🛡️ GDPR & International Compliance: This Data Processing Agreement (DPA) establishes the framework for how SuperBots processes personal data on behalf of customers in compliance with GDPR, CCPA, Privacy Act 1988 (Australia), and other applicable data protection regulations.
1. Definitions & Scope
1.1 Key Definitions
- Controller: The customer (you) who determines the purposes and means of processing personal data
- Processor: SuperBots, who processes personal data on behalf of the Controller
- Personal Data: Any information relating to an identified or identifiable natural person
- Processing: Any operation performed on personal data, including collection, storage, use, disclosure
- Sub-processor: Third-party service providers engaged by SuperBots to assist in data processing
- Data Subject: The individual whose personal data is being processed
1.2 Scope of Agreement
This DPA applies to all personal data processed by SuperBots in connection with:
- Website chat bot interactions and customer service
- Social media messaging and engagement automation
- SMS and WhatsApp business communications
- Email marketing and automation campaigns
- Sales process automation and lead management
- Customer relationship management integrations
- Staff training and internal communication bots
- Personal assistant and productivity automation
2. Roles & Responsibilities
2.1 Controller Responsibilities (Customer)
As the Controller, you are responsible for:
- Determining the lawful basis for processing personal data
- Providing clear privacy notices to data subjects
- Obtaining necessary consents for data processing
- Ensuring data accuracy and keeping records updated
- Responding to data subject rights requests
- Conducting Data Protection Impact Assessments when required
- Notifying SuperBots of any data security incidents
2.2 Processor Responsibilities (SuperBots)
As the Processor, SuperBots is responsible for:
- Processing personal data only as instructed by the Controller
- Implementing appropriate technical and organizational security measures
- Ensuring confidentiality of personal data processing
- Assisting with data subject rights requests when possible
- Notifying Controller of data breaches within 72 hours
- Conducting regular security audits and assessments
- Deleting or returning data upon contract termination
3. Types of Personal Data Processed
3.1 Customer Contact Information
Direct customer interactions may include:
- Names, email addresses, phone numbers
- Business affiliations and job titles
- Communication preferences and history
- IP addresses and device information
- Social media profile information (when applicable)
- Purchase history and billing information
3.2 End-User Data via Bot Interactions
Through bot services, SuperBots may process:
- Chat Conversations: Message content, timestamps, user preferences
- Social Media Data: Profile information, message content, engagement metrics
- Contact Lists: Names, phone numbers, email addresses
- Behavioral Data: Interaction patterns, response times, preferences
- Transaction Data: Purchase information, booking details, payment status
- Support Tickets: Issue descriptions, resolution history, satisfaction ratings
3.3 Categories of Data Subjects
- Current and prospective customers
- Website visitors and chat users
- Social media followers and engagers
- Email subscribers and recipients
- SMS and WhatsApp message recipients
- Customer service inquirers
- Sales leads and prospects
4. Processing Activities & Legal Basis
4.1 Purposes of Processing
SuperBots processes personal data for the following purposes:
- Service Delivery: Providing AI automation services as contracted
- Customer Communication: Responding to inquiries and providing support
- Bot Training: Improving AI responses and automation quality
- Performance Analytics: Measuring and optimizing bot performance
- Platform Integration: Connecting with third-party services and APIs
- Compliance: Meeting legal and regulatory requirements
- Security: Preventing fraud, abuse, and unauthorized access
4.2 Legal Basis for Processing
Processing is based on:
- Contract Performance: Processing necessary to fulfill service agreements
- Legitimate Interests: Improving services, security, and fraud prevention
- Consent: Where explicitly obtained for specific purposes
- Legal Obligation: Compliance with applicable laws and regulations
5. Data Security Measures
🔒 Enterprise-Grade Security: SuperBots implements comprehensive technical and organizational measures to ensure appropriate security of personal data, including protection against unauthorized access, disclosure, alteration, and destruction.
5.1 Technical Safeguards
- Encryption: AES-256 encryption for data at rest and TLS 1.3 for data in transit
- Access Controls: Multi-factor authentication and role-based access permissions
- Infrastructure: SOC 2 Type II compliant cloud hosting with redundancy
- Monitoring: 24/7 security monitoring and automated threat detection
- Backup: Encrypted, geographically distributed backup systems
- Network Security: Firewalls, intrusion detection, and DDoS protection
5.2 Organizational Safeguards
- Personnel: Background checks and confidentiality agreements for all staff
- Training: Regular data protection and security awareness training
- Policies: Comprehensive data governance and security policies
- Incident Response: Documented procedures for security breach response
- Vendor Management: Due diligence and contracts for all sub-processors
- Audit: Regular internal and external security assessments
6. Sub-processors & Third Parties
6.1 Authorized Sub-processors
SuperBots may engage the following categories of sub-processors:
- Cloud Infrastructure: AWS, Google Cloud, Microsoft Azure
- Payment Processing: Stripe, PayPal (for billing purposes only)
- Communication Services: Email delivery, SMS gateways
- Analytics & Monitoring: Performance monitoring and system analytics
- Customer Support: Help desk and ticketing systems
- Platform APIs: Facebook, Instagram, WhatsApp, Twitter, LinkedIn
6.2 Sub-processor Obligations
All sub-processors are contractually bound to:
- Process personal data only as instructed by SuperBots
- Implement appropriate technical and organizational security measures
- Maintain confidentiality of all personal data
- Assist with data subject rights requests when required
- Notify SuperBots of any data security incidents
- Delete or return data upon termination of services
6.3 Changes to Sub-processors
SuperBots will:
- Notify customers of any intended changes to sub-processors
- Provide 30 days advance notice of new sub-processor appointments
- Allow customers to object to new sub-processors on reasonable grounds
- Maintain an updated list of current sub-processors
7. International Data Transfers
7.1 Transfer Mechanisms
When personal data is transferred internationally, SuperBots ensures adequate protection through:
- Adequacy Decisions: Transfers to countries with EU adequacy decisions
- Standard Contractual Clauses: EU-approved contract terms for data transfers
- Binding Corporate Rules: Internal data protection rules for multinational processing
- Certification Schemes: Participation in recognized data protection certification programs
7.2 Transfer Safeguards
Additional Protections: All international transfers include supplementary measures such as encryption, access controls, and regular audits to ensure data protection equivalent to EU standards.
8. Data Subject Rights
8.1 Rights Support
SuperBots will assist customers in fulfilling data subject rights requests, including:
- Access: Providing information about processing and copies of personal data
- Rectification: Correcting inaccurate or incomplete personal data
- Erasure: Deleting personal data when legally required
- Restriction: Limiting processing under certain circumstances
- Portability: Providing data in a structured, machine-readable format
- Objection: Stopping processing based on legitimate interests
8.2 Response Process
- Customers forward data subject requests to [email protected]
- SuperBots responds to assistance requests within 15 business days
- Technical assistance provided to locate and extract relevant data
- Final response to data subject remains customer's responsibility
9. Data Breach Notification
9.1 Incident Response
In the event of a personal data breach, SuperBots will:
- Immediate Response: Contain and assess the breach within 2 hours
- Customer Notification: Notify affected customers within 72 hours
- Detailed Report: Provide comprehensive breach details within 7 days
- Remediation: Implement measures to prevent similar incidents
- Ongoing Updates: Provide status updates throughout investigation
9.2 Breach Information
Breach notifications will include:
- Nature and category of personal data affected
- Number of data subjects and records involved
- Likely consequences of the breach
- Measures taken to address the breach
- Recommendations for customer actions
- Contact information for further details
10. Data Retention & Deletion
10.1 Retention Periods
- Active Service Period: Data retained while service agreement is active
- Post-Termination: 90-day retention period for service restoration
- Legal Requirements: Extended retention for compliance obligations
- Backup Systems: Secure deletion from all backup systems
10.2 Secure Deletion
Upon contract termination or data deletion request:
- Personal data securely deleted using industry-standard methods
- All copies removed from production and backup systems
- Certification of deletion provided upon request
- Exception only for data required for legal compliance
11. Audit & Compliance
11.1 Audit Rights
Customers may:
- Request information about SuperBots' data processing practices
- Review relevant policies and procedures
- Request third-party audit reports (subject to confidentiality)
- Conduct on-site audits in extraordinary circumstances
11.2 Compliance Monitoring
Continuous Compliance: SuperBots maintains ongoing compliance through regular internal audits, external assessments, staff training, and policy updates to ensure adherence to evolving data protection requirements.
12. Contract Termination
12.1 End of Processing
Upon termination of services:
- All processing of personal data ceases immediately
- Customer data returned in commonly used format if requested
- All personal data securely deleted within 90 days
- Deletion certification provided to customer
- Sub-processors notified and required to delete data
13. Governing Law & Disputes
This DPA is governed by:
- Primary Jurisdiction: Australian law and courts
- GDPR Compliance: EU data protection law where applicable
- Local Requirements: Applicable local data protection laws
- Dispute Resolution: Mediation preferred before litigation
14. Contact Information
Last Updated: December 6, 2025
This Data Processing Agreement forms part of the SuperBots Terms & Conditions and Privacy Policy.