Data Processing Agreement

1. Parties, scope, and precedence

This DPA forms part of the service agreement between UTILHELP SOFTWARE & SOLUTIONS SRL (Agerra) and the customer accepting that agreement. It applies when Agerra processes personal data on the customer’s behalf. The customer is controller, or a processor authorized by its controller; Agerra is processor or subprocessor accordingly.

This DPA prevails over conflicting service terms for that processing. It does not cover information Agerra processes as controller for accounts, billing, security, and business administration, described in the Privacy Policy.

2. Processing particulars (Annex I)

Subject matter: hosting and operating customer-configured AI agents, knowledge retrieval, chat, lead collection, and integrations. Nature of processing: collection, storage, extraction, organization, embedding, retrieval, transmission to selected AI and tool providers, generation of responses, and deletion or return.

Purpose: providing the configured service on documented instructions. Duration: the service term and the limited period needed for return or deletion, unless law requires retention.

Data subjects: customers’ visitors, prospects, customers, staff, representatives, and individuals included in submitted sources. Data types: identifiers and contact details, messages, prompts, outputs, uploaded content, embeddings, lead fields, channel identifiers, tool payloads, and associated metadata. Frequency: ongoing or as initiated by users and jobs. Special-category and criminal-offence data are not intended for the standard service; do not submit them without a separate documented assessment and appropriate agreement.

3. Instructions and customer responsibilities

The agreement, workspace configuration, authorized user actions, and written requests document the customer’s instructions, including transfers. The customer must ensure lawful instructions, notices, consent where required, data minimization, and authority to disclose data. If acting as processor, the customer must have authorization from its controller.

Agerra will process data only on documented instructions, unless Union or Member State law requires otherwise; in that case we will inform the customer before processing unless prohibited by law. We will inform the customer immediately if, in our opinion, an instruction infringes applicable data protection law.

4. Confidentiality and security (Annex II)

Agerra will ensure authorized persons are bound by confidentiality and limit access to what is necessary. We will implement measures appropriate to risk under GDPR Article 32, taking account of the nature of processing and available technology.

Application measures include authenticated administrative access, workspace authorization checks, password hashing, encryption of stored integration and provider API credentials, and signed file access mechanisms. These do not constitute a claim that every stored object is encrypted or that the service is end-to-end encrypted. Operational controls, hosting configuration, backup arrangements, and any additional customer requirements must be documented for the applicable deployment.

5. Subprocessors

The provider register identifies service providers and distinguishes customer-selected integrations and controller services. The customer gives general written authorization for subprocessors used to process its data. Agerra will impose equivalent data protection obligations by written contract, including sufficient security guarantees, and remains responsible for their performance as required by Article 28(4).

Agerra will notify the customer of intended additions or replacements before they process customer data, allowing a reasonable opportunity to object on substantiated data protection grounds. The parties will seek an alternative; if none is reasonably available, the customer may end the affected service before the change takes effect. Publication of a vendor’s policy alone does not establish an executed processing agreement.

6. Assistance, incidents, and audits

Taking account of the processing and information available, Agerra will assist with data subject requests and obligations under GDPR Articles 32–36, including security, breach assessment, impact assessments, and supervisory-authority consultation. We will refer requests about customer data to the customer and will not independently respond except on instruction or where law requires.

Agerra will notify the customer without undue delay after becoming aware of a personal data breach affecting its data, provide available information on the nature, affected data and individuals, likely consequences, contact point, and mitigation, and provide further information as it becomes available. The controller remains responsible for its regulatory and individual notifications.

Agerra will make information necessary to demonstrate compliance available and allow and contribute to audits and inspections by the customer or its mandated auditor. Reasonable confidentiality and security arrangements may protect other customers without preventing legally required audits.

7. International transfers

Agerra will not make a restricted transfer without a lawful mechanism under GDPR Chapter V. Depending on the recipient, this may be an adequacy decision or the applicable European Commission Standard Contractual Clauses with required annexes, transfer assessment, and supplementary measures.

This page does not itself execute transfer clauses or establish a particular provider account’s region or eligibility for an adequacy framework. The parties must complete any required transfer documentation before the affected restricted processing. Contact andrei@asynnc.com for the applicable documentation.

8. Return, deletion, and contact

At the customer’s choice on termination, Agerra will return or delete personal data and delete existing copies unless Union or Member State law requires storage. Retained data remains protected and may be processed only for the legally required purpose. Backup and downstream-provider deletion timing must be addressed in the applicable deletion arrangements; cancellation alone is not a deletion instruction. Individual conversations can be manually deleted by authorized users, cascading to associated messages in the active application database. The current service has no automatic conversation expiry or configurable retention interval. Separately retained logs, backups, leads, and external deliveries require their own deletion arrangements; deleting a conversation is not a guarantee of simultaneous erasure from every system.

Send instructions, incident contacts, audit requests, and requests for return or deletion to andrei@asynnc.com, identifying the workspace and authorized contact. The parties’ details are those in the service account and applicable order; additional contracting information can be requested through that address.