Version 1.0. Data processing agreement under Article 28 GDPR between the user of AngeldeskAI IA (the “Controller”) and [complete in Equipo IA → Ajustes], CVR [complete in Equipo IA → Ajustes], [complete in Equipo IA → Ajustes] (the “Processor”). It is accepted electronically when the sales agent is turned on and is recorded with date and version.
1. Subject matter and duration
The Processor processes personal data on behalf of the Controller to provide the sales agent: handling conversations on the website, on WhatsApp, on Instagram and on Messenger, storing contacts and conversations, recording questions, booking appointments and sending emails to its contacts (confirmations, reminders, follow-ups, newsletters and one-off emails). The agreement lasts as long as the agent is active or the Controller’s data exists on the platform.
2. Data and data subjects
- Data subjects: visitors, prospective customers and customers of the Controller.
- Data: name, email, phone, content of conversations, interests, appointment date and time, technical identifiers of the chat, language.
- Special categories: the agent is configured not to ask for them. If a person shares them on their own initiative, they are processed only within the conversation and with the same safeguards.
3. Obligations of the Processor
- Process the data only on the documented instructions of the Controller (the agent’s settings and this agreement), unless required by law.
- Ensure the confidentiality of authorised persons.
- Apply appropriate security measures (Art. 32): HTTPS, encryption of credentials, access control, backups, activity logging and data minimisation.
- Assist the Controller in responding to data subjects’ requests (access, erasure, etc.) and in impact assessments where applicable.
- Notify the Controller of any personal data breach without undue delay and no later than 48 hours after becoming aware of it.
- At the end, delete or return the data as the Controller chooses, unless retention is required by law.
- Make available the information needed to demonstrate compliance and allow reasonable audits with prior notice.
4. Sub-processors
The Controller gives general authorisation to these sub-processors:
- [complete in Equipo IA → Ajustes]: hosting of the platform (EU or with adequate safeguards).
- Anthropic PBC (USA): generation of the agent’s replies, under standard contractual clauses and without using the data to train models.
- The platform’s email delivery provider: notifications to the Controller.
Google (Calendar), Microsoft (Outlook), Calendly, Meta (WhatsApp Business, Instagram and Messenger) and the email service the Controller connects (its own SMTP server or Brevo) are used only with the accounts the Controller connects and under the Controller’s own contracts with them. If the Controller chooses the platform email, its emails are sent through the platform’s email delivery provider. The Processor will give 30 days’ notice of any new sub-processor; the Controller may object and, in that case, cancel the service.
5. International transfers
Transfers to the United States are based on the European Commission’s standard contractual clauses and additional security measures.
6. Obligations of the Controller
- Have a legal basis for processing its customers’ data and inform them (for example, in its privacy policy), including that they are talking to an AI assistant.
- Not give instructions that are contrary to the law.
- Configure the agent with truthful information and respond to its customers’ requests.
- Send newsletters only to people who have agreed to receive them. When importing contacts or marking them as subscribed, the Controller confirms it has their consent. All newsletters and follow-ups include a one-click unsubscribe link.
7. Retention period
Conversations, contacts and the email history are deleted automatically 12 months after the last activity, or earlier if the Controller deletes them. Contacts subscribed to newsletters are kept for as long as they remain subscribed.