Data Processing Agreement
Agreement under Art. 28 GDPR between the customer as controller (Customer) and FAMMRO e.U., Am Golfplatz 45, 4225 Luftenberg an der Donau, Austria, as processor (FAMMRO).It applies to all processing of personal data that FAMMRO performs for the Customer under the Terms of Service (Main Contract) and is concluded when the Terms are accepted.
1Subject matter, duration and purpose
1.1FAMMRO processes personal data to receive, on behalf of the Customer, requests from the Customer's customers via chat widget, messengers, email and marketplaces, to answer them automatically and through the Customer's team, to manage conversations, contacts and leads, to operate a knowledge base and to retrieve data from the Customer's shops.
1.2This agreement applies as long as FAMMRO processes data for the Customer.It does not end before the data has been deleted or returned under section 10.
2Types of data and data subjects
| Data subjects | Data |
|---|---|
| Customers and prospects of the Customer | name, display name, profile picture, email, phone number, ID on the channel, messages, files, images, voice messages, language, order references and shipping status, visitor ID and session ID of the widget, approximate origin, timestamps |
| Team members of the Customer | name, email, role, activities in conversations |
| Persons in the knowledge base | information the Customer stores in files, texts or on its website |
FAMMRO only processes special categories of data under Art. 9 GDPR and payment card data if the Customer receives them via its channels contrary to section 7.4 of the Terms.The Customer configures its channels so that such data is avoided as far as possible.
3Instructions
3.1FAMMRO processes the data only on documented instructions from the Customer, including with regard to transfers to third countries, unless EU or Austrian law requires FAMMRO to process it.In that case FAMMRO informs the Customer beforehand, unless the law prohibits this.
3.2Instructions are the Main Contract, this agreement and the settings the Customer makes in the console.The Customer gives further instructions in text form.Instructions beyond the agreed scope of services are treated by the parties as a request to change the services.
3.3If FAMMRO considers an instruction unlawful, FAMMRO informs the Customer without delay and may suspend its execution until the Customer confirms or changes it.
3.4FAMMRO may create anonymized, aggregated statistics without any personal reference from the data processed on behalf of the Customer, for example the number of messages per day and channel, the share of conversations resolved by the bot, waiting times, languages and topic categories.They contain no names, texts or identifiers.FAMMRO may use them indefinitely, for the Customer's reports in the console, also after the retention period of the chat histories has expired, and, aggregated across all customers, to improve and bill the service.When the Main Contract ends, FAMMRO deletes the statistics relating to the Customer's company.Only values aggregated across all customers without reference to any company remain.
4Obligations of FAMMRO
4.1FAMMRO commits all persons with access to the data to confidentiality, unless they are subject to a statutory obligation of confidentiality (§ 6 Austrian Data Protection Act).
4.2FAMMRO implements the technical and organizational measures under Art. 32 GDPR described in Annex 2. FAMMRO may develop them further as long as the level of protection does not decrease.
4.3FAMMRO supports the Customer with appropriate measures in responding to requests from data subjects.For this the console offers functions to find and correct data and to export and delete the data of individual data subjects.Deletions are subject to the limits in section 10.4.If FAMMRO receives a request directly, FAMMRO forwards it to the Customer and does not answer it itself unless instructed by the Customer.
4.4FAMMRO supports the Customer in its obligations under Art. 32 to 36 GDPR, taking into account the nature of processing and the information available to FAMMRO.
4.5FAMMRO notifies the Customer of a personal data breach without undue delay, where possible within 48 hours of becoming aware of it, with the information under Art. 33(3) GDPR as far as available.The notification is not an admission of fault.
4.6FAMMRO has not appointed a data protection officer.The contact for data protection is support@fammro.com.
5Obligations of the Customer
5.1The Customer is responsible for the lawfulness of the processing, in particular for being permitted to collect the data and provide it to FAMMRO, for informing its customers and for obtaining required consents.
5.2The Customer chooses the channels, shops and platforms it connects to FAMMRO.Their providers, such as Meta, Telegram, Google, Microsoft, shop systems and marketplaces, are not sub processors of FAMMRO but services the Customer uses itself.
5.3The Customer informs FAMMRO without delay if it notices errors or irregularities in the processing.
6Sub processors
6.1The Customer grants FAMMRO general authorization under Art. 28(2) GDPR to engage sub processors.It covers the sub processors on the current list that FAMMRO sends the Customer on request under Annex 1, as well as further or replacement sub processors under section 6.2.
6.2FAMMRO informs the Customer at least 30 days before engaging a new sub processor by email and on this page.The Customer may object in text form within this period for an important data protection reason.If the parties cannot agree, the Customer may terminate the Main Contract as of the date the new sub processor is engaged.No further claims arise from the objection.In urgent cases, such as the failure of a provider or a security vulnerability, FAMMRO may switch immediately and informs the Customer without delay.
6.3FAMMRO contractually binds every sub processor to a level of protection equivalent to this agreement.
7Transfers to third countries
FAMMRO transfers data to countries outside the EEA only in accordance with Chapter V GDPR, in particular based on an adequacy decision such as the EU US Data Privacy Framework, or on the European Commission's standard contractual clauses.The Customer instructs FAMMRO to conclude the standard contractual clauses with sub processors on its behalf where necessary.
8Evidence and audits
8.1On request, FAMMRO provides the Customer with the information necessary to demonstrate compliance with this agreement, in particular these documents, descriptions of the measures and evidence from the sub processors.
8.2If this information demonstrably does not suffice, the Customer may carry out an audit once per calendar year or have it carried out by an auditor bound to confidentiality who is not a competitor of FAMMRO.The Customer announces it at least 30 days in advance.The audit takes place during business hours, does not disrupt operations and does not extend to data of other customers.The Customer bears the costs of the audit and compensates FAMMRO's effort under section 9. Audits by a supervisory authority remain unaffected.
9Compensation for support
The Customer compensates support under sections 4.3, 4.4 and 8 that goes beyond the functions of the console and minor effort according to reasonable effort, unless it is caused by a breach by FAMMRO.
10End of processing
10.1Until the end of the Main Contract the Customer can export its chat histories from the console and delete data itself.After the end of the contract FAMMRO deletes the data as soon as the Customer deletes its account or requests it, at the latest 90 days after the end of the contract, unless a statutory retention obligation applies.On request FAMMRO confirms the deletion in text form.
10.2Backups are encrypted and are overwritten in the regular backup cycle, after 30 days at the latest.Until then they are protected against access and serve only to restore data after an outage.
10.3During the term FAMMRO deletes chat histories automatically after the retention period of the license stated in the Privacy Policy.
10.4The Customer can export and delete the data of individual data subjects in the console.The following applies to deletions:
- They do not apply retroactively to backups, which are overwritten under section 10.2.
- Data the Customer has transferred to its own systems, for example to a CRM system or through an export, the Customer deletes there itself.
- Change log entries about the person remain as events, and personal content in them is replaced with “deleted”.This serves accountability and security (Art. 5(2) and Art. 17(3) GDPR).
- If the person has unsubscribed from messages, for example with STOP on X, a suppression entry remains so that they receive no further messages.
11Liability and final provisions
11.1Liability is governed by Art. 82 GDPR.Otherwise the rules of the Main Contract apply between the parties, unless Art. 82 GDPR prevents this.
11.2In case of conflicts this agreement takes precedence over the Terms with regard to the protection of personal data.Otherwise the final provisions of the Terms apply.
Annex 1: Sub processors
FAMMRO uses sub processors in the following categories.On request to support@fammro.com, FAMMRO sends the Customer the current list with the name and address of each sub processor without undue delay in text form.
| Service | Storage location or region | Basis |
|---|---|---|
| delivery of the console | worldwide network | Data Privacy Framework or standard contractual clauses |
| routing of requests to language models | USA | Data Privacy Framework or standard contractual clauses |
| language models of external AI providers for answers, summaries, translations, image recognition and text recognition, via the routing service | outside the EU | contract with the routing service, standard contractual clauses |
| search vectors for the knowledge base, via the routing service | EU or USA | contract with the routing service, standard contractual clauses |
| operation of the server | Frankfurt | storage in the EU, standard contractual clauses |
| database and file storage | Paris | storage in the EU, standard contractual clauses |
| queues and caches | Frankfurt | storage in the EU |
| protection and delivery of the API | worldwide network | Data Privacy Framework or standard contractual clauses |
| speech recognition for browsers without their own | USA | Data Privacy Framework or standard contractual clauses |
| error monitoring | Frankfurt | storage in the EU, Data Privacy Framework |
| sending email notifications | based in the EU | provider in the EU |
| sending email, fallback | EU or USA | provider in the EU, otherwise Data Privacy Framework or standard contractual clauses |
| SMS, only if set up | EU, fallback USA | provider in the EU, otherwise Data Privacy Framework or standard contractual clauses |
| reading public websites for the knowledge base | based in Germany | public content only |
| fetching public websites via a web archive when direct access is blocked | USA | public content only |
Annex 2: Technical and organizational measures
Confidentiality
- data centers of the providers with access control and ISO 27001 or SOC 2 certification
- sign in with password stored as a secure hash, passkeys and second factor, short lived access tokens, deny list for signed out sessions
- roles Owner, Admin, Manager and Support with graded permissions
- strict separation of each company's data in every query
- encryption in transit with TLS, encryption of conversations, contacts, leads and platform credentials in the database
- replacement of personal details with placeholders before transfer to language models
Integrity
- change log with person and time, reverting changes
- verification of the signature of incoming platform webhooks
- rate limiting of requests and sign in attempts
Availability and resilience
- regular database backups by the provider
- monitoring of errors in operation
- fallback routes for sending email
Regular review
- automated tests for every change, dependency checks for vulnerabilities
- privacy friendly defaults, automatic deletion after the retention period
This English version is provided for convenience.The German version is legally binding.