrations, replay protection, bot checks on sign-in pages, malware scanning of uploaded files, validation of all input, and automatic pauses of new chats, connections or trials at abuse thresholds until an administrator reviews them.
• Data minimization and deletion: only the data listed in section 2 is collected; retention periods are enforced by scheduled deletion; deletion is reapplied after a restore from backup; deleted data leaves backups within 30 days.
• Development: changes are tested automatically before release, code is reviewed, dependencies are kept updated, releases are atomic and can be rolled back, and security reports are received at support@chatpuff.com.
• Incident management: a documented procedure for detecting, assessing, containing and notifying breaches within the time limits of section 7.

Annex 3 — Sub-processors