Data Processing Agreement

1. Parties

Controller: the business using AI 247. Processor: Support Global Goods s.r.o., ID 21983330, registered office Kojetínská 3157/55, Přerov I-Město, 750 02 Přerov.

2. Subject and duration

The subject is processing of the controller's customer personal data (name, contact, communication content, bookings) to answer customers and arrange appointments on the controller's instructions.

It lasts as long as the service is used; afterwards data are deleted or returned at the controller's choice.

3. Instructions

The processor acts only on documented instructions of the controller. Instructions include the service setup, knowledge base, reply rules and enabled channels.

The processor promptly informs the controller if it considers an instruction to conflict with law.

4. Confidentiality and authorised persons

The processor ensures that persons with access are bound by confidentiality and receive access only to the extent their role requires.

5. Technical and organisational measures

Encryption in transit and at rest, access and credential management, separation of each controller's data, backups, monitoring, patching and recovery procedures.

Measures are reviewed regularly and adjusted to the risk of the processing.

6. Sub-processors

The list of sub-processors forms part of the privacy policy. The processor informs the controller of changes, who may object on reasonable grounds.

The processor passes its own obligations to each sub-processor.

7. Assisting the controller

The processor assists the controller with data subject requests (access, rectification, erasure, restriction, portability) and with the security and notification duties under the GDPR.

8. Personal data breaches

The processor notifies a personal data breach without undue delay, and at the latest within 48 hours of becoming aware of it, stating its extent, likely consequences and the measures taken.

9. Return and deletion

After the service ends, the processor deletes or returns the data at the controller's choice within 30 days, unless law requires further retention.

10. Audits

The controller may request evidence of compliance. Audits are notified in writing and carried out in a reasonable scope, normally once every 12 months, unless there is serious suspicion.

11. Third-country transfers

For transfers outside the EU the processor uses the European Commission's standard contractual clauses or an adequacy decision, supported by the necessary safeguards.

12. Liability

The processor is liable for damage caused by breach of its processor obligations under Regulation (EU) 2016/679.