Data Processing Agreement

Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Use between Carcani LLC (“Carcani,” “we,” “us,” or “our”) and the customer (“Customer,” “you,” or “your”) and governs the processing of Personal Data by Carcani on behalf of the Customer in connection with the Carcani Chat services.

This DPA applies where Carcani processes Personal Data on behalf of the Customer in the Customer’s use of Carcani Chat and where such processing is subject to applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, or other applicable data protection legislation.

1. Definitions

For purposes of this DPA, “Personal Data” means information relating to an identified or identifiable natural person that Carcani processes on behalf of the Customer.

“Processing,” “Controller,” “Processor,” “Data Subject,” and “Supervisory Authority” have the meanings given to them under applicable data protection law.

“Customer Data” means Personal Data and other information submitted, uploaded, transmitted, or otherwise provided to Carcani by or on behalf of the Customer through the Services.

“Subprocessor” means a third party engaged by Carcani to process Personal Data on behalf of the Customer in connection with the Services.

“Applicable Data Protection Law” means all applicable privacy and data protection laws and regulations governing the processing of Personal Data under this DPA, including the GDPR and UK GDPR where applicable.

2. Relationship of the Parties

For Personal Data processed by Carcani on the Customer’s behalf through the Services, the Customer acts as the Controller and Carcani acts as the Processor, except where Carcani processes information as an independent Controller for its own legitimate business purposes as described in the Privacy Policy.

Carcani may process information as an independent Controller where reasonably necessary to administer customer accounts, process payments, maintain security, prevent fraud and abuse, comply with legal obligations, provide customer support, maintain business records, and operate and improve the Services in accordance with the Privacy Policy.

The parties acknowledge that their respective roles may differ depending on the nature and purpose of the particular processing activity.

3. Processing of Personal Data

Carcani will process Customer Personal Data only for the purpose of providing, maintaining, securing, and supporting the Services and in accordance with the Customer’s documented instructions, unless processing is required by applicable law.

Where Carcani is required by law to process Personal Data in a manner inconsistent with the Customer’s instructions, Carcani will, where legally permitted, inform the Customer of that requirement before carrying out the processing.

The Customer is responsible for determining the purposes and lawful basis for processing Personal Data and for providing all required notices and obtaining any required consents or other legal authorizations.

4. Categories of Personal Data

Depending on how the Customer configures and uses Carcani Chat, Personal Data processed through the Services may include names, email addresses, telephone numbers, company information, account identifiers, IP addresses, device information, chat messages, conversation history, support requests, lead information, contact information, website visitor information, and other information submitted by users or collected through the Customer’s deployment of the Services.

The Customer must not use the Services to process sensitive or special-category Personal Data unless such processing is permitted by Applicable Data Protection Law and the Customer has implemented the appropriate safeguards.

5. Categories of Data Subjects

Depending on the Customer’s use of the Services, Data Subjects may include the Customer’s employees, contractors, customers, prospective customers, website visitors, leads, support users, and other individuals who interact with the Customer through Carcani Chat.

6. Customer Responsibilities

The Customer is responsible for ensuring that its use of the Services complies with Applicable Data Protection Law.

The Customer is responsible for determining what Personal Data is collected through its chatbots, websites, forms, integrations, APIs, and other deployments and for ensuring that such collection has an appropriate legal basis.

The Customer is responsible for providing appropriate privacy notices to Data Subjects and obtaining consent where required.

The Customer must not instruct Carcani to process Personal Data in a manner that violates Applicable Data Protection Law.

The Customer is responsible for configuring its Carcani Chat deployment appropriately, including determining what information its chatbots request from visitors and users.

7. Confidentiality

Carcani will ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations or are otherwise under an appropriate statutory obligation of confidentiality.

Carcani will limit access to Customer Personal Data to personnel and service providers who require access for legitimate business or service-related purposes.

8. Security Measures

Carcani will implement reasonable technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, alteration, or disclosure.

Such measures may include access controls, authentication mechanisms, encryption where appropriate, network security controls, logging and monitoring, backup and recovery procedures, vulnerability management, and internal security procedures.

Carcani will periodically review its security measures and may update or modify them as reasonably necessary to address changes in technology, security threats, and the Services.

9. Personal Data Breaches

Carcani will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

Where reasonably available, Carcani will provide information concerning the nature of the breach, the categories of Personal Data affected, the likely consequences, and measures taken or proposed to address the breach.

Carcani will reasonably cooperate with the Customer in investigating and addressing a Personal Data Breach, taking into account the nature of the processing and the information available to Carcani.

10. Assistance With Data Subject Requests

Taking into account the nature of the processing, Carcani will provide reasonable assistance to the Customer in responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Law.

Where technically available, Carcani may provide tools that allow the Customer to access, export, modify, or delete Customer Data.

The Customer remains responsible for responding directly to Data Subjects and determining whether a Data Subject request is valid and legally required.

11. Assistance With Compliance

Taking into account the nature of processing and information available to Carcani, Carcani will provide reasonable assistance to the Customer with obligations relating to security, Personal Data Breaches, data protection impact assessments, and consultations with Supervisory Authorities where required by Applicable Data Protection Law.

Any assistance requested by the Customer that is outside Carcani’s ordinary support obligations may be subject to reasonable fees and costs where permitted by law.

12. Subprocessors

The Customer authorizes Carcani to engage third-party Subprocessors where reasonably necessary to provide the Services.

Carcani will require Subprocessors that process Customer Personal Data to undertake data protection and confidentiality obligations appropriate to the services they provide.

Carcani remains responsible for the performance of its Subprocessors to the extent required by Applicable Data Protection Law.

Carcani may update or replace Subprocessors from time to time where reasonably necessary to operate, maintain, secure, or improve the Services.

13. Third-Party Services

The Services may depend upon third-party infrastructure, hosting providers, payment providers, artificial intelligence providers, analytics providers, security services, email services, and other technology providers.

Where such providers process Personal Data on behalf of Carcani or the Customer, Carcani will take reasonable steps to ensure that appropriate contractual and security protections apply to such processing.

Third-party services may be subject to their own terms and privacy policies where they process information as independent Controllers.

14. International Data Transfers

Customer Personal Data may be processed or transferred to countries outside the country in which the Customer or Data Subject is located where reasonably necessary to provide the Services.

Where Applicable Data Protection Law requires a lawful transfer mechanism, Carcani will use an appropriate mechanism, which may include an adequacy decision, Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Agreement or Addendum, or another legally recognized transfer mechanism.

Where required, Carcani will implement reasonable supplementary safeguards appropriate to the circumstances of the transfer.

15. Government and Law Enforcement Requests

Carcani may disclose Customer Personal Data where required by law, court order, governmental authority, or other legally binding process.

Where legally permitted, Carcani will use reasonable efforts to notify the Customer before disclosing Customer Personal Data and will limit disclosure to the information legally required.

16. Data Retention and Deletion

Carcani will retain Customer Personal Data for the duration of the Customer’s use of the Services and for such additional period as reasonably necessary to comply with legal obligations, resolve disputes, enforce agreements, maintain security, prevent fraud, or maintain appropriate backup systems.

Following termination of the Customer’s account, Carcani will delete or return Customer Personal Data in accordance with the Customer’s instructions and applicable retention requirements, unless continued retention is required or permitted by law.

Where deletion from backup systems is not immediately technically feasible, Carcani will protect the retained information and ensure that it is not actively processed except where necessary for backup recovery, security, or legal purposes, until deletion occurs in accordance with Carcani’s applicable retention procedures.

17. Customer Data and AI Processing

Carcani will not use Customer Personal Data or private Customer Content to train public or shared artificial intelligence models.

Customer Data may be processed as necessary to generate AI responses, provide requested functionality, maintain security, detect abuse, troubleshoot problems, and maintain the Services.

Where third-party artificial intelligence services are used to provide a feature, applicable Customer Data may be transmitted to those providers as necessary to provide that feature and subject to the applicable contractual and privacy protections.

The Customer is responsible for ensuring that its instructions and configuration of AI features comply with Applicable Data Protection Law.

18. Audits and Compliance Information

Carcani will make available information reasonably necessary to demonstrate compliance with the obligations applicable to Carcani under this DPA.

Where reasonably necessary and subject to appropriate confidentiality obligations, Carcani may provide relevant security documentation, policies, certifications, or other compliance information.

Any audit or assessment must be conducted in a manner that does not unreasonably disrupt Carcani’s operations or compromise the security or confidentiality of other customers’ information.

The Customer will provide reasonable advance notice of an audit and will bear its own costs associated with the audit.

19. Data Protection Impact Assessments

Where required by Applicable Data Protection Law, Carcani will provide reasonable cooperation to the Customer in connection with a Data Protection Impact Assessment relating to the Customer’s use of the Services, taking into account the nature of the processing and information available to Carcani.

20. Term and Termination

This DPA will remain in effect for as long as Carcani processes Customer Personal Data on behalf of the Customer.

Upon termination of the Customer’s use of the Services, the provisions of this DPA relating to confidentiality, security, retention, deletion, liability, and other provisions that by their nature should survive termination will continue to apply for so long as Carcani retains Customer Personal Data.

21. Order of Precedence

This DPA supplements the Terms of Use.

In the event of a conflict between this DPA and the Terms of Use concerning the processing of Personal Data, this DPA will control solely to the extent of that conflict.

Nothing in this DPA limits any rights or obligations that cannot lawfully be limited under Applicable Data Protection Law.

22. Liability

The liability provisions contained in the Terms of Use apply to this DPA unless Applicable Data Protection Law requires otherwise.

23. Changes to This DPA

Carcani may update this DPA from time to time where reasonably necessary to reflect changes in the Services, Applicable Data Protection Law, regulatory requirements, or data processing practices.

Where a change materially affects the Customer’s rights or obligations, Carcani will provide reasonable notice where required by law.

24. Governing Law

This DPA is governed by the governing-law and jurisdiction provisions contained in the Terms of Use, except to the extent that Applicable Data Protection Law requires otherwise.

25. Contact

This DPA is provided by Carcani LLC.

If you require a countersigned copy of this DPA, have questions regarding data processing, or need information concerning our data protection practices, please contact us through the contact information provided on our website.

Annex I — Details of Processing

Subject matter: Processing of Personal Data in connection with the provision of Carcani Chat, including AI chatbot functionality, customer support, lead capture, visitor interactions, conversation management, analytics, integrations, APIs, and related platform functionality.

Duration: The duration of the Customer’s subscription or use of the Services, together with any additional retention period permitted or required under this DPA and Applicable Data Protection Law.

Nature and purpose: Collection, storage, organization, retrieval, transmission, analysis, hosting, display, modification, deletion, and other processing necessary to provide and secure the Services at the Customer’s direction.

Categories of Personal Data: Names, email addresses, telephone numbers, company information, account information, IP addresses, device information, chat messages, conversation history, support requests, lead information, website visitor information, and other information submitted or collected through the Customer’s use of the Services.

Special categories of data: The Customer should not intentionally submit special-category Personal Data unless such processing is permitted by Applicable Data Protection Law and appropriate safeguards have been established.

Categories of Data Subjects: Customer employees, contractors, customers, prospective customers, website visitors, leads, support users, and other individuals interacting with the Customer through the Services.

Annex II — Technical and Organizational Measures

Carcani maintains reasonable technical and organizational safeguards appropriate to the nature and risk of the processing performed through the Services.

These safeguards may include access controls, authentication, least-privilege access, encryption where appropriate, secure development practices, system monitoring, logging, backups, recovery procedures, vulnerability management, incident response procedures, and personnel confidentiality requirements.

Carcani may modify its technical and organizational measures over time provided that such changes do not materially reduce the overall level of security appropriate to the Services.

Annex III — Subprocessors

Carcani may use third-party Subprocessors and service providers as necessary to provide the Services.

A current list of Subprocessors used for Customer Personal Data should be maintained by Carcani and made available to Customers through the appropriate documentation or website page.

Carcani will require applicable Subprocessors to provide appropriate data protection and confidentiality commitments consistent with the obligations applicable to the processing they perform.

Annex IV — International Transfers

Where Customer Personal Data is transferred internationally, Carcani will use a legally recognized transfer mechanism where required by Applicable Data Protection Law.

Depending on the circumstances, such mechanism may include an adequacy decision, European Commission Standard Contractual Clauses, UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism.