Data Processing Agreement (DPA)

1. Introduction

This Data Processing Agreement ("DPA") supplements the Terms of Service between Global Online Mapps Ltd, a company registered in England and Wales under company number 9909303 with registered office at Suite 7 Midshires House, Smeaton Close, Aylesbury, England HP19 8HL, trading as "Bravos AI" ("Processor"), and the customer using the Service ("Controller"). This DPA is entered into in accordance with Article 28 of the General Data Protection Regulation (GDPR) and the United Kingdom data protection legislation (UK GDPR).

By using the Service, the Controller accepts the terms of this DPA. If the Controller requires a signed version of this agreement, it may be requested at [email protected].

2. Definitions

• "Controller": The customer who determines the purposes and means of the processing of personal data through the Service.
• "Processor": Global Online Mapps Ltd (trading as "Bravos AI"), which processes personal data on behalf of the Controller.
• "Sub-processor": A third party engaged by the Processor to carry out specific processing activities on behalf of the Controller.
• "Personal Data": Any information relating to an identified or identifiable natural person processed in the context of the Service.
• "Data Subject": A natural person whose personal data is being processed.
• "Security Breach": A breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of personal data.
• "SCCs": Standard Contractual Clauses approved by the European Commission for international data transfers.

3. Subject Matter and Duration of Processing

The Processor processes personal data on behalf of the Controller for the purpose of providing the Bravos AI Service, which includes the creation, training, and deployment of AI-powered chatbots.

• • Duration: This DPA remains in effect for as long as the Controller uses the Service, plus the period necessary for the deletion or return of data after termination.
• • Nature of processing: Storage, indexing, vector embedding generation, processing through AI models for response generation, and content delivery to End Users.
• • Purpose: To provide the AI chatbot service contracted by the Controller, including the processing of End User queries and the generation of responses based on Training Data.

4. Types of Personal Data and Categories of Data Subjects

4.1 Types of Personal Data

• • Controller account data (name, email, encrypted password)
• • Conversation messages between End Users and the chatbot
• • Media files shared by End Users (automatically deleted after 24 hours)
• • Anonymous session identifiers (fingerprint)
• • Data contained in Training Data provided by the Controller (documents, CSV, Excel, URLs)
• • Lead data captured through the chatbot (name, email, phone, or other fields configured by the Controller)
• • Email address the End User provides when requesting to speak with a member of the Controller's team
• • End User's phone number and WhatsApp display name, when the Controller connects a WhatsApp Business number
• • Messages the Controller sends to its End Users from its own WhatsApp Business application, when the number is connected in coexistence mode
• • Technical data (IP address, user agent, device data)

4.2 Categories of Data Subjects

• • End Users who interact with the Controller's chatbots
• • Employees or representatives of the Controller with access to the admin panel
• • Individuals whose personal data is contained in the Training Data

5. Obligations of the Processor

5.1 Documented Instructions

The Processor shall process personal data only on documented instructions from the Controller, including those set out in the Terms of Service and this DPA, unless required to do so by law. In such a case, the Processor shall inform the Controller prior to processing, unless the law prohibits such notification.

5.2 Confidentiality

The Processor ensures that all persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.3 Security Measures (Art. 32 GDPR)

The Processor implements the following technical and organizational measures to ensure a level of security appropriate to the risk:

• • Encryption of data in transit (HTTPS/TLS)
• • Password encryption (bcrypt)
• • Restricted access to personal data based on the principle of least privilege
• • Regular and automated backups
• • Security monitoring and anomaly detection
• • Hosting on Hetzner Online GmbH servers (Germany, EU) with ISO 27001 standards
• • Periodic review of the effectiveness of security measures

5.4 Security Breach Notification

In the event of a Security Breach affecting the Controller's personal data, the Processor shall notify the Controller without undue delay and, in any case, within 72 hours of becoming aware of the breach. The notification shall include the nature of the breach, the categories and approximate number of affected data subjects, the likely consequences, and the measures taken or proposed to remedy the situation.

5.5 Assistance to the Controller

The Processor shall assist the Controller, taking into account the nature of the processing, in:

• • Responding to data subject requests (access, rectification, erasure, portability, objection, restriction)
• • Fulfilling obligations regarding security of processing (Art. 32 GDPR)
• • Notifying security breaches to the supervisory authority (Art. 33 GDPR)
• • Conducting data protection impact assessments (DPIA), where necessary
• • Prior consultation with the supervisory authority (Art. 36 GDPR)

5.6 Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR. The Processor shall allow and contribute to audits, including inspections, conducted by the Controller or an authorized auditor, with reasonable notice of at least 30 days and during business hours. The Controller shall bear the costs of the audit.

5.7 Processor Personnel Access

Authorized Processor personnel may access the data and content that the Controller uploads to the platform (documents, texts, spreadsheets, integrations and chatbot conversations) solely where necessary to: (i) provide and maintain the service; (ii) provide the technical support requested by the Controller; (iii) ensure the security of the platform and detect or prevent improper, fraudulent or unlawful use of the chatbots; and (iv) comply with applicable legal obligations. Such access is limited to personnel with a justified need (principle of least privilege), is subject to the confidentiality obligations of clause 5.2, and is not used for purposes other than those set out above.

6. Sub-processors

The Controller grants the Processor a general authorization to engage sub-processors, subject to the conditions in this section. The Processor ensures that sub-processors are bound by data protection obligations equivalent to those in this DPA.

6.1 Current Sub-processors

6.2 Notification of Changes

The Processor shall notify the Controller of any addition or replacement of sub-processors with at least 30 days' prior notice. The Controller may object to the new sub-processor on reasonable grounds related to data protection, within 15 days of notification. If the objection cannot be reasonably resolved, either party may terminate the agreement.

7. AI-Specific Provisions

7.1 AI Processing

The Service uses third-party artificial intelligence models to generate chatbot responses (currently OpenAI) and to analyse the images sent by End Users (currently an Anthropic model run inside Amazon Bedrock, in the Ireland region). The processing flow is as follows:

• • Training Data is processed locally to generate vector embeddings, which are stored in the Processor's database
• • When an End User sends a message, candidate fragments of Training Data are retrieved and sent together with the message to Voyage AI, which re-ranks them by relevance without generating any text
• • The highest-scoring fragments are sent to the OpenAI API along with the user's message to generate a response
• • OpenAI processes this data solely to generate the response and does not retain it beyond 30 days (for abuse monitoring), after which it is automatically deleted
• • OpenAI does not use data submitted through its API to train its models
• • Images sent by an End User are analysed in Amazon Bedrock, within the Ireland region, without leaving the European Union. The model runs inside AWS's infrastructure and the data is not sent to Anthropic's own infrastructure nor used to train models

7.2 Contractual Restrictions with AI Providers

The Processor maintains data processing agreements (DPAs) with all its AI providers that include:

• • Express prohibition on using customer data for model training
• • Defined retention periods and automatic deletion
• • Standard Contractual Clauses (SCCs) for international transfers
• • Appropriate technical and organizational security measures

7.3 Connections Initiated by the Controller (MCP Connector)

The Service allows the Controller to connect, via the connector (MCP), an AI assistant of its choice. When the Controller enables this connection, the provider of that assistant receives the data the assistant queries and acts as a further sub-processor appointed and authorised by the Controller itself, not engaged by the Processor. Consequently, such processing is outside the Processor's control: the safeguards in sections 6 and 7 —including the no-training commitment and the DPAs/SCCs— refer to the Processor's sub-processors and do not extend to the provider the Controller connects. It is the Controller's responsibility to review and accept that provider's terms and to have a legal basis for the processing. The Controller may revoke the connection at any time from its panel.

8. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA) or the United Kingdom, the Processor ensures that appropriate safeguards are in place:

• • Standard Contractual Clauses (SCCs): Module 2 (Controller to Processor) approved by the European Commission, incorporated by reference into this DPA
• • EU-US Data Privacy Framework (DPF): Verification of US provider participation where applicable
• • UK International Data Transfer Agreement (IDTA): For transfers subject to UK GDPR
• • Transfer Impact Assessment (TIA): Where required by applicable legislation

9. Data Subject Rights

The Processor shall assist the Controller, by appropriate technical and organizational measures, in responding to data subject requests under Chapter III of the GDPR:

• • Access and portability: The Controller can export conversations and data from the admin panel
• • Erasure: The Controller can delete conversations, training data, and lead data from the admin panel. Upon account cancellation, all data is deleted within 30 days
• • Rectification: The Controller can update Training Data at any time
• • Additional requests: For requests requiring Processor assistance, contact [email protected]

10. Data Retention and Deletion

Upon termination of the Service, the Processor shall delete all of the Controller's personal data within the following timeframes, unless a legal obligation requires its retention:

• • Account data: 30 days after cancellation
• • Training Data and embeddings: Deleted immediately upon datasource removal or account cancellation
• • Widget conversations: 90 days of inactivity (automatic deletion); those associated with a contact request are retained for as long as the contact is retained
• • Widget media files: 24 hours (automatic deletion)
• • Billing data: 10 years (legal tax requirement)
• • Technical logs: 90 days

The Controller may request the return of their data in a structured format prior to deletion by contacting [email protected].

11. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. Each party shall be liable for damages caused by processing that infringes the GDPR, in accordance with Article 82 of the GDPR.

12. Governing Law and Jurisdiction

This DPA is governed by the laws of the United Kingdom. Any disputes shall be resolved in accordance with the courts of England and Wales, without prejudice to the right of data subjects to lodge complaints with the data protection authority of their country of residence.

13. Contact

For any inquiries regarding this DPA or the processing of personal data:

• Email: [email protected]
• Registered office: Suite 7 Midshires House, Smeaton Close, Aylesbury, England HP19 8HL