Data Processing Agreement for ChatReact

Version: 2026-11-04 · including Annexes 1 to 3

1. Parties and conclusion

This agreement under Article 28(3) GDPR is between the customer identified in the ChatReact company profile (Customer) and AdSimple GmbH, Fabriksgasse 20, 2230 Gänserndorf, Austria, company register FN 64500 d, Regional Court of Korneuburg (Processor). The Processor's privacy contact is [email protected]. The Customer's contact is the authorised company account owner at their verified account email address. The Customer keeps its company and contact details current.

This DPA forms part of the ChatReact Terms of Service. New customers first verify their email address using the link sent to them. They then accept this DPA by expressly accepting the Terms including this DPA in the first onboarding step, completing registration. Only then is the user account created and access enabled. It is assigned to the company that the accepting person creates under their authority to represent that company. Existing companies conclude it by explicit acceptance on the company page in the dashboard. The accepting person represents that they have authority to bind the Customer. The company assignment, version, contract text and electronic acceptance record are available in the dashboard. No handwritten signature is required.

If the Customer is itself a processor, this agreement applies as a sub-processing agreement. The Customer must have the necessary authorisation from its controller and lawfully relay that controller's instructions. Creating a company profile does not allow an agency to bind an unrelated third party without authority.

2. Subject matter, scope and duration

The subject matter is the provision of the ChatReact functions activated by the Customer for processing business knowledge, communications and enquiries. Annex 1 describes the nature, purposes, data and data subjects. This agreement applies for the duration of the commissioned processing and for as long as AdSimple continues to hold data on behalf of the Customer.

The Customer determines purposes, lawful bases, content, activated functions, recipients and appropriate retention periods. AdSimple processes these data solely to provide the agreed services and on documented instructions. AdSimple's own processing, including contract administration, billing and legally required records, is described in the privacy policy and is outside this processing agreement.

3. Instructions and Customer obligations

Instructions arise from this agreement, the use and configuration of functions, and supplementary documented instructions by an authorised person. Supplementary instructions may be sent to [email protected]. AdSimple documents them and confirms material changes. Where instructions require additional services, the parties agree their implementation without limiting statutory obligations.

AdSimple promptly informs the Customer if it considers an instruction contrary to data protection law and suspends the affected processing until it is lawfully resolved. AdSimple informs the Customer in advance of processing required by law outside the instructions, unless the law prohibits doing so.

The Customer ensures lawful collection and disclosure, informs data subjects and obtains required consents. It limits inputs, knowledge sources, access rights and email recipients to what is necessary. It remains responsible for its website, integration through a consent manager and connected systems. This DPA does not replace a lawful basis or privacy information for data subjects.

4. Confidentiality and security

AdSimple binds persons authorised to process data to confidentiality unless they are already subject to an appropriate statutory duty, and limits their access to what their work requires. Confidentiality survives the end of their work.

AdSimple implements the technical and organisational measures required by Article 32 GDPR. Annex 2 sets out the agreed measures. AdSimple appropriately reviews their effectiveness and develops them in light of risk, the state of the art and implementation costs. Changes must not reduce the agreed level of protection. Material changes are documented and explained on request.

5. Assistance and personal data breaches

Taking account of the nature of processing and information available, AdSimple assists the Customer with Chapter III data subject rights and Articles 32 to 36 GDPR, including security, notifications, data protection impact assessments and prior consultation. Requests received directly from data subjects are promptly forwarded to the Customer; substantive responses are made only on its instructions or where legally required.

AdSimple notifies the Customer without undue delay after becoming aware of a personal data breach affecting data processed on its behalf. To the extent available, the notification describes its nature and scope, affected data and data subjects, likely consequences, a contact person and measures taken or proposed. Missing information is supplied without undue delay. AdSimple documents the incident and assists with mitigation. The Customer decides on notifications to supervisory authorities and data subjects, except where AdSimple has its own legal obligation.

6. Sub-processors

The Customer grants general authorisation for the sub-processors in Annex 3 for the stated purposes and activated functions. Listing a conditional provider does not mean it receives every conversation. AdSimple enters into agreements imposing substantially the same data protection obligations on appointed sub-processors and remains responsible to the Customer for their performance.

AdSimple gives the Customer written notice at least 30 days before adding or replacing a sub-processor, including its tasks, location and any international transfers. The Customer may object on substantiated data protection grounds within that period. The parties seek a suitable alternative. Affected data are not transferred to the disputed new provider before resolution. If no suitable solution is possible, the Customer may terminate the affected service before the change. Merely changing a website does not replace individual notice.

On request, AdSimple supplies necessary information and a copy of the relevant sub-processing agreement. Protected business secrets and third-party personal data may be redacted insofar as this does not prevent demonstration of compliance.

7. Processing locations and international transfers

Primary application and database storage are configured in Frankfurt. This does not promise exclusively European processing: AI providers, global delivery networks, support and other sub-processors may process data outside the EU/EEA. Annex 3 identifies the affected providers.

International transfers may take place only on documented instructions and in compliance with Chapter V GDPR. Before use, AdSimple verifies and documents the applicable basis: an applicable adequacy decision or appropriate safeguards, notably the European Commission's standard contractual clauses for international transfers, with necessary assessments and supplementary measures. Reliance on the EU-U.S. Data Privacy Framework requires an actual, applicable certification of the recipient. A provider's registered office or data centre region alone does not establish a transfer basis. Evidence is available on request. This DPA is not itself an international transfer instrument.

8. Evidence, audits and cooperation

AdSimple supplies information necessary to demonstrate compliance with Article 28 GDPR and allows appropriate audits, including inspections, by the Customer or a confidentiality-bound auditor. Audits are generally coordinated with reasonable notice and protect other customers' data. Audits prompted by concrete signs of non-compliance or authority requirements remain possible. Reports or certificates may be considered but do not replace the statutory audit right.

AdSimple maintains the required documentation, cooperates with the competent supervisory authority and informs the Customer of authority measures affecting its processing data where disclosure is permitted.

9. Return, deletion and termination

During use, conversations remain stored until deleted under a lawful instruction or with the associated chatbot or account. The service currently does not include automatic or dashboard-configurable retention periods for chat histories. Individual access, export and deletion instructions are coordinated through [email protected]. The Customer determines an appropriate period for its purposes and provides necessary instructions.

After the services end, at the Customer's choice, AdSimple returns the personal data processed on its behalf in a commonly used electronic format and deletes them, or deletes them without prior return. The Customer should request any return before final deletion. AdSimple completes deletion, including existing copies, without undue delay and no later than 30 days after completion of the return or receipt of the deletion instruction on termination, and confirms this on request. Legally required retention is excepted; such data are restricted and processed only for that statutory purpose. AdSimple communicates the legal basis and duration where permitted.

Deletion covers related stored conversations, analyses, delivery copies held by appointed providers, and processing data in files and vector stores. Restoring backups must not reintroduce previously deleted processing data into regular operations. The Customer deletes copies in its own or its recipients' mailboxes and systems. AdSimple's lawfully retained contract and acceptance records are handled separately from content data.

10. Precedence and changes

For conflicts concerning personal data processed on behalf of the Customer, this DPA and its annexes prevail over the Terms of Service. Statutory liability and data subject rights remain unaffected. Amendments require a documented agreement; publishing a new version does not retroactively amend an existing contract. Section 6 applies to sub-processor changes. The German version prevails; this English version is provided for accessibility.

Annex 1: Description of processing

Purposes and operations: Receiving, storing, structuring, searching, AI-assisted responding, translating, quality evaluation, making available, transmitting and deleting data to handle business enquiries. Processing occurs continuously during use and during imports or analyses requested by the Customer.

Special data: The standard service is intended for business communication. Deliberate processing of Article 9 special categories, Article 10 data or patient data subject to professional secrecy is not commissioned without a separate documented agreement on lawful basis, purpose and additional safeguards. A B2B purpose statement does not technically prevent accidental sensitive inputs. On instructions, such inputs must promptly be restricted or deleted; AdSimple does not use them for additional purposes.

AI use: Processing content must not be used to train general-purpose models for AdSimple's or providers' own purposes. AdSimple uses corresponding API contractual terms and settings. This obligation does not imply zero retention by AI providers or guarantee correct or anonymised answers. Provider security logs, stored API responses and vector stores must be included in deletion and transfer arrangements.

Annex 2: Technical and organisational measures

These measures do not constitute certification, a guaranteed recovery time or end-to-end encryption of chat emails. The Customer protects its accounts, devices, recipient mailboxes and connected systems and grants only necessary permissions.

Annex 3: Sub-processors and processing chain

The list covers providers envisaged for the described services. Actual use depends on function and platform configuration. AdSimple supplies the currently appointed providers and transfer evidence on request. General authorisation does not remove the obligation to verify contracts, processing locations and transfer bases before use.

Mailaura is a service of the same AdSimple GmbH and is therefore not an additional contracting party in the processing chain. Its underlying delivery and infrastructure services, notably AWS SES, remain covered as sub-processing.

The Microsoft 365 mailbox provider and Customer-designated webhook destinations, recipient mailboxes and integrations are governed by the Customer's own contractual relationships. AdSimple processes the data accessible through those connections under this DPA. Services used for AdSimple's own billing and advertising do not become sub-processors of chat content through those own-purpose uses.