Data Processing Addendum

1.Scope and definitions#

1.1This Data Processing Addendum ("DPA") forms part of the Terms of Service between Toser (operated by Stilian Genov, an individual based in Belene, Bulgaria) and the customer. It applies to personal data contained in Your Content that Toser processes on the customer's behalf ("Customer Personal Data").

1.2"Controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings given in Regulation (EU) 2016/679 (the GDPR).

1.3Annex I describes the Customer Personal Data and the processing.

1.4Toser's details: Stilian Genov, ul. Ivan Vazov 20, Belene, Bulgaria.

2.Roles#

2.1The customer is the controller of Customer Personal Data. Toser is the processor.

2.2Where Toser processes personal data for its own purposes, as set out in the Privacy Policy, Toser acts as a controller for that data. This DPA does not apply to that processing.

2.3The customer is responsible for having a lawful basis to submit Customer Personal Data to Toser, for informing the data subjects, and for the instructions it gives.

3.Processing#

3.1Toser processes Customer Personal Data only to provide Toser to the customer, as described in Annex I, for the term of the agreement and any deletion period in section 11.

4.Instructions#

4.1Toser processes Customer Personal Data only on the customer's documented instructions. The Terms of Service, this DPA and the configuration choices the customer makes in Toser, such as retention settings, are those instructions.

4.2If Toser believes an instruction infringes the GDPR, it will tell the customer without undue delay.

4.3Toser may process Customer Personal Data without those instructions only where EU or member state law requires it. Toser then tells the customer before doing so, unless the law forbids it.

5.Confidentiality#

5.1Toser ensures that the people authorised to process Customer Personal Data have committed to confidentiality, or are under an appropriate statutory duty of confidentiality.

6.Security#

6.1Toser implements the technical and organisational measures in Annex II. These take into account the nature, scope, context and purposes of processing, as Article 32 GDPR requires.

6.2Toser may update those measures, provided the update does not reduce the overall level of protection.

7.Sub-processors#

7.1The customer authorises Toser to engage the sub-processors listed in Annex III.

7.2Toser imposes data protection obligations on each sub-processor by contract. These obligations are equivalent to those in this DPA.

7.3Toser will give the customer at least 30 days' notice, by email to the Workspace owner, before adding or replacing a sub-processor. The customer may object on reasonable data protection grounds within that period. If the parties can't resolve the objection, the customer may end the affected service, as set out in the Terms of Service.

7.4Toser remains responsible to the customer for its sub-processors' performance of these obligations.

8.International transfers#

8.1Customer Personal Data in the database (Firestore) is stored in the EU. Sign-in data handled by Firebase Authentication may be processed outside the EU, and any other processing by a sub-processor outside the EU is listed in Annex III.

8.2Transfers outside the European Economic Area are made under the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, or another valid transfer mechanism.

9.Assistance#

9.1Taking into account the nature of the processing, Toser helps the customer, by appropriate technical and organisational measures, to respond to requests from data subjects under Chapter III of the GDPR.

9.2Toser helps the customer meet its obligations under Articles 32 to 36 GDPR, including security, breach notification, data protection impact assessments and prior consultation. This applies to the extent the customer needs it and Toser holds the relevant information.

10.Personal data breaches#

10.1Toser notifies the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

10.2The notice includes the information reasonably available to Toser about the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed.

11.Deletion and return#

11.1When the agreement ends, Toser deletes Customer Personal Data within 30 days, unless applicable law requires it to be kept. A Workspace whose trial ends without a plan counts as ended 30 days after the trial, and Toser deletes it automatically within 30 days after that.

11.2Backups containing Customer Personal Data are purged on a rolling basis, within 60 days.

11.3Where technically feasible, the customer may ask for the return of Customer Personal Data before it is deleted.

12.Audits and information#

12.1Toser makes available the information reasonably necessary to demonstrate compliance with this DPA. Toser allows and contributes to audits by the customer, or by an auditor the customer appoints. Audits take place once a year, on reasonable notice, during business hours, and at the customer's cost. An audit may also follow a personal data breach.

12.2Requests go through our contact page, choosing Security.

13.Liability and precedence#

13.1Liability under this DPA is subject to the limits in the Terms of Service.

13.2If this DPA conflicts with the Terms of Service on the processing of Customer Personal Data, this DPA prevails.

14.Governing law#

14.1This DPA is governed by the laws of Bulgaria, as the Terms of Service are, except where the Standard Contractual Clauses require otherwise.

14.2Disputes under this DPA are decided by the competent courts of Bulgaria, as set out in the Terms of Service, except where the Standard Contractual Clauses require otherwise.

Annex I: Processing details#

Annex II: Security measures#

• Encryption in transit: HTTPS (TLS) for all traffic, with HTTP Strict Transport Security enabled.
• Encryption at rest: AES-256, provided by Google Cloud.
• Authentication: Firebase Authentication with email and password.
• Authorisation: owner, admin and agent roles, with server-side permission checks on every request.
• Database access: client applications have no direct access. Database security rules deny client access.
• Workspace separation: data is stored per Workspace, and each request is checked against the caller's Workspace.
• Data minimisation: automatic redaction of card numbers, IBANs, email addresses and phone numbers before AI processing and storage. When question storage is off, question text is not saved.
• Retention controls: question logs are deleted automatically when they expire.
• Extension permissions: the browser extension requests only the permissions it needs. It has no content scripts. Optional site access is requested only when you first use Insert into reply on a site.
• Rate limiting: limits on answers per user and on public endpoints such as the contact form.
• Staff access: Toser has no employees. The operator is the only person with access to the production systems (Google Cloud and Firebase). Customer content is opened only to give support the customer asks for, or to investigate a security problem. Administrative actions in Google Cloud are recorded in its audit logs..

Annex III: Sub-processors#