Legal

Data Processing Agreement

Version 1.0 · GDPR-compliant

1. Parties

This Data Processing Agreement ("DPA") is entered into between the Client (Data Controller) and KonzeptWeber LLC (Yachay Systems) (Data Processor).

2. Subject Matter

This DPA governs the processing of personal data in connection with the services provided by Yachay Systems.

3. Nature and Purpose of Processing

Processing includes:

• Automated communication handling
• Appointment scheduling
• Message storage and processing

4. Types of Personal Data

The system may process:

• Names
• Phone numbers
• Email addresses
• Messaging identifiers
• Appointment data
• Communication content

5. Categories of Data Subjects

• Customers of the Client
• Website visitors
• Messaging users

6. Obligations of the Processor

The Provider shall process data only on documented instructions, ensure confidentiality, implement appropriate technical and organizational measures, and assist the Controller in fulfilling GDPR obligations.

7. Security Measures

The Provider implements access control, encrypted data transmission where possible, system monitoring, and minimal data storage practices.

8. Subprocessors

The Client agrees that the Provider may use subprocessors, including hosting providers, AI providers (e.g. LLM services), and messaging platforms (e.g. Meta). The Provider ensures that subprocessors meet appropriate data protection standards.

9. International Data Transfers

Where personal data is transferred outside the EU, Standard Contractual Clauses (SCCs) are applied where required.

10. Data Retention

Personal data is stored only as long as necessary for service provision unless otherwise required by law.

11. Data Subject Rights

The Provider supports the Client in responding to access requests, deletion requests, and correction requests.

12. Termination

Upon termination of the service, personal data may be deleted or returned upon request.

13. Governing Law

This DPA is governed by applicable data protection laws, including the GDPR.