Data Processing Agreement

This Data Processing Agreement (the “agreement”) is made between the person or organisation that is party to the Terms of Service (“you”), and Vlas Dmitrenko PR IT usluge TruSend Beograd (Savski Venac) (“TruSend”, “we”, “us”). It governs our processing of personal data on your behalf in providing the TruSend platform (the “platform”), as described in section 3. It is made under article 28 of Regulation (EU) 2016/679 (the “GDPR”) and the Law on Personal Data Protection of the Republic of Serbia.

1. Scope and effect

This agreement forms part of the Terms of Service (the “Terms”) and takes effect when you create a workspace. It is concluded electronically and is binding without a signature.

Where it conflicts with the Terms, this agreement prevails on anything concerning personal data. Where it conflicts with the Standard Contractual Clauses described in section 6, those clauses prevail.

2. Roles of the parties

For the personal data described in section 3 that we process on your behalf in providing the platform (“your data”), you are the controller and we are the processor. You determine the purposes and means of that processing; we process that data on your behalf and only on your instructions. Where you process that data as a processor on behalf of another controller, we act as your subprocessor, this agreement applies accordingly, and Module Three (processor to processor) of the Standard Contractual Clauses applies in place of Module Two.

For your own account, workspace configuration and billing, we are the controller. That processing is described in our Privacy Policy and is not governed by this agreement.

3. Details of the processing

• Subject matter and purpose — operating the platform for you: receiving, storing, routing, searching, translating and answering conversations across the channels you connect, producing AI replies grounded in your knowledge base, and showing you analytics.
• Nature of the processing — collection, recording, organisation, structuring, storage, retrieval, consultation, use (including generation of AI replies, translations and summaries), transmission to the subprocessors listed in Annex III, disclosure to the recipients you configure, erasure and destruction.
• Categories of data subjects — your customers and prospective customers who contact you; visitors to websites on which you install the chat widget; other individuals whose personal data is included in conversations or in your knowledge base; and your own staff who use the workspace, to the extent their personal data forms part of workspace content, such as messages they write and conversations assigned to them.
• Types of personal data — message content and attachments; contact identifiers such as name, email address, phone number and channel handle; contact attributes, tags and notes recorded in the workspace; conversation and delivery metadata; content you upload to your knowledge base; identifiers set by the chat widget, and the IP address and browser and device information of visitors who use it; customer and order data from Shopify and, from the TruSend WordPress plugin, the page on which a chat is opened and the visitor’s user role on the site, where you connect those integrations; records of consent choices made through the chat widget (the choice, its source, a checksum of the banner text shown, its time and the widget’s visitor identifier).
• Special categories — the platform is not intended for the processing of special categories of personal data, and you should not configure it to collect them. Where data subjects include such data in a conversation, it is processed as part of the message content in accordance with this agreement and is protected by the measures in Annex II.
• Duration — for as long as your workspace exists, and then as section 4.7 sets out.

4. Our obligations as processor

4.1 Documented instructions

We process your data only on your documented instructions, including with regard to transfers of personal data to a third country or an international organisation. Your instructions are the Terms, this agreement, and the configuration you set in your workspace. We will immediately inform you if, in our opinion, an instruction infringes the GDPR or other applicable data protection law, and we may suspend that instruction until the matter is resolved with you.

If a law to which we are subject requires us to process your data other than on your instructions, including to transfer it, we will inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.2 Confidentiality

We ensure that persons authorised to process your data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process it only on your instructions, unless Union or Member State law, or the law of the Republic of Serbia, requires them to do otherwise.

4.3 Security of processing

We implement the technical and organisational measures required by article 32 GDPR, described in Annex II. We may update them, provided the overall level of protection is not materially reduced.

4.4 Subprocessors

You give us general written authorisation to engage subprocessors. The current list is published at trusend.ai/subprocessors. Before a new subprocessor starts processing your data, we will update that page and notify the owners of your workspace by email at least 20 days in advance, giving you the opportunity to object to the change.

If you object on reasonable data protection grounds within that period, we will work with you in good faith to find an alternative. If we do not agree one within a reasonable time, you may terminate the affected subscription by notice to us.

We impose on each subprocessor, by written contract, data protection obligations no less protective than those in this agreement, in particular sufficient guarantees to implement appropriate technical and organisational measures. Where a subprocessor fails to fulfil its data protection obligations, we remain fully liable to you for the performance of that subprocessor’s obligations.

4.5 Data subject requests

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as this is possible, in responding to requests from data subjects to exercise their rights under chapter III GDPR, including access, rectification, erasure, restriction, portability and objection. The workspace provides search, deletion and CSV export of contacts and companies for this purpose at no extra charge; further assistance is provided at your reasonable cost. If a data subject contacts us directly about your data, we tell you without undue delay where we can identify you, and we do not respond ourselves other than to direct the data subject to you, unless you authorise us to.

4.6 Personal data breach notification

We notify you of a personal data breach affecting your data without undue delay after becoming aware of it.

The notification will describe, to the extent known: the nature of the breach, including where possible the categories and approximate number of data subjects and personal data records concerned; the name and contact details of our contact point from whom more information can be obtained; the likely consequences of the breach; and the measures taken or proposed to be taken to address it, including, where appropriate, measures to mitigate its possible adverse effects. Where it is not possible to provide all of this information at the same time, we will provide it in phases without undue further delay. Taking into account the nature of the processing and the information available to us, we assist you in ensuring compliance with your obligations under articles 32 to 36 GDPR by providing that information. Assistance with data protection impact assessments and prior consultation with the supervisory authority, beyond that information, is provided at your reasonable cost.

Unsuccessful attempts and activities that do not compromise the security of your data, such as pings, port scans, failed log-in attempts and denial-of-service attacks that do not cause loss of, or loss of access to, your data, are not personal data breaches. Notifying you of a breach is not an acknowledgement of fault or liability.

4.7 Deletion and return

Workspace owners and administrators can export contacts and companies at any time, in CSV format, using the export functions in the workspace. When the provision of the platform to you ends, we will, at your choice, delete or return your data; the Switching providers (EU Data Act) section of the Terms of Service describes how data is returned when you move to another provider. A deleted workspace and the files stored with it are deleted from production systems 30 days after the workspace is deleted, a period during which it can be restored, and from database recovery history within a further 7 days. Apart from our database provider’s own encrypted backups, which expire within 30 days, operational logs and error reports, which expire within 90 days of being recorded, and correspondence and records of data protection requests, which are kept for the periods stated in our Privacy Policy, we then retain no copies of your data unless Union or Member State law, or the law of the Republic of Serbia, requires storage of the personal data.

4.8 Information and audits

We make available to you all information necessary to demonstrate compliance with the obligations laid down in article 28 GDPR.

You agree to exercise your audit right first by reviewing the information we make available. Where that information is not sufficient to demonstrate compliance, you may audit us, or have us audited, once in any twelve months, or more often where there are indications of non-compliance or a supervisory authority requires it, on 30 days’ written notice and at your cost, including our reasonable costs of supporting the audit. The audit is carried out remotely by default, through documents and interviews, by you or by an independent auditor bound to confidentiality who is not our competitor. It does not include access to production systems, to conversation content, or to other customers’ data.

5. Your obligations as controller

• You have a lawful basis for the personal data you put into the platform, and you have provided data subjects with the information required by articles 13 and 14 GDPR and, where applicable, the Serbian Law on Personal Data Protection.
• Your instructions are lawful. You are responsible for the accuracy of the data you upload and for the configuration you set, including retention settings and the channels you connect.
• You manage your own seats: who you invite, what role they get, and removing them when they leave.
• You are responsible for the information and any consent required on your websites for the storage the chat widget uses on visitors’ devices, and for configuring the widget’s consent settings accordingly.

6. International transfers

We are established in the Republic of Serbia, for which there is no European Commission adequacy decision, and some of the subprocessors listed in Annex III process personal data outside the EEA. Where the GDPR applies to your use of TruSend, the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “Standard Contractual Clauses”), Module Two (controller to processor), are incorporated into this agreement, with you as data exporter and us as data importer. For Module Two, and for Module Three where it applies under section 2, they are completed as follows:

• Clause 7 — the optional docking clause applies.
• Clause 9(a) — Option 2 (general written authorisation) applies, and the time period for prior notice of an intended change of subprocessors is 20 days, as set out in section 4.4. Where Module Three applies, we give that notice to you, and you pass it on to your controller.
• Clause 11(a) — the optional wording does not apply.
• Clause 13 — the competent supervisory authority is as set out in Annex I.
• Clause 17 — Option 2 applies, and the Member State referred to in it is Ireland. Where you are not established in an EU Member State, Option 1 applies and the Standard Contractual Clauses are governed by the law of Ireland.
• Clause 18(b) — disputes are resolved by the courts of the EU Member State whose law governs under Clause 17.
• Annexes — Annexes I to III of the Standard Contractual Clauses are completed by the annexes to this agreement.

The Standard Contractual Clauses prevail over this agreement in case of conflict.

Where the Law on Personal Data Protection of the Republic of Serbia applies, transfers to subprocessors in countries on the Government of Serbia’s list of countries ensuring an adequate level of protection under article 64 of that law, which includes the EEA states and the United Kingdom, rely on that list. Transfers to other countries are made under the contractual clauses in each subprocessor’s data processing agreement, as stated for each provider on the subprocessors page.

Onward transfers to subprocessors outside the EEA are made under standard contractual clauses adopted by the European Commission or on the basis of an adequacy decision, as recorded for each provider on the subprocessors page. On request, we will enter into the UK International Data Transfer Addendum to the Standard Contractual Clauses or the amendments to the Standard Contractual Clauses required for transfers subject to the Swiss Federal Act on Data Protection.

7. AI processing

AI features, including replies, the AI assistant for your team, translation, conversation summaries, and the indexing, search and reranking of your knowledge base, use models accessed through OpenRouter, the routing provider listed in Annex III. Our OpenRouter account is configured to route requests only to the upstream providers named for it on the subprocessors page, in the regions stated there. Those providers act as OpenRouter’s subprocessors under its data processing agreement.

We do not use your data to train AI models, and our OpenRouter account allows only providers that do not train models on the content they are sent. Email addresses, phone numbers, card numbers and IP addresses detected in content sent to AI models are removed before it is sent. Contact details that your workspace publishes for customers in its knowledge base are not removed.

Images that your customers send in conversations answered by AI replies are sent to an AI model as they are, once per image, to produce a text description of what they show. The removal described above does not apply to the image itself. The description is stored with the image and deleted together with it, and the reply and the knowledge base search use the description instead of the image; the removal described above applies to the description as to other text.

Voice and audio messages that your customers send in conversations answered by AI replies are sent to a speech recognition model as they are, once per message, to produce a text transcript. Only providers that do not retain the content of the request are used for this. The removal described above does not apply to the recording itself. The transcript is stored with the recording and deleted together with it, and the reply, the knowledge base search and the rules that hand conversations over to your staff use the transcript instead of the recording; the removal described above applies to the transcript as to other text.

Videos that your customers send in conversations answered by AI replies are sent to an AI model as they are, once per video and only up to a fixed length, to produce a text description of what is shown and a transcript of what is said; the model is instructed not to describe people’s appearance. Only providers that do not retain the content of the request are used for this. The removal described above does not apply to the video itself. The description is stored with the video and deleted together with it, and the reply, the knowledge base search and the rules that hand conversations over to your staff use the description instead of the video; the removal described above applies to the description as to other text.

Documents that your customers send in conversations answered by AI replies (PDF, Word, Excel, plain-text and CSV files) are read on our servers, once per document, to extract their text; the file itself is not sent to anyone. A PDF document that contains no text, such as a scanned page, is instead sent to an AI model as it is, once per document and only its first pages, to recognize its text. Only providers that do not retain the content of the request are used for this, and the removal described above does not apply to the document itself. The extracted or recognized text, up to a fixed length, is stored with the document and deleted together with it, and the reply and the knowledge base search use it as part of the customer’s message; the removal described above applies to it as to other text.

The AI features are designed to answer support questions and to hand conversations over to your staff. They are not designed to make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them. Whether article 22 GDPR applies to your use of the AI features depends on how you configure and use them.

8. Liability, term and governing law

This agreement lasts as long as we process data on your behalf. Claims under or in connection with this agreement are subject to the exclusions and limitations of liability in the Terms. Nothing in this agreement restricts or limits the rights of any data subject or of any competent supervisory authority.

It is governed by the law of the Republic of Serbia, except that the Standard Contractual Clauses are governed by the law, and disputes arising from them are resolved by the courts, specified in section 6. It is made in English; a translation is for convenience only.

Annex I — Description of the processing

Parties. You, as data exporter and controller (or, where Module Three applies under section 2, processor), identified by the workspace you created, the account details of its owners and, for a paid subscription, the billing details held by Paddle, our merchant of record. Us, as data importer and processor (or, where Module Three applies, subprocessor): Vlas Dmitrenko PR IT usluge TruSend Beograd (Savski Venac), Bulevar Vudroa Vilsona 8v, 11000 Beograd (Savski Venac), Republic of Serbia — registration number 68677424, PIB 115837343. Contact: privacy@trusend.ai. Our representative in the European Union under article 27 GDPR, and our supervisory authority in the Republic of Serbia, are named on the company details page. Activities relevant to the data transferred: provision of the platform as described in section 3. Signature and date: the parties’ acceptance of the Terms of Service when you create a workspace is their signature of this agreement and of the Standard Contractual Clauses incorporated in it, dated the day the workspace is created.

Description. Categories of data subjects, types of personal data, special categories, and the nature, purpose and duration of the processing are set out in section 3. The transfer is continuous for as long as the workspace exists. Retention and deletion are as set out in section 4.7. Transfers to subprocessors are for the purposes and in the locations stated for each provider on the subprocessors page, for the duration set out in section 3.

Competent supervisory authority for the Standard Contractual Clauses (Clause 13): where you are established in an EU Member State, the supervisory authority responsible for ensuring your compliance with the GDPR as regards the data transfer; where you are not established in an EU Member State but fall within article 3(2) GDPR and have appointed a representative under article 27(1), the supervisory authority of the Member State in which your representative is established; and where you are not established in an EU Member State, fall within article 3(2) GDPR and are not required to appoint a representative under article 27(2), the supervisory authority of one of the Member States in which the data subjects whose personal data is transferred are located.

Annex II — Technical and organisational measures

• Encryption in transit: TLS on public connections and on connections to the database, and encrypted tunnels between our own servers. Encryption at rest: the database, its backups and stored files are encrypted by their providers, and data held on our servers is stored on encrypted volumes whose keys are not stored on the server that holds them.
• Unsent drafts sealed in the browser with an AES-256-GCM key issued by our server.
• Tenant isolation in the application: the organisation is derived from the authenticated connection, not from request parameters, and data queries are scoped to that organisation.
• Access to production systems restricted to a limited number of authorised persons bound by confidentiality; role-based, least-privilege access checked on the server; security-relevant defaults enforced on the server; two-step authentication for our staff on provider accounts; a password policy for product accounts.
• API keys masked and rotatable.
• Audit logging of settings, account and AI configuration changes with before and after values, retained 90 days; changes to contact retention policies and legal holds, 7 years. Staff logins to our servers and database sessions opened through our operations tooling are logged against the individual.
• Service and security logs record the IP address of each request and are kept for 14 days. Request bodies are not written to logs, and email addresses are masked before logs are sent to Grafana Labs, our operational monitoring provider.
• Redaction of email addresses, phone numbers, card numbers and IP addresses detected in text sent to AI models, as described in section 7; detection of payment card numbers and certain other identification numbers in replies before they are sent, with the check repeated on the server.
• Point-in-time recovery and daily snapshots kept for 7 days, and our database provider’s own encrypted backups kept for 30 days; a documented incident response procedure designed to meet the notification commitment in section 4.6.
• Assistance to you: the export, search and deletion functions in the workspace and the assistance described in sections 4.5 and 4.6.

Annex III — Subprocessors

The list of subprocessors that process personal data under this agreement, with the services each provides and where processing takes place, is published at trusend.ai/subprocessors and forms part of this agreement. As at the date of this version, they are: Hetzner Online GmbH, Databricks, Inc. (Neon), Cloudflare, Inc., Functional Software, Inc. (Sentry), Raintank Inc. (Grafana Labs), Lettermint B.V., Google Cloud EMEA Limited (Google Workspace), OpenRouter, Inc..