Data Processing Agreement

1. Introduction and scope

This Data Processing Agreement (the 'DPA') forms part of, and is subject to, the Breezaro Terms of Service (the 'Agreement') between Breezaro s.r.o., ID No. 23465344, with registered office at Zborovská 2049/27, 616 00 Brno, Czech Republic ('Breezaro' or the 'Processor'), and the customer that has accepted the Agreement (the 'Customer' or the 'Controller'). The company is registered in the Commercial Register maintained by the Regional Court in Brno, Section C, File 146059.

It applies to the extent Breezaro processes personal data on behalf of the Customer when providing the Service (the Breezaro AI chatbot and related features). Where its terms conflict with the Agreement on the subject of the processing of personal data, this DPA prevails.

'Applicable Data Protection Law' means Regulation (EU) 2016/679 (the 'GDPR') together with any national legislation implementing or supplementing it, including Czech Act No. 110/2019 Coll. Terms such as 'personal data', 'processing', 'controller', 'processor', 'data subject' and 'personal data breach' have the meanings given in the GDPR.

2. Roles of the parties

For personal data in the Customer's conversations, knowledge bases, connected content sources and visitor context, and other personal data processed on the Customer's behalf through the Service ('Customer Personal Data'), the Customer acts as controller and Breezaro acts as processor. Where the Customer acts as processor for another controller, Breezaro acts as sub-processor and the Customer must have that controller's authorisation to engage Breezaro.

The Customer is responsible for establishing a lawful basis for the processing, for providing all information and notices required towards data subjects (including in the Customer's own privacy policy), for the accuracy of any personal data it or its visitors provide, and for the lawfulness of the instructions it gives to Breezaro.

The Customer is responsible for obtaining and documenting any visitor consent required for its deployment, including under the rules on storage and access on terminal equipment, and for making refusal and withdrawal effective. The Customer must give accurate instructions through its configuration and integration. Neither an administration acknowledgement nor the use of Breezaro's consent API constitutes consent on behalf of a visitor. Breezaro remains responsible for its own obligations as processor; this allocation does not exclude either party's obligations under applicable law.

This DPA does not cover processing for which Breezaro determines its own purposes as controller, such as administering its customer accounts and billing. That processing is described in the Privacy Policy.

3. Subject matter and processing instructions

Breezaro processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers of personal data to a third country, unless required to process by Union or Member State law to which Breezaro is subject; in that case Breezaro informs the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

The Agreement, this DPA (including Annex 1), and the Customer's use, configuration and integration of the Service, including its selection of a supported consent provider and category or commands passed through the documented consent API, constitute documented processing instructions. New assistants have 'Wait for visitor consent' enabled by default; existing assistants retain their saved setting. The Customer must connect the selected consent source. Where prior consent is required, the Customer must keep waiting enabled or implement an equivalent effective control before collection and configure the connection to reflect the relevant existing visitor decision and later changes. With waiting enabled, an unknown or declined decision leaves optional context, website analytics and AI or history-based outreach disabled. Saved settings apply when the widget next loads the current settings. Selecting a provider or category does not establish a lawful basis or consent on behalf of visitors. Additional or alternative instructions outside the available controls must be agreed in writing. These controls also govern optional website analytics. Local welcome bubbles and eligible custom-text scenarios can display without optional collection; after the visitor opens a chat, the selected opening text may be processed as conversation content. This does not enable browsing-history collection or analytics.

Breezaro informs the Customer without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law.

4. Confidentiality

Breezaro ensures that the persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process the data only on the Customer's instructions unless required to act otherwise by law.

5. Security of processing

Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks of varying likelihood and severity to the rights and freedoms of data subjects, Breezaro implements appropriate technical and organisational measures pursuant to Article 32 GDPR. The measures in force are described in Annex 3. Breezaro may update those measures from time to time provided the overall level of protection is not diminished.

Taking into account the nature of the processing and the information available to it, Breezaro assists the Customer in meeting the Customer's security obligations under Article 32 GDPR. In particular, Breezaro provides the necessary information about the measures described in Annex 3, the available security settings of the Service, and known risks relating to the processing of the Customer's personal data, including material changes to those risks. Breezaro also assists with assessing and configuring security insofar as it relates to the Service. The Customer may request this assistance at info@breezaro.com. When sharing information, the parties protect confidential information and the security of the Service; these safeguards must not prevent the provision of information necessary for the Customer to meet its legal obligations.

6. Sub-processors

The Customer grants Breezaro general written authorisation to engage sub-processors to carry out specific processing activities on its behalf. The sub-processors under this wording of the DPA are listed in Annex 2.

Breezaro shall impose on each sub-processor, by a written contract, the same data protection obligations applicable to the relevant processing under this DPA, including sufficient guarantees for appropriate technical and organisational measures. Breezaro remains fully liable to the Customer for the performance of the sub-processor's obligations.

Breezaro will notify the Customer of each intended addition or replacement of a sub-processor by email to the contact address of the customer account at least 30 calendar days before engaging that sub-processor to process the Customer's personal data. The notice will state the provider's identity, registered office, intended processing activities and locations, relevant data protection safeguards, and planned engagement date. The Customer may raise a reasoned objection on data protection grounds at info@breezaro.com within 15 calendar days of receiving the notice.

The parties will seek to resolve the objection before the planned engagement of the sub-processor, for example by agreeing on additional safeguards or an alternative way of providing the affected part of the Service. Until a timely objection is resolved, Breezaro will not make the Customer's personal data available to that sub-processor. If no resolution is agreed by the planned engagement date, either party may terminate the part of the Service that cannot be provided without that sub-processor; the Customer will not be charged a termination penalty, and Breezaro will refund the proportionate prepaid fees for the unprovided period of the affected service. If the Customer does not object within the stated period, Breezaro may engage the sub-processor only after the 30-day notice period has elapsed. This procedure does not affect claims arising from a breach of this DPA or rights that cannot be contractually limited.

7. International transfers

Transfers of Customer Personal Data outside the EEA must comply with Chapter V GDPR and the Customer's documented instructions. Reliance on an adequacy decision under Article 45 GDPR, including the EU-U.S. Data Privacy Framework, requires the recipient and the transfer to fall within its current scope. Otherwise an applicable safeguard under Article 46 GDPR, such as valid Standard Contractual Clauses, is required.

Before relying on Standard Contractual Clauses, Breezaro must assess and document their effectiveness for the relevant transfer, implement any necessary supplementary measures and keep the assessment under review. Measures must reflect the actual processing and access to the data; encryption in transit or at rest alone is not a guarantee against every form of access. Annex 2 identifies the providers and mechanisms available under their published terms. The Customer may request information about the applicable safeguards and copies at info@breezaro.com.

8. Assistance with data subject rights

Taking into account the nature of the processing, Breezaro assists the Customer with requests under Chapter III GDPR, including access, rectification, erasure, restriction, portability and objection. Dashboard deletion and other self-service tools initiate the routine cleanup described in Section 12; they do not by themselves confirm erasure of every copy. The Customer may contact info@breezaro.com for assistance with a request or an instruction requiring action outside that routine process.

If Breezaro receives a request directly from a data subject that relates to Customer Personal Data, it forwards the request to the Customer without undue delay and does not otherwise respond to the request except on the Customer's documented instruction or where required to do so by law.

9. Personal data breaches

Breezaro notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provides the Customer with the information reasonably available to it to enable the Customer to meet its obligations under Articles 33 and 34 GDPR, including a description of the nature of the breach, its likely consequences and the measures taken or proposed.

10. Data protection impact assessments

Taking into account the nature of the processing and the information available to it, Breezaro provides the Customer with reasonable assistance in carrying out data protection impact assessments and, where required, prior consultations with the competent supervisory authority under Articles 35 and 36 GDPR.

11. Records, information and audits

Breezaro makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, by the Customer or an auditor mandated by the Customer. Routine audits may normally be scheduled once in any twelve-month period. This limit does not apply where an additional audit is required by law or a supervisory authority, following a personal data breach affecting Customer Personal Data, or where the Customer has reasonable grounds to suspect non-compliance.

Audit arrangements, including notice, timing, confidentiality and security measures, must be reasonable and must not prevent an effective audit or the exercise of rights under Article 28 GDPR. Audits should minimise unnecessary disruption and protect other customers' data. Shorter notice or other arrangements must be allowed where necessary in the circumstances.

12. Retention, return and deletion

At the Customer's choice, Breezaro shall delete or return all Customer Personal Data after the end of the provision of the Service and delete existing copies without undue delay, unless Union or Member State law requires storage. The routine technical lifecycle described below does not authorise retention contrary to that obligation or a lawful erasure instruction. Cancelling a paid subscription does not by itself close the account or end all processing where the Customer continues to use the Service.

Conversation history, knowledge-base content and account settings are retained while your account exists, unless you delete them or request erasure. Cancelling your subscription alone does not delete this data or saved integration credentials.

The periods below describe routine storage and automated cleanup. They are not statutory minimum retention periods and do not override a valid erasure request, a lawful instruction from the controller or the obligation to stop retaining personal data once it is no longer needed. Where Article 17 GDPR requires erasure, it must take place without undue delay; the routine cleanup schedule is not itself a reason to postpone it.

When documents are uploaded to the knowledge base, we store their processed text and document details. We do not save the uploaded files themselves in object storage. This content follows the retention and erasure rules described in this section.

A conversation deleted in the dashboard is hidden immediately. Its conversation records are permanently removed by a scheduled cleanup after the retention period measured from deletion: 90 days by default, configurable between 60 and 730 days per chatbot. Visitor page-trail records have a separate retention period of 90 days from their creation.

Removing an individual knowledge-base source stops its use for answers. A deleted source record, including extracted text, can remain in the database until the chatbot is deleted or a separate erasure request is completed. Removing a source is therefore not a guarantee of immediate erasure of every copy.

Deleting a chatbot or account removes its custom-action credentials and integration configuration and starts cleanup of external files and search vectors. Remaining file records for a deleted chatbot are normally removed after 60 days and remaining chatbot and conversation records after 90 days from chatbot deletion. These are scheduled cleanup periods; unsuccessful external deletions are retried and can delay completion. Account deletion anonymises the main user profile and revokes sign-in access.

You can request erasure of personal data or return of your data at info@breezaro.com. Where we act as processor, we forward a data subject's request to the relevant customer and assist that customer in fulfilling it. Operational, security and accounting records are considered separately from conversation records. They are included when assessing an erasure request; any continued retention requires an applicable legal ground or exception, such as a legal obligation or the establishment, exercise or defence of legal claims. Non-content usage totals and records that are no longer personal data may remain.

Ordinary operational and security logs and team audit entries are routinely deleted after 90 days. Records required to complete an unfinished deletion remain until completion. Retention periods and criteria for Breezaro’s own accounting, contractual-evidence and anti-abuse records, for which Breezaro acts as an independent controller, are set out separately in Section 3a of the Privacy Policy. Those purposes do not permit continued use of Customer Personal Data for providing answers after a valid deletion instruction.

Backups of the main PostgreSQL database are scheduled daily. They are stored in Amazon S3 in Stockholm, Sweden (eu-north-1). The backup job is configured to keep the five most recent successful backups rather than applying a fixed maximum age. With successful daily backups this is approximately five days; if backups stop succeeding, older copies remain until subsequent successful backups replace them. Deletion from the live database is reflected in subsequent backups, not by editing existing backup files.

An account that has never had a paid subscription may enter automatic deletion after 30 days from the end of its trial, and only after at least seven days have passed since a deletion warning was successfully sent. Active membership in another customer team and administrative accounts are excluded. Accounts deleted automatically follow the deletion process and retention periods described above; trial expiry itself does not immediately erase all data.

An account that has never had a subscription and has not completed onboarding may enter automatic deletion after 60 days from registration. Accounts with active membership in another customer team and administrative accounts are excluded.

13. Liability

Contractual claims between the parties relating to this DPA are subject, to the extent permitted by law, to the limitations of liability in Section 6 of the Agreement, including all exceptions stated in that section. The limitations apply only to Customers acting in the course of their business activity, not to consumers. In particular, they do not apply to harm caused intentionally or through gross negligence, harm to a person's natural rights, or claims of a weaker party that cannot lawfully be limited.

Nothing in this DPA or the Agreement limits or excludes liability that cannot be limited or excluded under applicable law. Contractual limitations between the parties do not affect the rights of data subjects, including the right to compensation under Article 82 GDPR, or the powers of supervisory authorities, including the imposition of administrative fines under Article 83 GDPR.

14. Term

This DPA takes effect when the Customer accepts it or first uses the Service, whichever is earlier, and continues in force for as long as Breezaro processes Customer Personal Data on the Customer's behalf under the Agreement.

15. Governing law

This DPA is governed by the laws of the Czech Republic and, where applicable, by Applicable Data Protection Law. Disputes are subject to the jurisdiction agreed in the Agreement.

16. Contact

Questions about this DPA or about Breezaro's processing of Customer Personal Data may be sent to info@breezaro.com.

Annex 1 - Description of the processing

This Annex describes the processing that Breezaro carries out on the Customer's behalf.

• Subject matter: the processing of Customer Personal Data through the Breezaro AI chatbot and related features.
• Duration: the term of the Agreement, together with the retention and deletion periods described in Section 12.
• Nature and purpose: hosting and operating an AI chatbot that answers the Customer's website visitors, generating and storing conversation records, retrieving answers from the Customer's knowledge base, and providing the Customer with an operator dashboard, analytics and notifications. Where enabled, processing current-page, browsing-trail and customer-supplied context to tailor assistance and select or generate proactive messages, including before the visitor starts a conversation.
• Categories of data subjects: the Customer's website visitors and end users, including visitors whose context is collected before they start a chat; individuals referenced in content the Customer uploads to its knowledge base; and the Customer's own operators and team members.
• Types of personal data: online identifiers (IP address, approximate country, device type, browser, operating system, language, referrer and campaign parameters); the content of chat messages, which may contain any personal data a visitor chooses to provide, such as name, email address, telephone number or order details; channel identifiers where the Customer connects messaging channels (for example a WhatsApp profile name); AI-generated conversation summaries; current-page information and the visitor page trail (URL paths, page titles and visit times); context supplied through the Customer's integration, such as shopping-cart contents; and any personal data contained in documents the Customer uploads to its knowledge base. Conversation metadata also includes the latest reported permission state for optional context collection and its server receipt time, for display to the Customer; it is not evidence of valid consent. Mobile notifications also involve the operator’s device push token, assistant and conversation identifiers, event type, and notification content.
• Special categories of personal data: the Service is not intended to process special categories of personal data. The Customer must not configure the Service to solicit such data, and Breezaro does not intentionally process it.

Annex 2 - Sub-processors

The following sub-processor list corresponds to this wording of the DPA. Breezaro notifies the Customer of changes as set out in Section 6. Meta is engaged only where the Customer connects the relevant messaging channel. Providers established in the EEA may transfer personal data onward to affiliates or sub-processors outside the EEA. The entries below describe transfer mechanisms available under the providers' published terms; the applicable agreements, transfer scope and current certification status determine which mechanism can be relied on. The obligations in Section 7 also apply to onward transfers. Expo is used when delivering mobile push notifications. This list is publicly available in Annex 2 at https://www.breezaro.com/en/dpa. Previously accepted wording of the DPA, including its sub-processor list, is available in profile settings.

The main production database is hosted by Hetzner in Nuremberg, Germany. Service assets and main-database backups are stored in Amazon S3 in Stockholm, Sweden (eu-north-1). The production Pinecone search index is hosted on AWS in the United States (us-east-1). The Service therefore does not provide exclusively EU-based storage or processing. AI providers and other recipients may process data outside the EEA under the safeguards described below; a provider's registered office is not a guarantee of its processing location.

• Hetzner Online GmbH (Germany): hosting of the application and main production database in Nuremberg, Germany.
• OpenAI (OpenAI Ireland Ltd, Ireland): generation of chatbot replies and audio transcription.
• Google Gemini API: response generation and embeddings. The contracting Google entity is determined by the applicable service agreement; the standard Paid Services terms identify Google Cloud EMEA Limited (Ireland) for customers with a Czech billing address. https://ai.google.dev/gemini-api/terms
• Pinecone (Pinecone Systems, Inc., United States): vector search over the customer's knowledge base and conversation content; the production index is stored on AWS in the United States (us-east-1). Pinecone's standard DPA incorporates Standard Contractual Clauses for applicable transfers (Article 46 GDPR), including Module 3 where the customer is a processor. The terms governing the service account determine the applicable contractual safeguards. https://www.pinecone.io/legal/data-processing-addendum/
• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): storage of service assets and main-database backups in Amazon S3, Stockholm, Sweden (eu-north-1).
• Resend (Plus Five Five, Inc. d/b/a Resend, United States): transactional and operator notification email delivery. Resend publishes participation in the EU-U.S. Data Privacy Framework, and its standard DPA also includes Standard Contractual Clauses. Reliance on the DPF requires current certification covering the transfer; the applicable account agreement governs contractual safeguards. https://resend.com/security/gdpr
• Sentry (Functional Software, Inc. d/b/a Sentry, United States): application error monitoring. Sentry publishes participation in the EU-U.S. Data Privacy Framework and offers Standard Contractual Clauses as an alternative. Reliance on the DPF requires current certification covering the transfer; the applicable account agreement governs contractual safeguards. https://sentry.io/trust/
• Meta (Meta Platforms Ireland Limited, Ireland): delivery of messages where the Customer connects WhatsApp, Facebook Messenger or Instagram channels.
• Expo (650 Industries, Inc., United States): delivery of mobile push notifications to operators. We send the device push token, notification title and text (which may contain the visitor’s message or name and reason for requesting an operator), assistant and conversation identifiers, and event type. Processing includes the United States. Expo uses Apple (APNs, United States) and Google (FCM, United States) for onward delivery. According to Expo’s documentation, the content remains in memory and queues until handed to Apple or Google; this does not specify retention by those onward services. Transfers to the United States covered by Expo’s current certification use the EU–U.S. Data Privacy Framework (DPF, Article 45 GDPR). The DPF does not replace contractual data-processing obligations. https://www.dataprivacyframework.gov/participant/5606; https://expo.dev/terms; https://expo.dev/privacy/subprocessors; https://docs.expo.dev/push-notifications/faq/

Annex 3 - Technical and organisational measures

Breezaro maintains the following technical and organisational measures, which it may update provided the overall level of protection is not reduced.

• Encryption of personal data in transit using TLS, encrypted storage of integration credentials, and access controls protecting the production database and object storage.
• Account passwords are stored using a strong one-way hash. Secret authentication headers saved for custom actions are stored encrypted. Saved custom-action secret headers are not returned to the customer dashboard; the server decrypts them when needed to call the configured endpoint.
• Logical multi-tenant separation so that each Customer's data is segregated and access is scoped to the Customer's own tenant.
• Access controls based on the principle of least privilege, with authenticated, role-based access to the operator dashboard and administrative systems.
• Protection of server-side outbound requests against server-side request forgery through pinned DNS resolution.
• Audit logging of significant administrative and team actions.
• Backups of the main database are scheduled daily to separate object storage, with retention based on the number of successful backups described in Section 12.
• Rate limiting and abuse protections on public endpoints.
• Retention and deletion controls that enable the Customer to delete conversations and request erasure, with automated purging as described in Section 12.
• Automated application tests include checks of authentication and access permissions, separation of customer accounts, encryption of stored secrets, and SSRF protection.