Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of and is incorporated into the Terms of Service or other written agreement (the “Agreement”) between Encore Interactive Inc. (“Encore Interactive”, “Processor”, “we”, or “us”) and the customer identified in the Agreement (“Customer” or “Controller”), and governs the processing of Personal Data by Encore Interactive on the Customer’s behalf in connection with the ChatOpsPro service (the “Service”). In the event of a conflict between this DPA and the Agreement with respect to the processing of Personal Data, this DPA prevails.

1. Definitions

Capitalized terms not defined here have the meaning given in the Agreement. “Personal Data”, “Controller”, “Processor”, “Sub-processor”, “Data Subject”, “Processing”, and “Personal Data Breach” have the meanings given in applicable Data Protection Law. “Data Protection Law” means all laws applicable to the processing of Personal Data under the Agreement, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, the EU General Data Protection Regulation 2016/679 (“GDPR”), and applicable U.S. state privacy laws including the California Consumer Privacy Act as amended (“CCPA/CPRA”). The UK GDPR is not included: as set out in Section 12, the Service is not offered to individuals in the United Kingdom and Encore Interactive does not undertake to comply with the UK GDPR. “Customer Personal Data” means Personal Data that Encore Interactive processes on the Customer’s behalf under the Agreement.

2. Roles & scope of processing

As between the parties, the Customer is the Controller (or, where the Customer is itself a processor for another controller, the processor) and Encore Interactive is the Processor (or sub-processor) of Customer Personal Data. Under the CCPA/CPRA, Encore Interactive acts as a “service provider” and does not sell or share Customer Personal Data and does not retain, use, or disclose it for any purpose other than performing the Service. The subject matter, duration, nature and purpose of the processing, the types of Personal Data, and the categories of Data Subjects are described in Annex I.

3. Processing on documented instructions

Encore Interactive will process Customer Personal Data only on the Customer’s documented instructions, including as set out in the Agreement, this DPA, and the Customer’s configuration and use of the Service, unless required to process by law (in which case, where permitted, we will inform the Customer of that legal requirement). The Customer is responsible for the accuracy and lawfulness of its instructions and for having a lawful basis to submit Customer Personal Data to the Service and to have it processed as described here. The Customer must not submit special-category or other highly sensitive data except as expressly supported by the Service and configured by the Customer.

4. Confidentiality

Encore Interactive ensures that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and are informed of the confidential nature of the data. Access is limited on a need-to-know basis.

5. Security measures

Encore Interactive implements and maintains appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. The current measures are described in Annex II. We may update them provided the level of protection is not materially decreased.

6. Sub-processors

The Customer provides a general authorization for Encore Interactive to engage the Sub-processors listed in Annex III, Part A, and to engage additional Sub-processors to perform the Service. Encore Interactive imposes on each Sub-processor data-protection obligations substantially equivalent to those in this DPA and remains responsible for each Sub-processor’s performance. We will make the current Sub-processor list available (including on this page) and provide notice of the addition or replacement of a Sub-processor before that Sub-processor begins processing Customer Personal Data, giving the Customer the opportunity to object on reasonable data-protection grounds. If the parties cannot resolve a reasonable objection, the Customer may terminate the affected Service as its sole remedy.

Destinations the Customer chooses. Separately from our Sub-processors, the Service can send Customer Personal Data to third-party systems that the Customer itself connects and authorizes — for example its own CRM, marketing, spreadsheet, calendar, appointment-booking, e-commerce, knowledge, or webhook endpoint. Those transfers are made on the Customer’s instruction, and the receiving provider processes the data under the Customer’s own agreement with that provider rather than as our Sub-processor. Annex III, Part B lists the integrations available for the Customer’s information; the Customer is responsible for the lawfulness of any integration it enables. For the avoidance of doubt, we apply the same advance-notice practice described above when we add a provider to either Part of Annex III.

7. International data transfers

Customer Personal Data is hosted in Canada (AWS ca-central-1 region). Certain Sub-processors may process limited Personal Data outside Canada, including in the United States (see Annex III). Where Personal Data protected by the GDPR is transferred to a country that has not received an adequacy decision, the parties rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses (SCCs) (Module Two, controller-to-processor, and Module Three, processor-to-processor, as applicable), together with supplementary measures where required. Canada benefits from a partial EU adequacy decision for data subject to PIPEDA. By entering into this DPA, the parties are deemed to have signed the SCCs where they apply, with the data-exporter and data-importer roles completed according to the roles in Section 2, and the Annexes of this DPA populating the corresponding SCC appendices. The Customer may request a copy of the executed transfer mechanism.

8. Assistance to the Controller

Taking into account the nature of the processing, Encore Interactive will assist the Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling the Customer’s obligations to respond to requests from Data Subjects exercising their rights (access, rectification, erasure, restriction, portability, and objection). The Service also provides self-service tools (including conversation export and deletion, and — where enabled — automatic redaction) that the Customer can use to respond to such requests directly. Encore Interactive will further assist the Customer, taking into account the information available to us, with data-security obligations, Personal Data Breach notifications, data protection impact assessments, and prior consultations with supervisory authorities.

9. Personal data breach

Encore Interactive will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide the Customer with information reasonably available to us to help the Customer meet its own breach-notification obligations. Our notification is not an acknowledgement of fault or liability.

10. Return & deletion of data

Customer Personal Data is retained according to the Customer’s configuration (including the retention period set in the dashboard) and the status of the Customer’s account. Upon termination or expiry of the Service, and at the Customer’s choice, Encore Interactive will delete or return Customer Personal Data and delete existing copies, unless retention is required by law. Backups are deleted in the ordinary course of our backup rotation.

11. Audits & records

Encore Interactive will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates. Audits are subject to reasonable notice, confidentiality obligations, and frequency limits, and must not compromise the security of other customers’ data. In the first instance, we may satisfy an audit request by providing relevant documentation, security summaries, or third-party reports where available.

12. EU representative & United Kingdom scope

United Kingdom. The Service is not offered to, marketed to, or targeted at individuals or businesses in the United Kingdom. Encore Interactive does not claim compliance with the UK GDPR and has not appointed a representative under Article 27 of the UK GDPR. Accordingly, the Customer must not use the Service to process Personal Data of data subjects in the United Kingdom, and must not represent to its own end users that the Service is UK GDPR compliant. If the Customer requires UK coverage, it must contact us before submitting such Personal Data; we may decline, and any resulting non-compliance arising from the Customer’s use in breach of this Section is the Customer’s responsibility.

13. Liability & governing law

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement. This DPA is governed by the laws of the Province of New Brunswick and the federal laws of Canada applicable therein, except that, where the SCCs apply, they are governed by the law specified in the SCCs. Where a court or supervisory authority requires that the SCCs be governed by the law of an EU member state or that disputes be resolved in a particular forum, that requirement prevails for the SCCs only.

Annex I — Details of processing

Annex II — Technical & organizational measures

• Encryption in transit: TLS for all external connections, and authenticated, in-transit-encrypted connections to internal data services within our private network.
• Encryption at rest: the production database (including its automated backups and snapshots), the object-storage bucket holding uploaded files, and the disk volumes of every server instance are encrypted at rest.
• Access control on a least-privilege, need-to-know basis; per-tenant data isolation; authenticated APIs with tenant-scoped authorization; private subnets with no public database access.
• Operator account security: optional two-factor authentication (TOTP) and passkey (WebAuthn) sign-in, which a Customer may require across its workspace; device-scoped pairing for the operator mobile app.
• Optional data minimization: automatic redaction of identifiers before AI processing and/or before storage, configurable per tenant.
• Network protections: server-side request-forgery guards on outbound fetch/crawl, restriction to public destinations, and scheme restrictions.
• Abuse & integrity controls: per-IP and per-tenant rate limiting, CAPTCHA on signup, email verification, domain-ownership verification, widget origin allowlisting, IP blocking, and per-tenant usage quotas.
• Retention controls: per-tenant configurable retention with automated age-based purging; self-service conversation export and deletion; automatic pruning of visitor browsing records after 90 days.
• Diagnostic logging: a small random sample of AI requests and responses may be written to our cloud provider’s log service for fault diagnosis and complexity analysis, retained for 30 days and then deleted automatically. It is disabled by default and is never applied to tenants with a redaction or healthcare privacy profile.
• Resilience: managed cloud infrastructure with encrypted, rotated backups.
• Personnel: confidentiality obligations and access limited to authorized personnel.

Annex III — Sub-processors & Customer-authorized destinations

Part A — Sub-processors engaged by Encore Interactive

The following Sub-processors may process Customer Personal Data to provide the Service, under Section 6. Providers marked “when enabled” process data only for Customers who connect that channel or feature. Some third parties (for example messaging platforms and the payment processor) may also act as independent controllers for their own purposes under their own terms.

Workspace-specific AI provider. Where the parties have agreed in writing that a Customer workspace is served by a different AI provider, that provider replaces OpenAI as the Sub-processor for that workspace’s conversation content, and its legal entity and processing region are recorded against the workspace and made available to the Customer. The advance-notice practice in Section 6 applies to that engagement. Knowledge-base indexing and search move to that provider only once the workspace’s knowledge base has been rebuilt using that provider’s model; until then OpenAI continues to process the text of visitor questions for that purpose. The voice assistant is not available to a workspace that requires all processing outside the United States.

Part B — Destinations the Customer connects

Where the Customer enables one of the following integrations, the Service exchanges Customer Personal Data with it on the Customer’s instruction. The Customer’s own account and agreement with that provider governs the provider’s processing; it does not act as our Sub-processor (see Section 6). The Customer is responsible for the lawfulness of each integration it enables.