Data processing agreement

Bots24/7 · Model · version 1.0 · 28 October 2026

Parties

1. [Client company name], located at [address], registered with the Dutch Chamber of Commerce (KvK) under number [KvK number], represented by [name and position], hereinafter: "Controller" or "Client"; and
2. Klik&Shop, a sole proprietorship trading as Bots24/7, located at Paramaribohof 55, 2315 VW Leiden, registered with the Dutch Chamber of Commerce (KvK) under number 98148362, hereinafter: "Processor" or "Bots24/7".

Recitals

• The parties have entered into an agreement for setting up, hosting and managing a chatbot for the Client's website and/or WhatsApp Business number (the "Main Agreement"), to which the Bots24/7 terms and conditions apply.
• In performing it, Bots24/7 processes personal data on behalf of the Client. The Client determines the purposes and means of that processing.
• The parties record their arrangements in this agreement, as required by Article 28(3) of the General Data Protection Regulation ("GDPR").

1. Definitions

Terms such as personal data, processing, data subject, controller, processor, sub-processor and personal data breach have the meaning given to them in the GDPR.

2. Subject matter and instructions

1. Bots24/7 processes personal data only on behalf of the Client and on its documented instructions, as set out in the Main Agreement, this agreement and Annex 1. This also applies to transfers to a country outside the European Economic Area (EEA).
2. Bots24/7 does not process the personal data for its own purposes, does not sell it and does not use it to train (AI) models outside the Client's chatbot.
3. If Bots24/7 is required by law to process the data otherwise, it will inform the Client in advance, unless the law prohibits this.
4. If Bots24/7 believes an instruction infringes the GDPR or other data protection law, it will inform the Client immediately and is not obliged to carry out that instruction.

3. Obligations of the Client

1. The Client warrants that the processing is lawful, that there is a valid legal basis for it and that data subjects (visitors and customers of the Client) are properly informed, for example through the Client's privacy statement.
2. The Client ensures that the chatbot's knowledge base contains no special categories of personal data or other data that does not belong there, unless the parties expressly agree otherwise in writing.

4. Confidentiality

Bots24/7 keeps the personal data confidential. It ensures that everyone with access to the data under its authority is bound by confidentiality and only has access insofar as necessary for the service.

5. Security

1. Bots24/7 takes appropriate technical and organisational measures to protect the personal data against loss and unlawful processing, taking into account the state of the art, the costs and the risks (Article 32 GDPR). These measures are listed in Annex 2.
2. Bots24/7 may adjust the measures, provided the level of security does not decrease.

6. Sub-processors

1. The Client gives Bots24/7 general written authorisation to engage sub-processors. The categories of sub-processors are listed in Annex 3. The specific sub-processors at the time of signing are provided to the Client upon signature.
2. Bots24/7 will inform the Client by email at least 30 days in advance of any intended addition or replacement of a sub-processor. The Client may object on reasonable grounds within that period. If the parties cannot resolve the matter, the Client may terminate the Main Agreement free of charge as of the date the change takes effect.
3. Bots24/7 imposes on each sub-processor in writing at least the same obligations as in this agreement, and remains liable to the Client for the performance of those obligations by sub-processors.

7. Transfers outside the EEA

Bots24/7 only transfers personal data to a country outside the EEA if appropriate safeguards exist within the meaning of Chapter V GDPR, such as an adequacy decision (including the EU-US Data Privacy Framework for certified parties) or the European Commission's standard contractual clauses, supplemented by additional measures where necessary.

8. Data subject rights

Bots24/7 assists the Client, as far as reasonably possible, in handling requests from data subjects (such as access, rectification, erasure, restriction, portability and objection). If Bots24/7 receives such a request directly, it forwards it to the Client within 5 working days and does not handle it itself unless instructed by the Client.

9. Personal data breaches

1. Bots24/7 informs the Client without undue delay and no later than 36 hours after becoming aware of a personal data breach affecting the Client's personal data.
2. The notification includes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact point. Information not yet available is provided as soon as possible.
3. The Client assesses whether the breach must be reported to the Dutch Data Protection Authority and/or data subjects, and makes those notifications itself. Bots24/7 provides reasonable cooperation.
4. Bots24/7 documents all personal data breaches, including the facts, effects and measures taken.

10. Other assistance

Taking into account the nature of the processing and the information available to it, Bots24/7 assists the Client in complying with Articles 32 to 36 GDPR, such as a data protection impact assessment (DPIA) and any prior consultation with the supervisory authority. For assistance requiring more than limited time, Bots24/7 may charge reasonable costs at its usual rate after prior notice.

11. Information and audits

1. Bots24/7 makes available all information necessary to demonstrate compliance with this agreement and Article 28 GDPR.
2. The Client may have an audit carried out at most once a year, or after a data breach, by an independent expert bound by confidentiality. The audit is announced at least 14 days in advance and must not unnecessarily disrupt business operations. The costs are borne by the Client, unless it turns out that Bots24/7 materially fails to comply with this agreement.

12. Retention, return and deletion

1. Bots24/7 does not keep personal data longer than necessary for the service or than agreed in Annex 1.
2. After the Main Agreement ends, Bots24/7 returns the personal data at the Client's request within 30 days in a common format (for example CSV or JSON) and then deletes it, including copies held by sub-processors, unless storage is required by law. Backups are overwritten according to the usual rotation schedule, within 90 days at the latest.
3. On request, Bots24/7 confirms the deletion in writing.

13. Liability

The liability provisions of the Bots24/7 terms and conditions apply, except where the GDPR mandatorily provides otherwise (Article 82 GDPR).

14. Term and final provisions

1. This agreement applies for as long as Bots24/7 processes personal data for the Client and does not end before the Main Agreement. Obligations that by their nature continue (such as confidentiality and deletion) remain in force afterwards.
2. In the event of conflict, this agreement prevails over the Main Agreement and the terms and conditions as regards the processing of personal data.
3. This agreement is governed by Dutch law. Disputes are submitted to the competent court of the District Court of The Hague.
4. If the law or a decision of a supervisory authority changes, the parties will amend this agreement in good faith where necessary.

Signatures

Annex 1 – Description of the processing

Annex 2 – Security measures

• Encrypted connections (TLS/HTTPS) for the chatbot, the management environment and the forwarding of requests.
• Access to data only for those who need it (need-to-know), with personal accounts, strong passwords and two-factor authentication.
• Data is stored with reputable hosting providers with encryption at rest where the provider offers it.
• Data minimisation: the chatbot only asks for data needed for the request, and conversations are deleted automatically after the retention period.
• Secrets such as API keys are not stored in source code and are separated per client.
• Software and dependencies are kept up to date; security updates are applied as soon as possible.
• Logging of administrative actions and monitoring of unusual activity, where the services used support it.
• A fixed procedure for reporting and handling data breaches (see article 9).
• Settings at AI language model providers under which submitted data is not used to train models, where the provider allows it.

Annex 3 – Categories of sub-processors

A list of the specific sub-processors, including country of establishment and transfer mechanism, is provided upon signature and kept up to date in accordance with article 6.

Print / save as PDF