Data Processing Agreement (DPA)

1Scope and purpose

This agreement governs the Data Processor's processing of personal data on behalf of the Customer. The purpose is to deliver AI-based services as specified in the main agreement.

Processing continues for as long as the main agreement is in force, subject to the deletion obligations in clause 12. The nature of the processing is collection, storage, structuring, analysis using language models, display to the Customer's staff and — where the Customer has configured it — transfer to systems and recipients the Customer itself determines.

What information we collect

As part of a conversation, the following information is processed and stored:

• The current browser address for the chat conversation (can be disabled)
• Personal information the end user chooses to provide in the conversation (name, phone number and/or email address, etc.)
• Files and attachments the end user chooses to upload in the conversation (including email attachments)
• Personal information from integrations connected to the Customer's KonversAI account (order history, returns and shipping information, etc.)
• Where the end user gives explicit consent to marketing tracking: transfer of marketing attribution to third parties configured by the Customer. See clause 8.
• Contact details for the Customer's own staff who use the operator interface (name, email address, role)

The end user's IP address is processed for security, troubleshooting and abuse prevention, and appears in technical logs held by the Data Processor and its sub-processors. The IP address is not stored as part of the conversation history.

The service is not designed for special categories of personal data (GDPR Art. 9) or personal data relating to criminal convictions (Art. 10). See clause 11 on the Customer's responsibility for this.

The data subjects are end users who contact the Customer through KonversAI — typically the Customer's customers, visitors to the Customer's website or other enquirers — as well as the Customer's own staff who use the service.

How long information is stored

• History in the end user's chat window can be used to tell the Customer which conversations come from the same browser session.
  • By default, no information is stored beyond the current browser session (session storage)
  • If the end user gives explicit consent to functional cookies, chat history is stored for up to 12 months in that browser (local storage in the browser)
• Conversation history is stored in the Customer's account until deleted by the Customer, or within 30 days after the customer relationship ends. The Customer may configure regular deletion of its conversations, for example so that conversations older than 30 days are deleted.
• Click IDs from adverts and pseudonymised (hashed) contact details used for marketing attribution are deleted within 30 days. See clause 8.
• Delivery logs for outbound integrations configured by the Customer are stored for up to 180 days.
• Technical and security logs are stored for up to 90 days.

2Instructions and processing

• The Data Processor shall only process data in accordance with the Customer's documented instructions. This agreement, the main agreement and the Customer's configuration of the service constitute the Customer's instructions.
• Processing includes collection, analysis and storage in order to deliver and improve the service.
• AI-specific: The Data Processor may use anonymised and aggregated data for statistics and algorithm improvement. Personal data or other customer data will not be used to train AI models. The same applies to the Data Processor's sub-processors.
• The Data Processor shall notify the Customer if, in the Data Processor's assessment, an instruction infringes data protection law, cf. GDPR Art. 28(3) final paragraph.
• The service composes and may send replies automatically. This does not constitute automated decision-making producing legal effects or similarly significant effects for the data subject (GDPR Art. 22). The Customer is responsible for configuring the service so that this remains the case, and for any necessary human follow-up.
• End users are informed that they are interacting with an AI assistant, cf. Regulation (EU) 2024/1689 (the AI Act) Art. 50.

3Confidentiality and access

• The Data Processor shall ensure that persons with access to the personal data have committed themselves to confidentiality, cf. GDPR Art. 28(3)(b).
• Access is granted by role and on a least-privilege basis, and is limited to what is necessary for operations, support and troubleshooting.
• The Data Processor operates an administration interface that can give access to data across customers. Access is role-based and restricted to named personnel bound by confidentiality, is used solely for operating and supporting the service, and is logged.

4Security

• The Data Processor shall implement technical and organisational measures to ensure confidentiality, integrity and availability (GDPR Art. 32).
• This includes encryption of data in transit and at rest, access control, logging and procedures for detecting and handling security breaches.
• In the event of a personal data breach, the Customer shall be notified without undue delay and no later than 24 hours after the Data Processor became aware of the breach.
• As far as possible, the notification shall describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact point for further information.
• The Data Processor shall assist the Customer with the Customer's own notification to the supervisory authority within 72 hours and any communication to the data subjects.
• The Data Processor notifies only the Customer, not the supervisory authority or the data subjects, unless the Customer requests it or the Data Processor is legally required to do so.

5Assistance to the Customer

• The Data Processor shall assist the Customer in fulfilling data subject rights (GDPR Art. 12–23), including access, rectification, erasure, restriction and data portability. The service provides functionality to find, export and delete a conversation; assistance beyond this is provided on a time-spent basis.
• If an end user contacts the Data Processor directly about their rights, the Data Processor shall not respond independently, but shall forward the request to the Customer without undue delay.
• The Data Processor shall assist the Customer with data protection impact assessments (DPIA) and any prior consultation with the supervisory authority, cf. GDPR Art. 35 and 36, and make the necessary documentation available.

6Sub-processors

• The Customer gives the Data Processor general written authorisation to use sub-processors, cf. GDPR Art. 28(2).
• An up-to-date list of sub-processors is available to the Customer at konvers.ai/dpa.
• New or changed sub-processors are notified to the Customer's administrators by email at least 30 days before they are put into use. The Customer has the right to object if there are legitimate grounds related to data protection. If the parties do not reach agreement, the Customer may terminate the affected part of the service free of charge, effective from the date the sub-processor is put into use.
• The Data Processor shall impose on every sub-processor the same obligations as set out in this agreement, and remains fully liable to the Customer for the sub-processor's performance of them, cf. GDPR Art. 28(4).

The Data Processor uses the following sub-processors:

• Microsoft Azure — cloud services and AI technology. Data centres in Norway and Europe. US supplier covered by the EU Standard Contractual Clauses.
• Lettermint.co — email service. Data centres in Europe, European company.
• Twilio — SMS and telephony. Data centres in Europe.
• Sentry — system monitoring. Data centres in Europe.
• PostHog — marketing data for the commercial website konvers.ai. Not used for delivering the KonversAI service and not used to process data on behalf of the Customer.

Third parties the Customer connects to its own account — for example its own business systems, messaging channels or recipients of marketing attribution — are not sub-processors of the Data Processor. The Customer is responsible for its own legal basis and any agreements with them.

7Storage in the end user's browser

• The KonversAI widget stores identifiers in the end user's browser in order to tie a conversation together. Without a consent signal, this is stored only for the current browser session (session storage), as a continuation of the enquiry the end user started themselves.
• Storage across visits only occurs where valid consent exists. The widget reads consent from common consent management platforms (CMPs) and respects later withdrawal.
• The Customer is the data controller for storage in the end user's terminal equipment on the Customer's website, and is responsible for obtaining consent under applicable electronic communications law. Annex B describes what is stored and can be used in the Customer's own cookie declaration.

8Marketing attribution

• Where the Customer has configured marketing attribution and the end user has given explicit consent to marketing, click IDs from adverts and pseudonymised (hashed) contact details may be transferred to the recipients the Customer has configured.
• Email addresses and phone numbers are transferred only as SHA-256 hashes. Hashed values are pseudonymised, not anonymised, and are still regarded as personal data.
• The recipients — typically advertising platforms — act as independent controllers for their own use of the data. This agreement does not govern their processing. The Customer is responsible for the legal basis and for informing data subjects about this transfer.
• Without marketing consent, the event is recorded without click IDs and without contact details.
• Click IDs and hashed contact details are deleted within 30 days.

9Transfers to third countries

• Processing shall take place within the EU/EEA and primarily in Norway.
• If data is transferred to countries outside the EU/EEA, the Data Processor shall ensure a valid transfer mechanism (e.g. the EU Standard Contractual Clauses).
• Some sub-processors have parent companies outside the EU/EEA. Support and operational access from third countries may occur with these, and is then covered by the EU Standard Contractual Clauses with supplementary measures. The Data Processor makes its transfer impact assessment available to the Customer on request.

10Audit

• The Customer has the right to verify that the Data Processor is meeting its obligations, cf. GDPR Art. 28(3)(h).
• This is done primarily through access to security reports, certifications and responses to the Customer's security questionnaire.
• Where this is not sufficient, the Customer may carry out an audit or inspection, itself or through an independent auditor it appoints. An audit may be carried out up to once a year, shall be notified at least 30 days in advance, shall not unduly disrupt the Data Processor's operations, and requires a confidentiality undertaking. The Customer bears its own and the Data Processor's costs for such an audit, unless the audit reveals material non-compliance.
• In case of suspected security breach, or upon order from a supervisory authority, an audit may be carried out without regard to the limitations above.

11The Customer's obligations as data controller

• The Customer is responsible for having a legal basis for the data processed in KonversAI.
• The Customer shall inform its end users in its own privacy policy that KonversAI is used, what data is processed, and that KonversAI AS is the Customer's data processor. The Customer shall also list KonversAI AS in its own record of processing activities (GDPR Art. 30).
• If the Customer is itself a data processor for another controller — for example an agency operating the solution for its own client — KonversAI AS is a sub-processor in that relationship. The Customer is then responsible for obtaining the necessary authorisation from its controller and for passing on the obligations in this agreement.
• The Customer shall obtain consent for storage in the end user's browser and for marketing attribution, and pass the consent signal to the widget. See clauses 7 and 8 and the technical embedding documentation.
• The Customer shall not configure or use the service to collect special categories of personal data (GDPR Art. 9) or data relating to criminal convictions (Art. 10) without prior written agreement with the Data Processor.

12Deletion upon termination

• Upon termination, the Data Processor shall, at the Customer's choice, delete or return all personal data, cf. GDPR Art. 28(3)(g). If the Customer gives no instruction, the data is deleted.
• Deletion takes place within a reasonable time (30 days by default), unless legislation requires continued storage. Backups are deleted according to the ordinary rotation cycle, and are covered by the same security measures in the meantime.
• The Customer may request a data export before deletion.
• The Data Processor confirms deletion in writing on the Customer's request.

13Term, changes and other provisions

• The agreement applies for as long as the Data Processor processes personal data on behalf of the Customer.
• The Data Processor may update this agreement. The Customer's administrators are notified by email of any changes. Material changes are notified at least 30 days before they take effect, and during that period the Customer may terminate the main agreement free of charge if it does not accept the change.
• In the event of conflict, this agreement prevails over the main agreement on questions concerning the processing of personal data.
• The limitation of liability in the main agreement also applies to this agreement. The limitation does not apply to administrative fines imposed on the Customer as a result of the Data Processor's breach of this agreement, or to claims from data subjects under GDPR Art. 82 caused by the Data Processor.
• The agreement is governed by Norwegian law with the same venue as the main agreement.

Annex B: Storage in the end user's browser

The widget stores the values below in the end user's browser. These are not cookies, but storage in the browser's sessionStorage and localStorage. The rules on storage in terminal equipment nevertheless apply in the same way. <key> is the Customer's widget key.

The widget additionally reads the cookie __oppref if it is present on the Customer's website. It is set by the advertising platform's own tracking code, not by KonversAI, and is read only where marketing consent exists.

If the end user withdraws consent, the values stored across visits are removed, and the conversation continues on session storage for the remainder of the current browser session.