Data Processing Agreement (DPA)

1. Roles

Customer — controller. XYZ Sp. z o.o. (Assist24) — processor on documented Customer instructions.

2. Scope

Support chat message text and related metadata necessary to provide the service under the agreement (Terms).

3. Obligations

Processing per documentation and Customer configuration; confidentiality; appropriate security; assistance with data subject requests and breaches — without undue delay to the Customer.

4. Subprocessors

Subprocessor list. Material list changes will be communicated to Customers.

5. Termination

Chat message rows are marked for deletion 730 days (two years) after each message is created using DynamoDB TTL. TTL deletion is asynchronous and may occur after that period. Termination does not trigger automatic immediate deletion of message rows. Conversation/inbox metadata, idempotency records, and billing records are not expired by this TTL and follow their separate lifecycles; legal obligations may require longer retention of billing records.

6. Incorporation

Using the service under the Terms incorporates this DPA unless parties agree otherwise in writing.