Data Processing Agreement

Last updated: September 2026

1. Subject Matter and Duration of Processing

The subject matter of this Agreement is the processing of personal data by the Processor in connection with the use of InsightHub — a SaaS platform for AI-powered product search, chat assistance, and search analytics.

The duration of the processing corresponds to the term of the service agreement between the Controller (Customer) and the Processor (Provider).

2. Nature and Purpose of Processing

The processing comprises the following activities:

• Provision of the AI assistant on the Customer's website/shop (chat widget) and — where the add-on is subscribed — via WhatsApp and telephone (InsightHub Voice)
• Storage and analysis of search queries, chat sessions, and click paths
• Creation and display of analytics dashboards in the Customer's admin area
• Synchronization of product, content, customer, and order data from connected shop and website systems
• Lead and contact management incl. document storage, helpdesk tickets, review and survey invitations, cart reminders, and automations on behalf of the Customer
• Delivery of transactional and notification emails (e.g., reports, alerts)

3. Types of Personal Data

The following categories of personal data may be processed:

• Search queries, chat messages, WhatsApp messages, and telephone call transcripts (text, no audio recording) of end users
• Contact and lead data: name, email, telephone number (including callers' phone numbers), inquiry, status, notes, custom fields
• Customer and order data from the Customer's shop system (name, email, order number, line items, status), shopping carts incl. proof of consent
• Reviews and survey responses (name, email, rating, free text)
• Technical data: visitor ID, IP address, user agent, timestamps, session assignment
• Customer identifiers optionally passed by the Customer: customer ID, email address, name
• Account data of the Customer's administrators: name, email, password hash, locale, role
• Usage data (page views, timestamps, actions taken)
• Documents and files uploaded by the Customer or by end users (e.g., contracts, ID copies, invoices, images) including file name, file type, size, and assignment to the respective lead — including all personal data contained in these documents

4. Categories of Data Subjects

• End users (customers, visitors) of the website or shop operated by the Customer
• Employees and administrators of the Customer who operate InsightHub

5. Obligations of the Processor

The Processor undertakes:

• To process personal data only on documented instructions from the Controller
• To ensure that persons authorized to process the personal data have committed themselves to confidentiality
• To take all technical and organizational measures required pursuant to Art. 32 GDPR (see Annex 2)
• Not to engage any further sub-processors beyond those listed in Annex 3 without prior authorization
• To assist the Controller in fulfilling its obligations toward data subjects (Art. 12–22 GDPR)
• To assist the Controller with data protection impact assessments and notification obligations
• To delete or return all personal data after the end of the processing
• To make available to the Controller all information necessary to demonstrate compliance and to allow for audits

6. Sub-processors

The Processor engages sub-processors for hosting and network, AI services, email delivery, payment processing, and — only where the respective add-ons are subscribed — for WhatsApp messaging and telephony. A complete list including purpose and server location is set out in Annex 3.

Where further sub-processors are engaged, the Controller will be informed in advance with reasonable notice and given the opportunity to object. In the event of a justified objection, both parties have a right of extraordinary termination.

7. Technical and Organizational Measures

The Processor guarantees the following security measures:

7.1 Confidentiality

• Access control through authentication and role-based permissions
• Restriction of access to authorized employees
• Encryption of data in transit (TLS 1.2+)
• Encryption of sensitive data at rest

7.2 Integrity

• Logging of input, modification, and deletion operations
• Input validation and protection against injection attacks
• Secure transmission paths between application components

7.3 Availability

• Regular, automated, and encrypted backups (stored separately from the production system) with verified restoration
• Monitoring of services and incident notifications
• Documented recovery procedures

7.4 Resilience

• Scalable infrastructure in certified EU data centers
• Monitoring of system resources
• Redundant components where economically reasonable

8. Retention Periods

9. Rights of Data Subjects

The Processor assists the Controller in fulfilling its obligations pursuant to Art. 12–22 GDPR, in particular with regard to:

• Requests for access (Art. 15 GDPR)
• Requests for rectification (Art. 16 GDPR)
• Requests for erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)

10. Notification of Personal Data Breaches

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach. The notification shall at least contain:

• A description of the nature of the breach
• The categories and approximate number of data subjects and data records concerned
• The likely consequences of the breach
• The countermeasures taken or proposed

11. Deletion and Return

After the end of the contractual relationship, all personal data processed on behalf of the Controller will be deleted or — at the Controller's request — returned, unless statutory retention obligations prevent this. Confirmation of deletion will be provided upon request.

12. Audit Rights

The Controller has the right to verify compliance with the technical and organizational measures. The Processor shall provide the necessary information and shall allow audits in a reasonable manner after prior coordination.

13. Liability

Liability is governed by the provisions of Art. 82 GDPR. Each party is liable for the damage caused by processing that does not comply with the GDPR, in accordance with its degree of fault. In all other respects, the liability provisions of the General Terms and Conditions apply.

14. Final Provisions

This Data Processing Agreement is governed by Austrian law. Amendments and supplements must be made in writing (text form is sufficient). Should individual provisions be invalid, the validity of the remaining provisions shall remain unaffected.