Data Processing Agreement

1. Roles of the parties

You are the controller of the personal data you process through Baliza — principally the conversations you have with your own customers and the contact records that come with them. We are your processor for that data and act only on your documented instructions.

We are a separate controller for the limited data we handle in our own right: your account details, your organisation record and your usage of the service. That is governed by our Privacy Policy rather than by this agreement.

Your use of the service, including the configuration you choose and the channels you enable, constitutes your documented instructions to us. If we believe an instruction breaches data protection law, we will tell you.

2. Subject matter, duration, nature and purpose

The subject matter is the provision of the Baliza customer conversation platform. The nature and purpose of processing is to receive, store, route, display, transmit and — where you enable it — automate responses to conversations between you and your customers, and to provide the related contact, knowledge base, scheduling and reporting features.

Processing lasts for as long as your account is active, plus the deletion period described in section 10.

3. Categories of data subjects and personal data

Data subjects: your customers and prospective customers who contact you through a channel you have connected; visitors to websites where you have installed the chat widget; and your own staff who use the service.

Categories of personal data are set out in Annex I. You decide what enters the service, so this list describes what the service is capable of holding rather than what you necessarily use.

The service is not designed for special categories of personal data. If your use involves them, tell us before you begin so we can confirm whether the service is appropriate and what additional measures apply.

4. Confidentiality

We ensure that personnel authorised to process your data are bound by confidentiality obligations, receive appropriate data protection training, and are granted access only where needed to provide or support the service.

5. Security

We implement appropriate technical and organisational measures as required by Article 32. Those measures are described in Annex II. We may update them provided the level of protection is not reduced.

6. Sub-processors

You give general authorisation for us to engage sub-processors. The current list is in Annex III.

We impose data protection obligations on each sub-processor no less protective than those in this agreement, and we remain fully liable to you for their performance.

We will give you at least [TODO: notice period, commonly 30 days] notice before adding or replacing a sub-processor, through [TODO: the mechanism — a subscribable sub-processor page and email to account administrators]. If you have a reasonable data protection objection, tell us within that period and we will work with you in good faith; if we cannot resolve it, you may terminate the affected part of the service.

Where you configure your own AI provider, that provider is engaged by you, not by us. It is not our sub-processor, and your relationship with it is yours to govern.

7. Assisting with data subject requests

The service gives you the tools to access, correct, export and delete the personal data you hold, so that you can respond to requests directly.

If a data subject contacts us instead, we will not respond on your behalf beyond directing them to you, and will inform you without undue delay. Where you cannot fulfil a request through the service, we will provide reasonable assistance, taking into account the nature of the processing.

8. Personal data breaches

We will notify you without undue delay, and in any case within [TODO: commitment, commonly 48 or 72 hours] of becoming aware of a personal data breach affecting your data. The notification will describe the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and the measures taken or proposed.

Notifying supervisory authorities and affected data subjects is your responsibility as controller; we will provide the information you reasonably need to do it.

9. Impact assessments and prior consultation

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and any prior consultation with a supervisory authority.

10. Return and deletion

On termination you may export your data through the service for [TODO: export window]. After that we will delete it, including from backups in line with our backup rotation, within [TODO: deletion timeline], except where we are required by law to retain it.

[TODO: confirm these windows against what the product and your backup retention actually do before publishing. This is the clause customers most often verify.]

11. Information and audit

We will make available the information reasonably necessary to demonstrate compliance with this agreement. [TODO: state what you will provide — a security overview, completed security questionnaires, and any third-party certification or report once you hold one.]

[TODO: define audit rights and their limits — for example once per year, on reasonable notice, during business hours, subject to confidentiality, at the controller's cost, and not disrupting other customers.]

12. International transfers

The Baliza application and database are hosted in the European Union and your conversation data is stored there.

Transfers outside the EEA occur only in the limited circumstances identified in Annex III — principally messaging platforms, push notification delivery, and operational tooling. Where such a transfer takes place, it is covered by an adequacy decision or by Standard Contractual Clauses with appropriate supplementary measures.

[TODO: confirm which named sub-processors transfer outside the EEA and attach or reference the executed Standard Contractual Clauses.]

Annex I — Details of processing

Categories of personal data processed on your behalf:

• Contact identity data: name, email address, phone number, and channel identifiers.
• Conversation content: messages, timestamps, assignment, routing and status history.
• Files and media exchanged in conversations, including images, documents and voice notes.
• Web chat technical data: IP address, browser user agent, and session identifiers.
• Optional website engagement events, only where you enable them, retained for 30 or 90 days at your choice.
• Appointment records and, where enabled, missed-appointment history used to apply your booking rules.
• Knowledge base content you author and the search indexes derived from it.
• Your staff account data: name, email address, role, team membership and device tokens for notifications.

Frequency of processing: continuous, for the duration of the agreement.

Annex II — Technical and organisational measures

• Encryption of data in transit between clients and the service.
• Passwords stored using a modern memory-hard hashing algorithm; credentials never stored in readable form.
• Role-based access control within each organisation, with inbox-level restrictions so staff see only conversations belonging to their team.
• Logical separation of each customer organisation's data within the service.
• Signed identity verification for chat widget visitors, preventing one visitor from impersonating another.
• Optional biometric or passcode lock on the mobile application.
• Scheduled deletion of expired uploads and, where enabled, engagement events.
• Error monitoring and audit logging to detect and investigate incidents.
• [TODO: add encryption at rest, backup and restore testing, access review cadence, vulnerability management, penetration testing, and personnel onboarding and offboarding controls — describe only what you actually do.]

Annex III — Sub-processors

[TODO: this annex must list, for each sub-processor: legal entity name, corporate location, processing location, the purpose it serves, and whether it involves a transfer outside the EEA. Publish it at a stable URL so customers can subscribe to changes.]

The categories currently engaged are:

• Cloud hosting and managed database — running the application and storing your data.
• Object storage — files and media exchanged in conversations.
• Email delivery — transactional email and, if enabled, the email channel.
• Messaging platforms — for each channel you connect.
• Push notification delivery — alerts to your staff devices.
• Background job processing — message pipeline and scheduled clean-up tasks.
• Error monitoring and product analytics — fault diagnosis and usage insight.

Contact

To request a signed copy of this agreement, or for questions about it, contact [TODO: privacy contact address].