Data Processing Agreement

1.Who is who

You, the business that uses Support Agent, are the controller: you decide why and how your customers' personal data is used. We, [Company name], [Street, postcode and city, Denmark], CVR [number], are your processor.

If you sell through a platform that offers Support Agent as a built-in feature, the platform passes your instructions on to us, and this DPA applies to the data we process for you in the same way.

2.What we process and why

We process personal data to run the service: receiving your customers' messages, working out what they ask about, looking up the orders, subscriptions or bookings they refer to, drafting replies, carrying out actions on those orders (such as a refund, a cancellation or a return), making return labels through your shipping tool, sending replies, and showing you statistics about your support. The Annex lists the people and the kinds of data involved.

We process it for as long as you use the service, and then delete it as described in section 11. We do not sell it, use it for advertising, or combine it with data from other customers.

3.Your instructions

We act only on your documented instructions. The Agreement, this DPA and the settings you choose in the service (which channels are connected, which topics are answered automatically, who on your team has access) are those instructions. If an instruction would break data protection law, we will tell you and need not follow it.

You are responsible for having a lawful basis for the processing, for telling your customers about it in your privacy notice, and for the content you connect to the service.

If the law requires us to process your data for another reason, we will tell you first, unless that law forbids it.

4.How the AI is used

Support Agent uses a language model to read incoming messages and to write reply drafts. The model receives the message and the order details needed to answer it, and nothing more.

• The model is run by Mistral AI in the EU.
• Your data is not used to train or improve any model, ours or Mistral's.
• Mistral may keep requests for a limited period to detect abuse of its service, under its own processing agreement with us, and deletes them afterwards.
• You choose per topic whether the service waits for a person on your team or handles a message on its own. When it waits, it proposes a reply and any action, such as a refund or a cancellation, and your team member decides. On topics you set to automatic, it sends the reply and carries out the action itself, within the limits you set, and only for a sender it could verify as the order's customer.

Where your customers talk to the service directly, you are responsible for telling them that replies may be written with the help of AI, as the EU AI Act requires. We help by giving you the means to do so.

5.Confidentiality and staff access

Everyone at [Company name] who can reach your data is bound by confidentiality. Our staff cannot read the contents of conversations by default. That access is turned on only to investigate a problem, and only for as long as needed.

6.Security

We protect your data with technical and organisational measures that fit the risk, including:

• Encryption in transit (TLS) for all traffic to and from the service.
• Encryption at rest (AES-256-GCM) for access tokens to the platforms you connect, such as Shopify.
• Passwords stored only as bcrypt hashes. Invitation and reset links are single-use, stored hashed, and expire.
• Sessions in secure, HTTP-only cookies.
• Access by role within your team: support users answer customers and act on their orders but cannot change settings, and can be limited to some of your stores.
• Incoming mail is accepted only when signed by our mail provider, and order details are shown only when the sender is verified.
• Rate limits on incoming mail, replies and AI use, to contain abuse.

You are responsible for the security of your own accounts, including who you invite and how they keep their passwords.

7.If something goes wrong

If we become aware of a personal data breach affecting your data, we notify you within 48 hours. We tell you what happened, which data and people are affected, the likely consequences, and what we are doing about it. If we do not know everything yet, we send what we have and follow up. Notifying you is not an admission of fault.

8.Helping you meet your obligations

We help you, as far as we reasonably can, to answer requests from people exercising their rights (access, correction, deletion and so on). If such a request reaches us directly, we pass it on to you and do not answer it ourselves unless you ask us to.

We also give you the information you need for a data protection impact assessment or a consultation with a supervisory authority.

9.Sub-processors

You give us general permission to use the sub-processors below. Each one is bound by a written agreement that protects your data at least as well as this DPA, and we remain responsible to you for their work.

When an end customer asks where a parcel is, we ask the carrier for its status. The carrier receives the tracking number only.

Platforms you connect yourself, such as Shopify, are your own providers, not our sub-processors. We read from them because you told us to.

So is the shipping tool you connect for return labels, and the carriers it books with. When you send a reply with a return label, we send the customer's name and address, the order number and the parcel's weight, and, if you chose a QR code instead of a printed label, the customer's email address, so the tool can send the code to your own account there, under your agreement with it, and keep no copy of the address. The tools you can connect:

Before we add or replace a sub-processor, we email your admins at least 30 days ahead. If you object on reasonable data protection grounds, we will try to find a solution with you. If we cannot, you may end the affected part of the service, and we refund any prepaid fees for it.

10.Transfers outside the EEA

We store your data in the EU. Where a sub-processor processes it outside the EEA, as our mail provider does in the USA, we rely on the European Commission's Standard Contractual Clauses, or on the EU-U.S. Data Privacy Framework where the provider is certified, together with any further safeguards needed.

11.Retention and deletion

What the AI wrote and what was sent are deleted after at most 180 days. You can delete individual data in the service, and we delete what you ask us to within 30 days.

When you close your account, we delete your data within 30 days, unless the law requires us to keep it. Ask us before then if you want a copy.

12.Audits

We give you the information you need to see that we meet this DPA. Usually our written answers to your questions are enough. If they are not, or a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit us, at most once a year, with 30 days' notice, during business hours and at your own cost.

13.General terms

This DPA lasts as long as we process personal data for you. Liability under it follows the Agreement, except where data protection law does not allow that. It is governed by Danish law, and disputes go to the Danish courts.

We may update this DPA to follow the law or changes to the service. We tell you about material changes 30 days ahead. If a part of it turns out to be invalid, the rest still applies.

Questions about this DPA or about privacy: [privacy@domain].