Data Processing Agreement

1. Parties

This DPA is entered into between:

• Customer: the organisation that has entered into an agreement to use Arasta; and
• Arasta: [LEGAL COMPANY NAME], trading as Arasta, registered in England and Wales under company number [COMPANY NUMBER], with its registered office at [REGISTERED ADDRESS] (“Arasta”).

For the purposes of applicable Data Protection Laws, Customer acts as a controller or processor, as applicable, and Arasta acts as a processor or sub-processor when processing Customer Personal Data on Customer’s behalf.

“Data Protection Laws” means all applicable laws relating to privacy and personal data, including the UK GDPR and the Data Protection Act 2018, as amended from time to time.

2. Subject matter and duration of the processing

Arasta processes Customer Personal Data as necessary to provide, secure, maintain and support the Service.

Processing begins when Customer enables or uses the Service and continues for the duration of the Customer’s subscription or other agreement with Arasta, together with any limited retention period required for deletion, backups, security, dispute resolution or compliance with applicable law.

3. Nature and purpose of the processing

Arasta provides an AI-assisted ecommerce customer support platform.

Depending on the Customer’s configuration, processing may include:

• receiving and storing conversations between website visitors, customers and AI or human support agents;
• identifying customer intent and routing requests;
• retrieving relevant ecommerce, product, order, account, fulfilment or content information;
• verifying that a customer owns an order before sharing its details, including by sending a one-time code to the email address on the order;
• generating responses using artificial intelligence models;
• generating embeddings and performing semantic retrieval over Customer-provided content;
• reading data from authorised ecommerce platforms and APIs, including Adobe Commerce, Magento Open Source and Shopify;
• sending transactional emails, such as verification codes, replies to offline messages and notifications to Customer’s team;
• maintaining conversation history and operational metadata;
• providing administration, analytics, monitoring and debugging functionality;
• detecting fraud, abuse and security incidents; and
• providing technical support requested by Customer.

Arasta will process Customer Personal Data only on Customer’s documented instructions, including instructions provided through the Service, configuration settings and support requests, unless processing is required by applicable law.

If Arasta believes that an instruction infringes applicable Data Protection Laws, it may inform Customer and suspend the affected processing until the matter is resolved.

4. Types of personal data and categories of data subjects

Categories of data subjects

Depending on Customer’s use of the Service, Customer Personal Data may relate to:

• Customer’s website visitors;
• Customer’s ecommerce customers and prospective customers;
• users communicating through chat or customer-support interfaces;
• Customer’s employees, contractors and authorised administrators; and
• other individuals whose information is submitted by Customer through connected systems.

Types of personal data

Customer Personal Data may include:

• name and contact information, such as email address and telephone number;
• customer and account identifiers;
• chat messages, questions, responses and conversation history;
• order numbers, order status, delivery and fulfilment information;
• product, cart and purchase information;
• customer-service information;
• billing and delivery addresses where they are part of the order data the Service reads;
• technical identifiers such as IP address, user agent, session identifiers and timestamps;
• administrator names, email addresses and account identifiers;
• information contained in Customer-provided CMS, knowledge-base or support content; and
• other information submitted by a data subject to Customer through the Service.

The Service is not intended to require special-category personal data or criminal-offence data. Customer should not intentionally submit such information unless its processing is lawful and necessary for Customer’s use case.

Arasta does not require payment-card numbers to be included in AI conversations and Customers should not submit full payment-card credentials through chat.

5. Obligations and rights of the controller and the processor

Customer determines the purposes and essential means of the processing and is responsible for:

• ensuring that it has a lawful basis for processing Customer Personal Data;
• providing appropriate privacy notices to data subjects;
• ensuring its instructions comply with applicable law;
• configuring the Service appropriately for its use case; and
• responding to data-subject requests as controller, except where Arasta provides assistance.

Arasta will:

• process Customer Personal Data only on documented instructions from Customer;
• ensure persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations;
• maintain appropriate technical and organisational security measures;
• notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data;
• provide reasonable information necessary for Customer to meet applicable breach-notification and data-protection obligations;
• provide reasonable assistance with Data Protection Impact Assessments where the nature of the processing requires it; and
• comply with applicable obligations imposed directly on processors by Data Protection Laws.

Arasta may process account administration, billing, fraud-prevention, security and business-contact information as an independent controller where Arasta determines the purposes and means of that processing. Such processing is governed by Arasta’s Privacy Policy [PRIVACY POLICY — TO BE PUBLISHED] rather than this DPA.

6. Sub-processors

Customer provides Arasta with general authorisation to engage sub-processors where reasonably necessary to provide the Service.

Arasta maintains a current list of sub-processors on its Sub-processors page.

Arasta will impose data-protection obligations on each sub-processor that provides a level of protection appropriate to the processing performed.

Arasta remains responsible for the performance of its sub-processors to the extent required by applicable Data Protection Laws.

Where required by applicable law, Arasta will provide reasonable advance notice of the addition or replacement of a sub-processor that materially processes Customer Personal Data.

Customer may raise a reasonable data-protection objection to a new sub-processor. Arasta and Customer will work in good faith to resolve the objection. Where no reasonable alternative is available, Customer may discontinue the affected feature or terminate the affected Service in accordance with the applicable agreement.

7. Technical and organisational security measures

Taking into account the nature, scope, context and purposes of processing and the risks to individuals, Arasta will maintain appropriate technical and organisational measures designed to protect Customer Personal Data.

These measures include, where applicable:

• encryption of network communications using TLS;
• field-level encryption, with a separate data key per Customer organisation, of integration credentials, signing secrets and customer email addresses;
• logical separation of Customer organisations, enforced by row-level security in the database;
• verification of order ownership before order details are disclosed in a conversation;
• role- and permission-based access controls for Customer’s team;
• restricted administrative access;
• secure management of API credentials, tokens and secrets;
• logging and monitoring of security-relevant events, including audit logs of deletions and administrative changes;
• rate limiting and abuse protection;
• dependency and security updates;
• vulnerability management;
• daily backups and recovery procedures for persistent data;
• protections against unauthorised access, alteration or disclosure;
• data minimisation;
• incident-response procedures; and
• reasonable controls over production access by personnel.

Arasta will periodically review these measures and may update them as the Service and security practices evolve, provided that the overall level of protection is not materially reduced.

8. Assistance with data subject requests

Taking into account the nature of the processing, Arasta will provide reasonable technical and organisational assistance to enable Customer to respond to requests by data subjects exercising their rights under applicable Data Protection Laws.

Where Arasta receives a request directly from an individual relating to Customer Personal Data, Arasta will normally direct the individual to Customer unless applicable law requires Arasta to respond directly.

Customer can view conversations, delete an individual conversation and delete all data held for a customer’s email address from the Service’s dashboard. For other requests, such as access or export, Arasta will assist on request.

9. Deletion and return of personal data

During the subscription, Customer may delete Customer Personal Data using available Service functionality or by submitting a valid support request. Deletions made in the dashboard take effect immediately in active systems.

Customer chooses a retention period for conversations of between 3 and 24 months; conversations older than that period are deleted automatically every day.

Following termination of the Service, Arasta will, at Customer’s request and subject to applicable law, delete or return Customer Personal Data. Customer Personal Data will be removed from active systems within 30 days following the applicable deletion event.

Residual copies contained in backups may remain for up to 14 days before being automatically deleted, provided that such data remains protected and is not restored except for legitimate disaster-recovery or security purposes.

Arasta may retain data where required by law, provided that such data is isolated from further processing except for the purpose requiring its retention.

10. Use of aggregated and anonymised data

Arasta may generate statistics and analytics relating to the operation, reliability, security and use of the Service.

Arasta may use information that has been aggregated or anonymised so that it no longer identifies Customer or any individual to operate, analyse and improve the Service.

Arasta will not attempt to re-identify properly anonymised data.

Arasta does not use Customer Personal Data to train Arasta-owned general-purpose AI models unless Customer separately and explicitly agrees to such processing.

Third-party AI providers process information according to Arasta’s agreements with those providers and are identified on the Sub-processors page.

11. Audits and inspections

Arasta will make available information reasonably necessary to demonstrate compliance with this DPA and applicable Article 28 processor obligations.

Where Customer reasonably requires additional verification, Arasta may satisfy audit requests initially through security documentation, questionnaires, certifications or other appropriate evidence.

If additional inspection is legally required, Customer may conduct an audit itself or through an independent auditor subject to reasonable confidentiality, security and operational requirements.

Unless required following a Personal Data Breach, regulatory request or material compliance concern, audits should not occur more than once in any twelve-month period.

Audits must not unreasonably interfere with Arasta’s operations or expose confidential information belonging to another customer.

12. International transfers

Arasta and its sub-processors may process Customer Personal Data outside the United Kingdom or the country in which Customer is established.

Where an international transfer requires safeguards under applicable Data Protection Laws, Arasta will rely on an appropriate lawful transfer mechanism, which may include:

• an adequacy regulation or decision;
• the UK International Data Transfer Agreement;
• the UK International Data Transfer Addendum to the EU Standard Contractual Clauses;
• applicable EU Standard Contractual Clauses; or
• another transfer mechanism recognised by applicable Data Protection Laws.

Details of relevant sub-processors, processing locations and applicable transfer safeguards are maintained on Arasta’s Sub-processors page.

Precedence

If this DPA conflicts with the agreement governing Customer’s use of the Service regarding the processing of Customer Personal Data, this DPA will prevail to the extent of that conflict.

Contact

Questions regarding this DPA or Arasta’s processing of personal data may be sent to:

[email protected]