Data Processing Agreement

1. Parties and scope

This agreement is between the business that uses Fabiana (the “Controller”) and Fabiana (the “Processor”). It forms part of the Terms of Service and applies to the personal data the Processor processes on the Controller’s behalf through Fabiana.

2. Details of the processing

• Subject and purpose: answering the Controller’s customers on its channels with AI, managing its contacts, conversations, bookings, payments and campaigns.
• Duration: while the Terms are in force, plus the deletion period in section 9.
• Data subjects: the Controller’s customers, leads and contacts, and its team members.
• Data: identification and contact details, message and call content, booking and payment references, consent records, and any data the customers themselves send.
• Special categories: not intended. The Controller should not ask customers for them through Fabiana.

3. Instructions

The Processor processes the data only on the Controller’s documented instructions — these Terms, this agreement and the Controller’s configuration of Fabiana — unless the law requires otherwise, in which case it tells the Controller first where the law allows. The Processor tells the Controller if it believes an instruction breaks data protection law.

4. Confidentiality

Everyone authorised to process the data is bound by confidentiality and accesses it only as needed to provide or support the service.

5. Security

• Encryption in transit (TLS 1.2+) and at rest (AES-256); channel access tokens encrypted again by the application.
• Each organisation’s data isolated from the others’; role-based access for team members; an audit log of their actions.
• Production access limited to authorised staff; point-in-time backups kept 35 days.
• Logs kept 30 days and stripped of email addresses and phone numbers.

6. Sub-processors

The Controller authorises the sub-processors listed in the Privacy Policy. The Processor binds each to data protection obligations equivalent to these, and remains responsible for them. It announces a new sub-processor at least 30 days before using it; the Controller may object on reasonable grounds and, if no solution is found, terminate the affected service.

7. International transfers

Where data is transferred outside the EEA, the transfer relies on the EU–U.S. Data Privacy Framework for certified recipients, or on the European Commission’s standard contractual clauses.

8. Assistance

• Data subject requests: Fabiana lets the Controller export or erase all data about a person, and record or withdraw marketing consent. The Processor forwards any request it receives directly.
• Personal data breaches: the Processor notifies the Controller without undue delay and within 48 hours of becoming aware of a breach affecting its data, with the information it has, so the Controller can meet its 72-hour deadline.
• Impact assessments and consultations: the Processor provides the information reasonably needed.

9. End of the service

When the Terms end, the Processor deletes the Controller’s data within 30 days of its request, after letting it export what it needs, unless the law requires keeping it. Data in backups is overwritten within 35 days.

10. Audits

The Processor makes available the information needed to show compliance with this agreement and allows audits by the Controller or an auditor it appoints, on 30 days’ notice, at most once a year unless a breach or an authority requires it.