Data processing agreement

Effective date: [Effective date]

This agreement is between the customer who accepts the Zaproo Search terms of service (the "controller") and [Company legal name], [Registered address] (the "processor"). It applies to personal data the processor handles for the controller through Zaproo Search, and it meets Article 28 of the GDPR.

1. What is processed

• Purpose: providing site search, analytics and the AI shopping assistant on the controller's shop.
• Data subjects: the controller's shoppers, and any people named in the documents the controller indexes.
• Data: search queries and events with a hashed session id, device type and country; assistant conversations with a random visitor id and the site they ran on; whatever personal data the controller includes in indexed documents; IP addresses in short-lived rate-limit counters.
• Special categories: none are intended. The controller should not index them and should tell shoppers not to enter them in the assistant.
• Duration: the term of the subscription, plus the deletion period in section 9.

2. Instructions

The processor handles the data only on the controller's documented instructions. The terms, this agreement and the settings the controller chooses in the dashboard are those instructions. The processor tells the controller if it thinks an instruction breaks the GDPR.

3. Confidentiality

Everyone at the processor who can access the data is bound by confidentiality. Changes the processor's staff make in a customer account are recorded in the audit log.

4. Security

The processor keeps the technical and organisational measures in Annex 1, including separation of each customer's data, encryption of AI provider keys at rest, and backups. [Annex 1, to be written.]

5. Sub-processors

The controller gives general authorisation for the sub-processors on the sub-processor list. The processor announces a new or replaced sub-processor [30 days, to confirm] in advance, and the controller may object on reasonable grounds. The processor binds each sub-processor to data protection terms no weaker than these and stays responsible for it.

AI model providers receive shopper messages when the AI assistant is used. Their default retention, and whether zero data retention is in place, is described in How the AI assistant handles data with model providers.

6. Transfers outside the EEA

Where a sub-processor processes data outside the EEA, the transfer relies on [Standard Contractual Clauses / an adequacy decision such as the EU-US Data Privacy Framework, to confirm per sub-processor].

7. Helping the controller

The processor helps the controller answer data subject requests, for example by deleting a conversation in the dashboard, and helps with security, breach notification and data protection impact assessments, as far as the processor's role allows.

8. Breaches

The processor tells the controller without undue delay, and within [48 hours, to confirm], after it becomes aware of a personal data breach affecting the controller's data, with the information the controller needs to meet its own duties. Contact: [Security contact].

9. Deletion and return

Assistant conversations are deleted after the retention period the controller sets. When the subscription ends, the processor deletes the controller's data within [N days, to confirm], unless the law requires keeping it. The controller can export its data before then [export method, to confirm]. Backups expire on their own cycle, 30 days for the database and 14 days for search snapshots.

10. Audits

The processor makes available the information needed to show compliance with this agreement, and allows audits by the controller or an auditor it appoints, with reasonable notice and at most [once a year, to confirm].

11. Contacts

Data protection contact: [DPO contact]. Governing law: [Governing law, to confirm].