Data Processing Agreement

1. Parties and roles

The customer who uses Bugalou is the controller. GNL-Commerce, trading as Bugalou, is the processor. The processor processes personal data only on behalf of the customer and in accordance with this DPA.

Where Bugalou processes personal data for its own purposes, such as the customer's account details, billing and the security of the platform, Bugalou is itself the controller. That processing is described in the privacy policy, not in this DPA.

2. Subject, nature and purpose

Bugalou provides a platform for customer communication. In doing so, the processor processes personal data for the following purposes:

• receiving, storing, displaying and sending messages via the channels the customer connects (such as WhatsApp, Instagram, Messenger, email, website chat, SMS and telephony)
• managing contacts, conversations, tickets, notes and attachments
• running automations, AI features and integrations that the customer switches on
• providing reports and statistics to the customer

3. Categories of data subjects and personal data

Data subjects: the customer's own customers and contacts, visitors of the customer's website who use the chat, and the customer's users (employees).

• contact details, such as name, phone number, email address and social media profile names
• the content of messages, emails, calls and attachments, and their metadata (time, channel, status)
• order and customer data that the customer retrieves via integrations, such as shop or ERP systems
• technical data of website visitors who use the chat, such as IP address and browser information
• any other personal data that the customer or its contacts share via the platform

The customer does not use the platform for special categories of personal data (Article 9 GDPR) unless this is necessary and lawful, and remains responsible for that.

4. Duration

This DPA applies for as long as the processor processes personal data for the customer, which is for as long as the customer has a Bugalou account. When a paid subscription ends, the account moves to the free plan and remains active. Clause 11 governs deletion.

5. Instructions

The processor processes personal data only on documented instructions from the customer. The terms of service, this DPA and the settings the customer chooses in the platform together form those instructions.

The processor informs the customer if, in its opinion, an instruction infringes the GDPR or other data protection law. The processor may process personal data without an instruction only where EU or Dutch law requires it, and then informs the customer in advance unless that law prohibits it.

6. Confidentiality

Anyone who works for the processor and has access to personal data is bound by confidentiality. Bugalou's support team only looks into a customer's account with the customer's permission, or where necessary for security or to comply with the law.

7. Security

The processor takes appropriate technical and organisational measures in accordance with Article 32 GDPR. The current measures are listed in the annex. The processor may change these measures provided the level of protection does not decrease.

8. Sub-processors

The customer gives general authorisation to engage sub-processors. The current list, with the purpose and location of each sub-processor, is on the sub-processors page. The processor imposes data protection obligations on each sub-processor that are equivalent to those in this DPA, and remains responsible for their compliance.

The processor informs the customer of an intended new or replacing sub-processor at least 14 days in advance, by email or in the platform. The customer may object on reasonable grounds within that period. If the parties cannot resolve the objection, the customer may terminate the subscription with effect from the change.

9. Transfers outside the EEA

Some sub-processors process personal data outside the European Economic Area, for example in the United States. The processor ensures that such a transfer meets Chapter V GDPR, for example via the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

10. Assistance to the customer

• Requests from data subjects: the platform allows the customer to view, export, correct and delete personal data. If a data subject contacts the processor directly, the processor forwards the request to the customer without undue delay.
• Personal data breaches: the processor informs the customer without undue delay, and where possible within 48 hours, after becoming aware of a breach involving the customer's personal data, with the information the customer needs to meet its obligations under Articles 33 and 34 GDPR.
• The processor assists the customer, where reasonable, with a data protection impact assessment and prior consultation of the supervisory authority.

11. Return and deletion

The customer can export its data, delete conversations and set retention periods itself at any time. On a request from the customer to close its account, the processor deletes the customer's personal data within 30 days, unless EU or Dutch law requires retention. Copies in the backups of the database provider disappear when those backups expire.

12. Information and audits

The processor provides the customer, on request, with the information reasonably needed to demonstrate compliance with Article 28 GDPR. If that information is not sufficient, the customer may have an audit carried out by an independent expert bound by confidentiality, at most once a year, with at least 30 days' notice, during office hours and at the customer's expense. Bugalou has no external certifications or audit reports.

13. Liability and term

The liability provisions of the terms of service apply to this DPA. Where this DPA and the terms of service conflict on the processing of personal data, this DPA prevails. This DPA is governed by Dutch law, and disputes are submitted to the court named in the terms of service.