Data processing agreement

This Data Processing Agreement (“DPA”) forms part of the Biel.ai Terms of Service or another written agreement between the customer (“Customer”) and Volcanic Labs SLU, operating Biel.ai (“Biel”). It applies when Biel processes personal data on Customer's behalf in connection with the Services. Customer is the controller and Biel the processor. If Customer is a processor for another controller, Customer confirms its authority to appoint Biel as a subprocessor.

1. Definitions and interpretation

“Applicable Data Protection Law” means the GDPR and other data-protection laws applicable to the processing. “Customer Personal Data” means personal data processed by Biel on Customer's behalf. The terms controller, processor, data subject, personal data, processing, personal data breach and supervisory authority have the meanings given in the GDPR.

2. Processing details

Biel processes Customer Personal Data to provide, secure, support and maintain the Services under Customer’s documented instructions and Schedule 1. This DPA and Customer’s configuration and use constitute instructions, including for international transfers. Additional instructions must be consistent with the agreement. Work beyond the Services may incur reasonable fees.

If Union or Member State law requires other processing, Biel will inform Customer beforehand unless notice is prohibited on important public-interest grounds. If an instruction appears unlawful, Biel will notify Customer without undue delay and may pause that processing until resolved, unless notice is legally prohibited. Biel will not use Customer Personal Data to train AI models or authorise AI subprocessors to do so.

3. Customer responsibilities

Customer is responsible for the lawfulness, accuracy and quality of Customer Personal Data and its processing instructions. Customer will provide required notices, establish a lawful basis, configure the Services appropriately and avoid submitting special-category or highly sensitive personal data unless the parties have expressly agreed appropriate safeguards in writing.

4. Confidentiality

Biel will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate data-protection and security guidance. They may process that data only on Customer's documented instructions unless required by applicable law.

5. Security

Biel will maintain technical and organisational measures appropriate to the processing risks, taking account of the state of the art, costs, nature, scope, context and purposes. Measures protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Schedule 2 and our Security Overview describe them. Updates will not materially reduce overall protection.

6. Personal data breaches

Biel will notify Customer without undue delay after becoming aware of a breach affecting Customer Personal Data. We will provide available information needed for Customer’s notification duties, with updates as it becomes available, and take reasonable steps to investigate, contain and mitigate the breach. Notice is not an admission of fault or liability.

7. Data-subject requests and regulatory assistance

Taking account of the processing and information available, Biel will reasonably assist Customer with data-subject requests, security, breach notifications, impact assessments and prior consultations. Requests received by Biel about Customer Personal Data will be redirected to Customer unless a response is legally required. Material work beyond standard Services may incur reasonable fees, except where caused by Biel’s breach.

8. Subprocessors

Customer grants Biel general written authorization to use subprocessors. Biel maintains a current list in its provider documentation and will give advance notice of a new subprocessor that will process Customer Personal Data. Customer may object on reasonable data-protection grounds within 14 days of that notice. The parties will work in good faith to resolve the objection. If no reasonable alternative is available, either party may terminate the affected Services.

Biel will impose data-protection obligations on each subprocessor that are no less protective in substance than the relevant obligations in this DPA. Biel remains responsible for each subprocessor's performance of those obligations to the extent required by Applicable Data Protection Law.

9. International transfers

Biel will ensure that transfers of Customer Personal Data outside the European Economic Area are supported by a lawful transfer mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with supplementary measures where required. On request, Biel will provide information reasonably necessary for Customer to assess the applicable transfer safeguards.

10. Information and audits

Biel will provide information reasonably necessary to demonstrate compliance. Customer should first use available independent reports, certifications or written responses. If insufficient, Customer or an authorised independent auditor may conduct an audit, including an inspection.

Routine audits are limited to once yearly. Additional audits are permitted following a confirmed breach or where required by law or an authority. Give reasonable advance notice, protect others’ data and Biel’s confidential information, and avoid unreasonable disruption. Customer pays its auditor’s fees. These arrangements do not prevent legally required audits or cooperation.

11. Return and deletion

After the Services end, Biel will, at Customer’s choice, return or delete Customer Personal Data and delete existing copies within a reasonable period, unless Union or Member State law requires retention. Retained data remains protected by this DPA and limited to the permitted retention purpose. Protected backups expire under the normal cycle. Disaster recovery must reapply deletion instructions to restored data.

12. Liability and order of precedence

The liability provisions in the agreement governing the Services apply to this DPA to the extent permitted by law. Nothing in this DPA limits obligations or rights that cannot lawfully be limited. If this DPA conflicts with the agreement on the processing of Customer Personal Data, this DPA controls. If applicable Standard Contractual Clauses conflict with this DPA, those clauses control.

13. Duration

This DPA remains in effect for as long as Biel processes Customer Personal Data on Customer's behalf.

Schedule 1: Processing details

Subject matter and purpose

Providing, securing, supporting and maintaining Biel's documentation chat, search, analytics, integrations, API and related services configured by Customer.

Duration

The subscription term and the limited period required for return, deletion, backup expiry or legally required retention after termination.

Nature of processing

Collection, transmission, ingestion, organization, indexing, storage, retrieval, consultation, generation, display, logging, support, deletion and other processing needed to provide the Services.

Categories of data subjects

• Customer's account administrators, team members and contractors.
• People who use Customer's chatbot, search, team-chat integrations, API or other Biel-powered experiences.
• People whose personal data Customer includes in connected documentation or other submitted content.

Types of personal data

• Names, email addresses, account identifiers and organization details.
• Questions, prompts, messages, feedback and other content submitted through the Services.
• Documentation and connected-source content, which may incidentally contain personal data.
• IP addresses, device and browser information, timestamps, authentication records and security or usage logs.
• Support communications and configuration information supplied by Customer.

Special-category data

The Services are not intended for special-category data or data relating to criminal convictions. Customer must not submit such data unless expressly agreed in writing with Biel and permitted by law.

Schedule 2: Technical and organizational measures

• Access controls designed to restrict production and customer data to authorized personnel and services.
• Encryption of data in transit and at rest using current industry-standard protocols.
• Logical separation of customer projects and scoped credentials for service access.
• Logging, monitoring, incident-response and recovery procedures proportionate to the Services.
• Backup, availability and restoration controls appropriate to hosted services.
• Secure development, dependency management and vulnerability remediation practices.
• Confidentiality commitments and security guidance for authorized personnel.
• Vendor assessment and contractual controls for subprocessors.
• Retention and deletion controls for Customer Personal Data and credentials.

Contact

Volcanic Labs SLU

Plaza de Galicia, Local 7, 38612, Santa Cruz de Tenerife, Spain

Email: [email protected]