Data Processing Addendum
Last updated 7 September 2026 · Incorporated into the Terms of Service · Template. Have a lawyer review it before you rely on it commercially.
This Addendum applies where we process personal data on your behalf under Article 28 GDPR. It takes effect automatically when you use the Service — you do not need to sign anything. If your procurement process requires a countersigned copy, email privacy@sprosimo.net and we will provide one.
1. Roles
You are the controller and we are the processor for any personal data contained in files you submit to the Service. For your own account and billing data we are an independent controller; see the Privacy Policy.
2. Subject matter and details of processing
| Subject matter | Indexing content you supply, and answering questions from your website's visitors using it |
|---|---|
| Duration | For as long as you hold an account, plus 30 days |
| Nature and purpose | Automated extraction, indexing, retrieval and storage of your content; logging and answering visitor questions |
| Types of personal data | Incidental business-contact details appearing in your indexed content (a staff name or email on an About or Contact page); the free text a visitor types into the chat; an email address a visitor voluntarily provides for a human handover; a salted daily hash derived from the visitor's IP address (we do not store the raw IP) |
| Categories of data subject | Visitors to your website, and any individuals named in the content you index |
| Special categories | None. Submitting special-category data is prohibited by the Acceptable Use Policy |
3. Our obligations
- We process personal data only on your documented instructions, which are these Terms and your use of the Service, unless required otherwise by law — in which case we will tell you first unless the law prohibits it.
- We ensure that people authorised to process the data are bound by confidentiality.
- We implement the technical and organisational measures described on the Security page, taking into account the state of the art and the risks presented.
- We assist you, so far as reasonably possible, with data subject requests, data protection impact assessments and prior consultations.
- We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification obligations.
- At the end of the term we delete or return the data at your choice, except where storage is required by law.
- We make available the information needed to demonstrate compliance and allow audits under section 7.
4. Your obligations
- You warrant that you have a lawful basis for the content you index and the visitor data you collect through the assistant, and that you have given any notices required — including telling your own visitors, in your own privacy policy, that an assistant is present and what it records.
- You must not submit special-category data, payment card numbers or government identity numbers.
- You are responsible for the accuracy of the data you submit and for the instructions you give.
5. Sub-processors
You give general written authorisation for us to engage the sub-processors listed at https://sprosimo.net/subprocessors. We impose data protection obligations on each of them no less protective than those in this Addendum, and we remain liable to you for their performance.
We will update that page before engaging a new sub-processor. You may object on reasonable data-protection grounds within 30 days; if we cannot resolve the objection you may terminate the affected part of the Service and we will refund any prepaid unused period.
6. International transfers
Where personal data is transferred outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses (Decision 2021/914), together with any applicable adequacy decision and any supplementary measures the transfer risk assessment requires. Per-provider detail is on the Sub-processors page.
7. Audit
On reasonable written notice, and no more than once in any 12 months unless a supervisory authority or a breach requires otherwise, we will respond to a reasonable written security questionnaire and provide documentation about our measures. On-site audits are available where a supervisory authority requires one, at your cost, subject to reasonable confidentiality and scheduling conditions.
8. Security measures (Annex II summary)
- TLS in transit; encryption at rest by the storage provider.
- bcrypt password hashing (work factor 12); API keys stored as SHA-256 hashes and shown once.
- Role-based access, individual credentials, multi-factor authentication on administrative accounts.
- Append-only access logging with timestamp and IP; retained 24 months.
- CSRF protection, security response headers, per-endpoint rate limiting, signed webhook verification with event-level deduplication.
- Daily backups with 30-day retention; documented incident response.
- Logical tenant separation: every query is scoped to the owning account.
The Security page also lists, honestly, the controls we do not have.
9. Liability
Liability under this Addendum is subject to the limitations in clause 14 of the Terms of Service, to the extent permitted by law.