Data Processing Agreement

This Data Processing Agreement (the "DPA") governs the processing of personal data by Ethere on behalf of the Customer where Ethere acts as a data processor. It forms part of the Terms of Service (it is the detail behind Section 18): where the Customer processes End-User personal data through the widget, the Customer is the controller and Ethere is the processor. Where the Customer and Ethere have signed a separate DPA, that signed document governs instead.

Roles and scope

For personal data processed through the widget on the Customer's website, the Customer is the controller and Ethere is the processor. Ethere processes that personal data only on the Customer's documented instructions — the Terms, this DPA, and the configuration and instructions the Customer gives through the Service — unless a law requires otherwise. The subject matter, duration, nature, and purpose of the processing, the categories of data subjects, and the categories of personal data are described in Annex A.

Ethere's obligations

Ethere will: (a) process personal data only on documented instructions; (b) ensure that persons authorised to process it are bound by confidentiality; (c) implement the technical and organizational measures in Annex B and on the Security page; (d) engage subprocessors only as set out below; (e) assist the Customer with data subject requests and with Articles 32 to 36 of the GDPR, including impact assessments; (f) delete or return personal data at the end of the services as set out below; (g) make available the information needed to demonstrate compliance and allow audits as set out below; and (h) notify the Customer of a personal data breach as set out below.

The Customer's obligations

The Customer will: provide lawful documented instructions; obtain any consents and give any notices its End Users are entitled to (Section 16); ensure its use of the Service complies with applicable law; and not instruct Ethere to process personal data in a way that would breach the GDPR or other applicable law. The Customer is responsible for the accuracy and lawfulness of the content it uploads.

Subprocessors

The Customer authorises Ethere to engage the subprocessors named on the Subprocessors page. Ethere imposes the same data-protection obligations on every subprocessor by written agreement, remains fully liable for their performance, keeps the list current, and gives the Customer notice of an intended change so that the Customer can object on reasonable data-protection grounds. If the Customer objects and the matter cannot be resolved, the Customer may terminate the affected part of the Service.

Security

Ethere implements the technical and organizational measures described in Annex B and on the Security page, and may update them provided the level of protection is not reduced.

Personal data breach

Ethere notifies the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on the Customer's behalf, with the information the Customer needs to meet its own obligations under Article 33 of the GDPR.

Data subject requests

Ethere assists the Customer, by appropriate technical and organizational measures, in responding to a data subject request. Where a data subject contacts Ethere directly, Ethere may direct the request to the Customer where the Customer is the controller, as explained in the Privacy Policy. The Customer is responsible for the response.

Deletion and return

At the Customer's choice, and on termination, Ethere deletes or returns the personal data it processed on the Customer's behalf, and deletes existing copies, unless a law requires retention. The self-service export and the deletion schedule described in Section 31 of the Terms apply, and data may survive in the encrypted backups until those backups rotate on their normal schedule.

Audits and information

Ethere makes available all information necessary to demonstrate compliance with Article 28 of the GDPR and allows for audits, including inspections, subject to reasonable notice, scope, and confidentiality, and provided an audit does not compromise the security or confidentiality of other customers' data. The Security page describes the measures in force and states plainly what Ethere does not claim.

International transfers

Ethere's own data is stored on infrastructure located in the European Union. Where a subprocessor processes personal data outside the European Economic Area, the transfer is made under the Standard Contractual Clauses together with a transfer risk assessment, and the current position for each subprocessor is stated on the Subprocessors page.

Confidentiality

Each party keeps the other's confidential information confidential and uses it only to perform this DPA, subject to the exceptions in Section 19 of the Terms.

Liability

Each party's liability under this DPA is subject to the limitations and exclusions in Section 28 of the Terms, to the extent the law allows, and nothing in this DPA limits a liability that cannot be limited under the GDPR.

Term and governing law

This DPA applies for as long as Ethere processes personal data on the Customer's behalf, and the provisions on deletion, confidentiality, and audits survive termination. It is governed by the law that governs the Terms (Section 37), and a signed order form or separate DPA prevails over the Terms to the extent of any conflict (Section 51). Questions about this DPA, or a request for an executed copy, go to privacy@ethere.cloud.

Annex A — Details of the processing

• Subject matter — the provision of the AI chat widget and the related Service.
• Duration — the Subscription Term and the retention periods described in the Privacy Policy.
• Nature and purpose — answering End-User questions and the related engagement analytics, lead capture, and support.
• Categories of data subjects — the Customer's End Users and the Customer's Users.
• Categories of personal data — conversation content, the randomly generated visitor identifier, engagement events, the page path and referrer host, and, where lead capture is enabled, the visitor's name and email address. Special categories of personal data are not intended to be processed.

Annex B — Technical and organizational measures

The measures in force are described on the Security page and include tenancy isolation enforced in PostgreSQL, Argon2id password hashing, two-factor authentication and passkeys, transport and browser protections, column-level encryption of stored credentials and secrets, encrypted backups held separately from the production database, monitoring with an append-only audit trail, and abuse protection on the public endpoints.

Annex C — Standard Contractual Clauses

Where personal data is transferred outside the European Economic Area to a subprocessor, the transfer is made under the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) together with a transfer risk assessment. Annexes I, II, and III to the Clauses are completed by the details in Annex A and Annex B of this DPA and by the Subprocessors page.