Review the DPA below and fill in your company details. We will generate a signed PDF and email it to you. Return the countersigned copy to legal@boei.help.
Agency provisions version: 2026-11-05 v2.
These agency provisions and the full standard Boei Data Processing Agreement reproduced below, including its annexes, form the Agreement between Ruby Foundry B.V. trading as Boei and the agency named in the signing form (the Agency). These provisions prevail where they expressly amend or explain the standard Agreement. All other terms remain unchanged.
Applicable Data Protection Law means the laws governing the relevant processing by a Party, including the GDPR and applicable national implementing laws and, where applicable, the UK GDPR and UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection and its implementing rules. References to the GDPR do not exclude equivalent duties under those applicable laws. A Party is not subject to a foreign law solely because this Agreement names it.
The Main Agreement consists of the Agency's approved agency application or other written agency approval, the applicable Boei service order or subscription confirmation, and the Boei Terms and Conditions and End User License Agreement incorporated into that arrangement. This Agreement does not create an agency service arrangement where Boei has not approved one. Subject to that approval and the Main Agreement, Boei expressly permits the Agency to supply and manage Boei services for Covered Client Accounts and to bill its own clients. This is the express permission required by the resale and non-transfer provisions of those commercial terms, limited to this approved arrangement. It does not transfer Boei's agreement to a client or permit resale of Boei's underlying software outside that arrangement.
For Article 4.1, this Agreement takes effect on the date both Parties have accepted or signed it, unless their signed service order states a later date. It applies to existing Covered Client Accounts from that date and to future Covered Client Accounts when added. It replaces an earlier standard Boei DPA signed by the Agency only for the same covered processing between these Parties. It does not replace a client's direct DPA with Boei or release liability accrued under an earlier agreement.
The Agency's legal name, business address and country, and signing contact are recorded in the signing form or attached service order. Company register, registration number and tax number are supplied where applicable; absence of a register or tax number does not invalidate the identification of an otherwise identifiable contracting party. Each signatory confirms authority to bind its Party.
For client processing, the usual chain is: Client as Controller, Agency as Processor, and Boei as Sub-Processor. Payment by the Agency does not make it the Controller of its clients' Personal Data. Where a client itself acts as Processor for another Controller, the corresponding further-processing roles apply and the Agency must obtain the necessary authority throughout that chain.
For the Agency's own use of the Service where it determines the purposes and essential means, including its own internal tests, the Agency is Controller and Boei is Processor. Boei's separate processing of account, billing and business administration data for its own purposes is governed by its applicable privacy notice.
Covered Client Accounts are client accounts supplied through the Agency under its agreement with Boei and linked to the Agency's reseller or existing managed-agency arrangement. They include current and future trial and paid accounts, including accounts billed manually or through an existing agency package. For new Covered Client Accounts, before processing client Personal Data, the Agency shall provide Boei with that account's identifier, the client's legal name, business address and country, and a monitored business contact address for data protection and continuity requests. For Covered Client Accounts already processing Personal Data on the effective date, the Agency shall provide these details within thirty days after that date. These details may be recorded in the Service or supplied through a secure written channel agreed with Boei. The Agency shall keep them current. Boei may retain and use this limited record to perform this Agreement, including the continuity procedure below, subject to confidentiality and applicable retention requirements.
An account for which the client contracts directly with Boei remains governed by the applicable agreement between that client and Boei. Granting the Agency management access does not by itself replace that agreement or turn Boei into the Agency's Sub-Processor for that account.
No separate agreement between Boei and each client is needed for Covered Client Accounts where the Agency is Boei's contracting party and the processing chain above applies.
This Agreement creates rights and obligations only between Boei and the Agency. Except for the limited continuity procedure in this Agreement, it gives clients no independent contractual rights against Boei. Rights under mandatory law remain unaffected.
For contractual rights and obligations, references in the standard Agreement to Controller, including its account, instructions, requests, contact address, fees and Main Agreement, mean the Agency as Boei's contracting party, subject to the role allocations in these provisions. Controller Personal Data includes Personal Data processed for Covered Client Accounts. References to visitors, customers, data subjects and processing purposes concern the relevant client, or the Agency for its own processing.
Article 1.1 is replaced by the roles above. In Articles 1.3a, 1.4 and 1.6, the Main Agreement and Offers are between Boei and the Agency, and the Parties are Boei and the Agency. The recitals are read accordingly. The Agency communicates client instructions and is not, solely for that reason, represented as determining the client's purposes.
In Article 2.7, references to "these general terms and conditions" mean this Data Processing Agreement. For Article 3.2, the activities are the provision and security of the Boei communication and chatbot Service, hosting and storage, message delivery, knowledge-base processing, and configured integrations as described in the agency processing details below. Boei does not thereby undertake to provide the Agency or its clients with a separately managed VPS or general network service.
The Agency represents, on entering this Agreement for existing Covered Client Accounts and before adding new accounts or new processing, that it has the necessary client processing agreements and written authorization to appoint Boei and the further sub-processors under Article 8. It must maintain that authority throughout the processing.
Boei's obligations for client Personal Data are those set out in this Agreement, which the Parties intend to satisfy Article 28(3) and (4) GDPR. The Agency shall ensure that its client agreements are consistent with those obligations and that the required data protection obligations are passed through the processing chain. Any additional client requirement binds Boei only if Boei agrees to it in writing before the affected processing. Undisclosed client contracts do not impose additional obligations on Boei.
Each client acting as Controller remains responsible for its processing purposes, legal bases, required notices and consents, cookies and similar technologies, and its other statutory Controller duties. The Agency shall obtain the relevant client assurances, ensure its client agreements address these duties, and communicate lawful instructions to Boei. For Article 7.3 and the special-category data assurances in the Agency processing details table, the Agency undertakes to obtain and maintain the necessary client assurances and authorizations, including those required for special-category data, before instructing the affected processing. The Agency must not instruct processing where these requirements are not met.
As between the Parties, the Agency is responsible for its clients' use of Covered Client Accounts and their acts or omissions in connection with the Agency's obligations under this Agreement as for its own, subject to the liability provisions below. This allocation does not make the Agency the Controller of client data or reduce Boei's own obligations.
Boei processes Personal Data on documented instructions communicated by the Agency, subject to the legal exceptions in the standard Agreement. Boei may treat instructions from the Agency, including account configuration, as authorized by the relevant client unless it knows otherwise. This does not limit Article 3a.5 or Boei's obligations under applicable law. Direct client requests are referred to the Agency unless the continuity provisions below or applicable law require otherwise.
Requests, security and breach notifications, deletion and return instructions, sub-processor notices and transfer documentation pass between Boei and the Agency. The Agency forwards relevant information to affected clients without undue delay and coordinates their requests. Boei provides the assistance required by the standard Agreement. The existing deadlines, including Article 9.5, remain unchanged.
For Article 11, if Boei receives a request from a data subject concerning Covered Client Accounts, it shall notify the Agency without undue delay and in any event within five working days. Boei shall not decide or substantively answer that request without the Agency's documented instructions, except as required by Applicable Data Protection Law. A neutral acknowledgement or request to identify the relevant account is permitted. The Agency shall promptly forward the request to the relevant Controller and coordinate Boei's required assistance. This does not restrict a data subject's statutory rights or the powers of a competent authority.
The Agency gives Article 8 authorization on the basis of the required client authorizations. Annex 1 identifies Boei's further sub-processors. Boei remains responsible to the Agency under Article 8.5; the Agency remains responsible to its clients under Article 28(4) GDPR.
Sub-processor changes and objections follow Article 8 through the Agency. The Agency must coordinate with affected clients within the notice and objection periods in that Article. Where a justified objection affects a particular client's processing and that processing can reasonably be separated, the termination remedy in Article 8.4 applies to that affected account or service. It does not automatically terminate unaffected client accounts.
Audit requests under Article 5.7 are coordinated through the Agency. Boei first provides relevant existing documentation where it is sufficient to address the request. Routine on-site audits are coordinated as one agency audit in any twelve-month period. Additional audits remain available following a material security incident, where there are reasonable grounds to suspect non-compliance not resolved by the available evidence, at a competent supervisory authority's request, or where otherwise required by law. The standard confidentiality, notice, security and cost provisions continue to apply. Statutory audit and inspection rights are not restricted.
Article 12.1 is replaced as follows: each Party's total aggregate liability to the other arising out of or in connection with this Agreement, including indemnification under Article 13, whether in contract, tort (including negligence) or otherwise, is limited to the total fees actually paid by the Agency to Boei for the covered services in the three months immediately preceding the event giving rise to the claim. The same calculation applies to both Parties.
This is one aggregate limit for the Agency agreement across all Covered Client Accounts and the Agency's own covered processing, not a separate limit per client. Covered-service fees include the Agency's client plans and Custom Whitelabel where applicable.
Article 12.2 applies to both Parties: the limit does not apply to liability arising from either Party's wilful misconduct or gross negligence, or liability which cannot lawfully be limited or excluded. Articles 12.3 to 12.7 and Article 13 otherwise continue to apply, subject to the express amendments below. Any indemnification owed by either Party under Article 13, including for a breach attributable to the Agency's clients as allocated above, is subject to this same limit and its exceptions.
To the extent permitted by law, each Party bears any fine or administrative penalty imposed on it, and such amounts cannot be recovered from the other Party under Article 12 or 13. For covered processing, Articles 13.1 and 13.2 otherwise apply only to claims under Article 82 GDPR, not to corrective measures or other orders. Article 13.3 continues to apply to those indemnification claims.
Article 12.5 is replaced as follows: each Party shall notify the other in writing of a claim under this Article without undue delay after becoming aware of it. Late notification does not by itself forfeit the claim, but the other Party is not liable for loss to the extent caused by the delay.
Nothing in this Agreement restricts data subjects' mandatory rights under Article 82 GDPR or other Applicable Data Protection Law, supervisory powers, or liability and remedies under applicable standard transfer clauses where those clauses prohibit such a restriction. In a conflict, those mandatory rules and applicable standard transfer clauses prevail.
The Agency may select an available AI model for each client chatbot in accordance with the client's documented instructions.
Access to Personal Data by the Agency, its clients or their authorized users from outside the EEA is permitted only where a valid adequacy decision applies to that access or the Parties have agreed a valid transfer mechanism in writing before access starts. This Agreement does not itself provide such a mechanism. Any additional requirements under Applicable Data Protection Law remain applicable. A client being outside the EEA does not remove Boei's GDPR obligations.
Article 6 governs international transfers involving Boei's suppliers. It does not authorize access by the Agency, its clients or their authorized users from another country; that access is subject to the preceding paragraph. Relevant supplier transfer mechanisms and associated Transfer Impact Assessments may be requested under Article 6.6. If a required mechanism ceases to be valid or cannot be complied with, the affected access must stop until a valid mechanism and any required safeguards are in place.
For Article 6.2, Mistral AI's configured EEA response processing is not a transfer to the United States merely because it is an AI service. Other enabled services may involve transfers as identified in the applicable configuration and sub-processor information. Not every vendor in Annex 1 is used for every client.
For Articles 3a.4 and 6.4(c), Boei shall use suitable API or business processing terms and settings that prohibit training on covered client inputs and outputs, disable optional training or data sharing for that processing, and not submit covered Personal Data through feedback or experimental features that permit training. This does not promise zero retention: providers may retain limited content or logs for service delivery, security, abuse prevention or legal duties under their applicable processing terms. Boei shall disclose the retention applicable to an agreed client configuration on request.
Where the Agency or a client connects a service under its own account and direct contract, such as a customer-connected Twilio account, that party arranges the applicable data protection terms and transfer safeguards with its provider. Boei connects to that service on documented instructions and remains responsible for its own processing and disclosures. A customer-selected integration is not treated as a further sub-processor appointed by Boei solely because it is connected to the Service. This provision does not determine the status of any separate service Boei itself engages.
The Agreement follows the term in Article 4. Ending one client's processing does not by itself end the Agreement or require deletion of other clients' data. For an instruction to end one client's processing immediately, the maximum 28-day period in Article 4.4 runs from receipt of that documented instruction. If the instruction specifies a future end date, it runs from that date. Return, deletion, lawful retention and backup rotation otherwise follow Article 4.4 and Annex 3.
If the Agency has factually disappeared, ceased to exist in law or become insolvent, the relevant Controller may directly instruct Boei to end the processing of its Personal Data and return or delete that data in accordance with Article 4.4 and Annex 3. This limited continuity right may be exercised by that Controller after Boei verifies its identity and authority. The Agency must ensure its client agreements permit this procedure and provide the information needed to establish the relevant client's authority.
Boei may contact an affected client for this limited continuity purpose. Continuing the Service under a new contracting arrangement requires verified authority and the applicable processing agreement before further processing under that arrangement. There is no automatic transfer of a client account to another contracting party.
Non-payment may affect Service availability under the Main Agreement but does not remove the applicable security, return and deletion obligations or permit use of client Personal Data for other purposes.
Where Boei intends to terminate the Agency's service for non-payment, it shall notify the Agency in writing of the proposed termination, the affected accounts and the return or deletion process before termination takes effect, subject to any legally required immediate action. The Main Agreement governs suspension, payment and termination rights; this notice does not promise continued paid functionality. The 28-day period in Article 4.4 starts on effective termination, not on a later client communication.
The Agency shall promptly inform affected clients and arrange lawful return or deletion instructions. If the Agency has not confirmed within five working days after Boei's notice that this has been done, or cannot be reached, Boei may notify the verified client contact directly, limited to the impending end of processing and how to arrange authorized return or deletion. Where reasonably possible this occurs before deletion and with time to exercise the applicable return right. Boei shall take reasonable steps to verify a requester's identity and authority, protect other clients' data and avoid inconsistent instructions. The right to contact a client does not authorize marketing, an automatic account transfer, continued processing without a valid agreement, or an extension of the statutory or agreed deletion period.
The standard DPA version and annexes reproduced in the signed document are the agreed text at signing. The signed text is retained with its content hash and verification reference. Publication of a later version does not by itself replace the signed Agreement. Changes follow Article 4.2, without affecting the update mechanisms expressly permitted by the Agreement, including Article 8 for sub-processor changes.
| Element | Description |
|---|---|
| Subject matter | Providing the Boei communication, inbox, live-chat, AI chatbot and related configured integration services for the Agency and Covered Client Accounts. |
| Duration | The term of the covered Service and the return, deletion and backup periods in Article 4.4 and Annex 3, subject to lawful retention. |
| Nature and purposes | Receiving, hosting, organizing, searching, retrieving, transmitting and displaying communications; routing and assigning conversations; forms, automated responses, configured workflows and notifications; ingesting authorized websites and documents into a knowledge base; processing the knowledge base and generating AI responses; support and security activities permitted by this Agreement; and transmitting data to client-selected integrations on documented instructions. |
| Channels and integrations | Website widgets, web chat, live chat, email and connected WhatsApp or messaging channels where enabled. CRM and calendar integrations process only the data needed for the connection and instructed action. A provider under a client-owned contract is distinguished from a further sub-processor appointed by Boei as set out above. |
| Categories of data subjects | Website visitors, leads, clients, prospects and other correspondents; the Agency's and clients' staff, contractors and authorized users; suppliers and other contacts whose information is lawfully submitted through the Service. |
| Types of Personal Data | Names and contact details; business and account identifiers; IP addresses, browser/device information and related technical metadata; messages, emails, form responses, attachments and uploaded documents; conversation history, assignments and instructed notes; knowledge-base source material and related search data; appointment information, calendar availability and booking contact details where enabled; and CRM records or identifiers actually exchanged by a configured integration. |
| Frequency | Ongoing or event-driven during use, with periodic knowledge-base synchronization where enabled. |
| Special-category data | The Service is not designed or intended as a specialist tool for special categories of Personal Data under Article 9 GDPR, including health, biometric, political, religious or philosophical, trade-union, sexual-orientation or sex-life data. For client processing, the Agency warrants that it has obtained and maintains the relevant Controller's assurances that such data will not be submitted except where incidental to normal chat interactions or required or permitted by the law applicable to that Controller's sector; that, in either case, a valid lawful basis under Article 9(2) exists and any DPIA required under Article 35 has been carried out; and that the Controller remains responsible for its lawful basis and sector-specific safeguards. The Agency shall communicate suitable lawful instructions before instructing the affected processing. For the Agency's own Controller processing, the Agency gives these assurances directly and bears those Controller duties. |
| Instructions and access | The Agency communicates authorized instructions and controls authorized account users. Internal Agency processing has the separate Controller role described above. Boei's own account and billing administration is governed by its applicable privacy notice. |
The full sub-processor annex reproduced below remains part of this Agreement, subject to these corrections and role explanations:
For Annex 3, network-edge DDoS and WAF services apply to hosts on which they are enabled. The general reference to Cloudflare does not promise Cloudflare protection for every application or chatbot endpoint. All other agreed technical and organizational measures remain unchanged. Boei remains responsible for maintaining an accurate applicable vendor list and the required contracts and safeguards; these clarifications do not replace that duty.
The following standard text is incorporated subject to the agency provisions above.
Effective date: November 5, 2026 View legal changelog
For data protection inquiries: support@boei.help
To request a countersigned copy of this Agreement, use the self-service form at app.boei.help/dpa.
Ruby Foundry B.V., trading as Boei (hereinafter: Boei), is registered at the Dutch Chamber of Commerce with number 99995662 and is located at Mulderstraat 35 (3581GP) in Utrecht (The Netherlands), hereinafter referred to as "Processor".
For the purpose of this agreement, the following terms have been given the following meaning:
Controller: the customer entity that has entered into an Agreement with Boei for the provision of Services and that determines the purposes and means of the processing of Personal Data within the meaning of Article 4(7) of the GDPR.
Service: the provision of software by Boei.
Agreement: this document, including any annexes, containing the terms and conditions for cooperation between the Parties.
3a. Main Agreement: the principal agreement between Boei and the Controller governing the provision of the Services, being Boei's Terms and Conditions and, where applicable, the End User License Agreement and any Offer or order form accepted by the Controller. This Processor Agreement forms an integral part of the Main Agreement.
Offer: any offer or quotation to the Controller for the provision of Services by Boei
Services: the services offered by Boei, including the provision of software and related support.
Parties: Boei and Controller hereinafter jointly referred to as: "Parties".
Taking into account that:
This Agreement applies to every Offer from Boei, every Agreement between Boei and the Controller and to every Service offered by Boei.
Before a (distance) Agreement is concluded, the Controller will be provided with this data processing agreement. If this is not reasonably possible, Boei will indicate to the Controller how the Controller can view the data processing agreement.
Deviation from this Agreement is not possible. In exceptional situations it is possible to deviate from this Agreement, if and insofar explicitly agreed upon in writing by Boei.
This Agreement also applies to additional, amended and follow-up orders from the Controller.
The data processing agreements of the Controller are excluded.
If one or more provisions of this Agreement are partially or wholly invalid or are annulled, the other provisions of this Agreement will remain in force, and the invalid/nullified provision(s) will be replaced by a provision with the same purport as the original provision.
Uncertainties about the content, explanation or situations that are not regulated in this Agreement must be assessed and explained in the spirit of these general terms and conditions. The agreements in the Agreement are leading and take precedence over these general terms and conditions.
The rights and obligations under the Agreement between the Parties cannot be transferred by the Controller to a third party unless Boei grants the Controller explicit and prior permission. Boei is free to attach further conditions to this.
Processor undertakes to process Personal Data on behalf of Controller under the conditions of this Processor Agreement. Processing will only take place in the context of the execution of the Main Agreement and this Processor Agreement within the meaning of Article 28 paragraph 3 GDPR.
The Processor is prohibited from processing the Personal Data for a purpose other than the purpose established by the Controller. The purpose of the processing is to provide the services requested by the Controller as described and recorded in the Main Agreement. To this end, the following activities are performed, among other things, the storage of (personal) data by means of hosting and cloud storage as well as the security thereof, making a VPS available, setting up and keeping a network available, and other related activities.
The category of data subjects from whom the Personal Data is collected concerns the personal data of the (potential) customers of the Controller, visitors to the website or web application, suppliers, account holders and/or other persons or relations of the Controller with whom the Processor comes into contact insofar as they are processed on behalf of the Controller.
The category of personal data that can be processed are: contact and name and address details, customer or identification number(s), IP address and other location data, content of e-mails, chat messages, contact forms and other (personal) data that are stored or processed via the services of the Processor.
Processor will not process the personal data for any purpose other than as determined by the Controller. The Controller will inform the Processor of the processing purposes insofar as they have not already been mentioned in this Processor Agreement.
Processor has no control over the means for processing and storing the personal data. The Controller is responsible for determining the purpose of the processing and must clearly record this.
Processing will take place manually (for example, when Processor staff access data to provide support, troubleshoot issues, or handle data subject requests, as further limited by Article 3a) as well as (semi)automatically.
The personal data to be processed on behalf of the Controller remain the property of the Controller and/or the relevant data subjects.
The Processor shall process Personal Data solely for the purpose of providing the Services as documented in this Agreement and in accordance with the Controller's written instructions. The Processor shall not process Personal Data for any other purpose, including for the Processor's own commercial benefit.
The Processor may review chat interactions processed on behalf of the Controller for the purposes of quality assurance, troubleshooting, and optimising the configuration and performance of the Service as provided to the Controller. Such review is considered part of the provision of the Service and shall not constitute processing for the Processor's own independent purposes.
The Processor shall not use chat content, interaction data, or any other Personal Data processed on behalf of the Controller for:
This Agreement commences upon acceptance of the Main Agreement by the Controller and has been entered into for the duration of the Main Agreement.
Changes to this agreement as a result of changes in any underlying agreement for services, legislation or regulations or other relevant circumstances are only legally valid if they are added to the Processor Agreement after consultation and with the explicit permission of the parties.
This agreement ends by operation of law if the Main Agreement ends.
As soon as the agreement has been terminated for any reason and in any way whatsoever, the Processor – at the discretion of the Controller – will return all Personal Data that it holds in original or copy form to the Controller and/or delete these original Personal Data and any copies within a maximum period of 28 days. The obligation to delete under this Article applies to Personal Data held in active systems. Personal Data contained in encrypted backups cannot be selectively erased and is deleted when those backups are rotated out of retention in accordance with Annex 3, section 4. Any costs associated with this will be borne by the Controller.
Confidentiality, liability and dispute resolution provisions shall remain in full force and effect after termination of this Agreement.
The Processor is obliged to comply with the conditions imposed on the processing of Personal Data on the basis of applicable laws and regulations, in particular the GDPR and the GDPR Implementation Act.
The Processor is prohibited from enriching its own database(s) and/or files with any (personal) data from the database(s) of the Controller, except in the event that the Processor provides temporary database(s) and/or files for the proper processing of the Personal Data. The temporary files are deleted from the active production environment immediately from the moment that these temporary files are no longer needed for processing. Any residual copies contained in encrypted backups cannot be selectively erased and are deleted on backup rotation in accordance with Annex 3, section 4.
The Processor will inform the Controller at its first request about the measures it has taken with regard to its obligations under this Processor Agreement.
If the Controller gives instructions to the Processor with regard to the processing of Personal Data, the Processor must follow these instructions if this is necessary for correct processing, except in the event that these instructions are contrary to laws and regulations and any applicable professional and behavioral rules. Only the Controller is authorized to give its exclusive opinion in this regard.
All obligations resting on the Processor also apply to persons who process Personal Data under the authority of the Processor (after explicit permission from the Controller), including employees and third parties engaged by the Processor.
Processor is responsible for ensuring that only employees and/or third parties have access to the personal data for which access is necessary for the execution of the agreement. The employees and/or third parties work under the responsibility of the Processor.
The Controller has access to Personal Data through the Processor's application interface as part of the normal use of the Service. For access to Personal Data beyond what is available through the application interface, or for the purpose of verifying compliance with this Agreement, the Processor shall cooperate with reasonable inspection and audit requests from the Controller. The Controller shall provide at least fourteen (14) days' prior written notice for any audit, which shall be conducted during normal business hours and in a manner that minimises disruption to the Processor's operations. Any audit shall be subject to the Processor's confidentiality requirements and shall not compromise the security or privacy of other customers' data. The Controller shall bear its own costs in connection with any audit. If an audit requires significant involvement of the Processor's personnel beyond providing standard documentation and access, the Controller shall reimburse the Processor's reasonable costs, agreed in advance.
This agreement is not transferable, unless expressly agreed otherwise.
The Processor shall process Personal Data within the European Economic Area (EEA) as its primary processing location. All primary hosting, database, storage and email delivery takes place within the EEA (Hetzner Germany (Nuremberg), Weaviate (Frankfurt, Germany), Mailgun (EU endpoint), AWS EU-West Ireland).
Certain providers identified in Annex 1 may process Personal Data outside the EEA, including where the contracting entity is established in the EEA. Relevant categories include:
The Processor shall inform the Controller without undue delay of any material changes to the international transfer arrangements described in this Article, including changes to the legal basis relied upon.
Upon request, the Processor shall provide the Controller with copies of the relevant transfer mechanisms (e.g., SCCs) and any associated Transfer Impact Assessments.
The Processor will perform the activities for the Controller in the context of this agreement as referred to in Article 3.2 of this agreement, as well as other activities as laid down in the Main Agreement.
The Processor is responsible only for the processing of Personal Data carried out on behalf of the Controller under this Agreement and in accordance with the Controller's documented instructions. The Processor is not responsible for: (a) the collection of Personal Data by the Controller; (b) processing for purposes not documented in this Agreement or not instructed by the Controller; (c) processing by third parties not engaged by the Processor as sub-processors under Article 8.
The Controller is solely responsible for compliance with the ePrivacy Directive (2002/58/EC), its national implementations (including the Dutch Telecommunications Act / Telecommunicatiewet), and any equivalent cookie or tracking legislation in respect of the Controller's own website and the deployment of the Boei widget on that website. This includes, where required, obtaining prior informed consent from website visitors for any cookies or similar technologies set by the widget (such as the widget_load_key cookie used for returning-visitor recognition and AI conversation continuity). The Processor provides configuration options that allow the Controller to disable cookie-setting behaviour of the widget where needed.
Controller grants Processor general written authorisation to engage the sub-processors listed in Annex 1 to this Agreement.
Processor shall maintain an up-to-date list of sub-processors in Annex 1, which shall include the company name, registered office or incorporation jurisdiction as identified in Annex 1, description of services provided, and location of data processing.
The Processor shall publish any intended addition or replacement of a sub-processor that processes Controller Personal Data by updating the sub-processor list in Annex 1 on its website at least thirty (30) days prior to the change taking effect, including the date of the update. The Processor shall notify the Controller by email at the designated account contact address of such intended changes. It is the Controller's responsibility to keep its contact address current. Controller may object to the intended change within fourteen (14) days of the published update, provided that such objection is based on reasonable, documented grounds relating to data protection. This prior-notification obligation does not apply to vendors of the Processor's own marketing website (listed separately in Annex 1 for transparency), which do not process Controller Personal Data.
If Controller raises a reasonable objection and the parties are unable to resolve the matter within thirty (30) days, Controller may terminate the Agreement on written notice without penalty.
Processor shall impose the same data protection obligations as set out in this Agreement on any sub-processor by way of a contract. Processor remains fully liable to Controller for the performance of the sub-processor's obligations.
The current list of sub-processors is maintained at boei.help/legal/subprocessors. The list published on that page is the authoritative list and forms an integral part of this Agreement (Annex 1). A snapshot is reproduced below for convenience at the time of publication of this Agreement.
The security level of the measures must at least meet a level that is not unreasonable in the context of the associated costs, sensitivity of the Personal Data concerned as well as the state of the art and risks. Processor does not guarantee that the security measures it has taken are effective at all times, under all circumstances. In consultation, the parties can take other additional or further security measures.
The Processor has its own responsibility to inform itself and/or its employees and third parties to be engaged of all protocols, the (security) policy and other instructions that enable and promote safe processing.
Processor is responsible and liable for its part of the processing.
If there is a breach in the security of the Personal Data, which can cause damage or have adverse consequences for the protection of the Personal Data, the Processor shall inform the Controller without undue delay and, where feasible, no later than 48 hours after becoming aware of the personal data breach. The Controller will then inform the competent supervisory authority and any data subjects as soon as possible about the infringement. The Processor's obligation to report only applies if a data breach has occurred.
Pursuant to the Processor's notification obligation, the notification of a breach must consist of at least the following components:
The Controller must keep a register of all infringements (including incidents) in accordance with article 33 paragraph 5 GDPR.
If a breach of the security of the Personal Data has occurred at the Processor, the Processor is obliged to take appropriate measures at its own expense to prevent future incidents and/or breaches.
Taking into account the nature of the processing and the information available to the Processor, the Processor shall provide the Controller with reasonable assistance in ensuring compliance with the Controller's obligations under Articles 32 to 36 GDPR, as set out in this Article.
Security of processing (Article 32). The Processor shall, upon the Controller's reasonable written request, make available the information necessary to demonstrate compliance with the security obligations set out in Article 9 and Annex 3 of this Agreement, including the technical and organisational measures then in effect.
Personal data breaches (Articles 33 and 34). In addition to the notification obligations set out in Article 9.5 and 9.6, the Processor shall, upon the Controller's reasonable request, assist the Controller in:
Such assistance shall be provided taking into account the nature of the processing and the information available to the Processor, and relates to processing carried out on behalf of the Controller.
Data protection impact assessments and prior consultation (Articles 35 and 36). Where the Controller is required to carry out a data protection impact assessment or to consult the competent supervisory authority prior to processing, the Processor shall, upon reasonable written request, provide the information within its possession that is reasonably necessary for the Controller to fulfil these obligations, insofar as such information relates to the processing carried out under this Agreement and is not otherwise available to the Controller.
The assistance described in this Article shall be provided taking into account the nature of the Service and the information available to the Processor. The Processor is not obliged to provide information relating to its wider business, other customers, or matters unrelated to the processing carried out on behalf of the Controller. Where standard documentation made available by the Processor (including this Agreement, Annex 3, and the security information published by the Processor) is sufficient to meet the Controller's request, provision of that documentation shall be deemed to satisfy the Processor's obligations under this Article.
Assistance under this Article shall be provided free of charge where it requires only the provision of standard documentation. Where a request requires material assistance beyond the provision of standard documentation, the Processor may charge reasonable costs to the extent permitted by applicable law, provided that such costs are communicated to and agreed with the Controller in advance.
Processor and its employees, as well as third parties engaged by Processor, are obliged to maintain the confidentiality of all personal data, sensitive information and/or company data obtained through this agreement. The duty of confidentiality does not apply if the Controller has given explicit and written permission to the Processor to share this data and information with third parties, or if there is a legal obligation to provide the data and information to a third party. After the expiry of this agreement, the parties remain obliged to adhere to this confidentiality obligation. If a party is required to provide information to a third party on the basis of a legal obligation, the providing party is obliged to inform the other party about this in writing without delay, at least within 24 hours.
If and insofar as possible, the Processor can refer the relevant (government) body that requests information directly to the Controller. Processor can provide contact information of the Controller in this regard to this (government) body.
In the event that the Processor receives a request for inspection from a data subject or an authorized body, the Processor will process this request as soon as possible, but at the latest within 5 working days. If it is not possible to handle the request yourself, the request will be forwarded to the Controller within 5 working days. If requested to do so, the processor must cooperate in the execution of the request. The (reasonable) costs that the Processor must incur for the benefit of the cooperation are for the account of the Controller.
The provisions of Article 11.1 apply mutatis mutandis if a data subject wishes to assert other rights such as the right to rectification, erasure, right to restriction of processing, right to data portability, right to object and rights in the case of automated individual decision-making, as laid down in sections 3 and 4 of the General Data Protection Regulation.
Where a request concerns the erasure of Personal Data, erasure is carried out in the active production environment. Personal Data contained in encrypted backups cannot be selectively erased and is deleted on expiry of the backup retention period set out in Annex 3, section 4.
The Processor's total aggregate liability to the Controller for all claims arising out of or in connection with this Agreement, whether in contract, tort (including negligence), or otherwise, shall be limited to the total fees paid by the Controller to the Processor in the three (3) months immediately preceding the event giving rise to the claim.
The limitation set out in Article 12.1 shall not apply to:
In respect of claims under Article 82 GDPR, each party shall be liable for damage caused by processing that infringes the GDPR to the extent attributable to its own acts or omissions. Where both parties are involved in the same processing that caused damage, each party shall bear liability in proportion to its responsibility for the damage, in accordance with Article 82(2) and (5) GDPR.
Neither party shall be liable to the other for any indirect, incidental, special, or consequential damages, including but not limited to loss of profit, revenue, or goodwill, except where such exclusion is not permitted under mandatory applicable law.
The Controller shall notify the Processor in writing of any claim under this Article without undue delay, and in any event within six (6) months of becoming aware of the event giving rise to the claim. Failure to notify within this period shall result in forfeiture of the claim, unless the Controller demonstrates that timely notification was not reasonably possible.
Each party shall use reasonable efforts to mitigate any loss or damage for which the other party may be liable under this Agreement.
In the event of any conflict between the liability provisions of this Agreement and those of the Main Agreement (including the Terms and Conditions) in relation to claims arising out of or in connection with the processing of Personal Data or breaches of data protection law, the liability provisions of this Agreement shall prevail. For all other claims, the liability provisions of the Main Agreement apply.
To the extent that a fine, administrative penalty (including any administrative fine under Article 83 GDPR), corrective measure or other order is imposed on the Processor by a competent supervisory authority, or a claim under Article 82 GDPR is brought against the Processor by a data subject or third party, and such amount is attributable to a breach by the Controller of its obligations under this Agreement or under applicable data protection law, the Controller shall indemnify the Processor for the amount so attributable, subject to the limitations set out in Article 12.
Reciprocally, and on the same terms, the Processor shall indemnify the Controller to the extent that a fine, administrative penalty, corrective measure, order, or claim under Article 82 GDPR is imposed on or brought against the Controller and is attributable to a breach by the Processor of its obligations under this Agreement or under applicable data protection law, subject to the limitations set out in Article 12.
The indemnified party shall (a) notify the indemnifying party in writing of any claim covered by this Article without undue delay after becoming aware of it, (b) provide the indemnifying party with reasonable cooperation and access to information relevant to the defence of the claim, and (c) not settle or admit liability in respect of any such claim without the indemnifying party's prior written consent, which shall not be unreasonably withheld or delayed. The indemnifying party shall have the right to assume and control the defence of the claim at its own cost, using counsel of its choice, provided that the indemnified party may participate in the defence at its own cost.
If any provision of this agreement is found to be invalid or void, the remaining provisions will remain in full force and effect. The parties will then enter into consultation in order to agree on a new provision with regard to the void or voided provision, whereby the purpose and intent of the void or voided provision will be taken into account as much as possible.
The parties will cooperate fully with each other to adjust this agreement and make it suitable for any new or amended privacy legislation.
This agreement is governed by Dutch law.
All disputes that arise between parties that arise from or are related to or relate to this Processor Agreement will be settled by the competent court of the Processor's place of business, namely the Midden-Nederland District Court (location Utrecht).
The current, authoritative list of sub-processors is maintained at boei.help/legal/subprocessors. The snapshot reproduced below reflects the list at the effective date of this Agreement; any more recent additions or replacements published on the sub-processors page supersede this snapshot.
| Sub-Processor | Registered Office / Incorporation Jurisdiction | Services | Processing Location |
|---|---|---|---|
| Hetzner Online GmbH | Gunzenhausen, Germany | Primary server hosting, database hosting, and backup storage | EU (Nuremberg, Germany) (EEA) |
| Weaviate B.V. | Amsterdam, Netherlands | Vector database for AI chatbot knowledge base | EU (Frankfurt, Germany) (EEA) |
| Mistral AI, SAS | Paris, France | AI language model processing for chatbot functionality (configurable per customer) | EU (France) (EEA) |
| OpenAI Ireland Ltd. | Ireland | AI language model processing for enabled chatbot and knowledge-base functions | USA and other locations under the applicable provider terms |
| Anthropic Ireland, Limited | Ireland | AI language model processing for chatbot functionality (configurable per customer) | USA and other locations under the applicable provider terms |
| Google Cloud EMEA Limited | 70 Sir John Rogerson's Quay, Dublin 2, Ireland | Gemini Developer API Paid Services for configured chatbot functionality, under Google's Data Processing Addendum for Products Where Google is a Data Processor | USA and other locations under the applicable provider terms |
| Amazon Web Services EMEA SARL | Luxembourg | Static asset storage (images) | EU-West (Ireland) (EEA) |
| Mailgun Technologies, Inc. | San Antonio, TX, USA | Email delivery via the Service. Used for: (a) emails from the Processor to Controller account holders (account notifications, billing, product updates, newsletters); (b) emails from the Controller to its data subjects where the Controller has enabled the email channel (replies, conversation messages); (c) chat transcripts sent to a data subject on request; (d) lead and conversation notifications to Controller staff. Not used for marketing by the Processor to the Controller's data subjects. | EU (api.eu.mailgun.net) (EEA) |
| SideGuide Technologies, Inc. d/b/a Firecrawl | Delaware, USA (incorporation jurisdiction) | Website crawling for AI chatbot knowledge base ingestion; fetched public pages may contain personal data | USA |
| Stripe, Inc. | San Francisco, CA, USA | Payment processing and subscription billing | USA |
| Cloudflare, Inc. | San Francisco, CA, USA | DNS and network-edge services for boei.help and cdn.boei.help where enabled, including static resources used by widgets. It may receive request metadata such as visitor IP addresses through those hosts. This does not describe app.boei.help or the chatbot API as Cloudflare-proxied. | Global edge network |
| ProductLift | Utrecht, Netherlands | Product changelog widget embedded in the Boei admin area and authenticated feedback portal (feedback.boei.help) linked to Boei accounts for voting and posting. Operated by Ruby Foundry B.V., the same legal entity as Boei; listed for transparency. | EU (Falkenstein, Germany) (EEA) |
The response-model choice is configurable. Providers may also support other enabled Service functions. The applicable provider information covers those functions as well; not all providers listed above necessarily process data for every customer.
The vendors listed below are used exclusively on Boei's own marketing website (boei.help). They do not process Controller Personal Data submitted through the Service and are listed here for transparency only. They are not subject to the 30-day prior-notification obligation in Article 8.3; the Processor may add, replace or remove these vendors at its discretion.
| Vendor | Registered Office / Incorporation Jurisdiction | Services | Processing Location |
|---|---|---|---|
| Plausible Insights OÜ | Tallinn, Estonia | Cookie-less website analytics for boei.help (aggregate traffic metrics, no personal profiles) | EU (Germany) (EEA) |
| Google LLC (Google Tag Manager & Google Analytics 4) | Mountain View, CA, USA | Tag management and website analytics for boei.help (only loaded after consent via the cookie banner) | USA |
| Element | Description |
|---|---|
| Subject matter of processing | The provision of the Boei customer communication widget and AI chatbot service, including the receipt, storage, processing, and delivery of chat messages and other communications between the Controller's website visitors and the Controller. |
| Duration of processing | For the duration of the Agreement between the Controller and the Processor. Upon termination, Personal Data shall be deleted or returned in accordance with Article 4. |
| Nature and purpose of processing | The processing consists of receiving, storing, transmitting, and displaying chat messages and related communications submitted by website visitors through the Boei widget. Where AI chatbot functionality is enabled, processing includes submitting message content to AI model providers to generate automated responses on behalf of the Controller. Processing also includes sending notifications and chat transcripts via email, and crawling the Controller's website to build a knowledge base for AI chatbot functionality. |
| Categories of data subjects | Website visitors, prospective clients, existing clients, and other individuals who interact with the Controller's website through the Boei widget. |
| Categories of personal data | Name, email address, phone number, IP address, browser and device information, geographical location data, chat message content, contact form submissions, and any other personal data voluntarily provided by data subjects through the widget. |
| Special categories of personal data | The Service is not designed or intended as a specialist tool for the processing of special categories of personal data within the meaning of Article 9 GDPR (e.g., health data, biometric data, data concerning political opinions, religious or philosophical beliefs, trade union membership, or sexual orientation). The Controller shall not submit special categories of personal data through the Service except (i) where incidental to normal chat interactions, or (ii) where required or permitted by applicable law in the Controller's sector (for example, education or healthcare), in which case the Controller warrants that it has a valid lawful basis under Article 9(2) GDPR and has carried out any Data Protection Impact Assessment required under Article 35 GDPR. The Controller remains solely responsible for determining the lawful basis and for any sector-specific safeguards. |
This Annex describes the technical and organisational measures implemented by the Processor pursuant to Article 9 and Article 28(3)(c) and 32 GDPR. The Processor may update these measures from time to time in line with technological developments, provided that the overall level of security is not reduced below that described in this Annex.