Data Processing Addendum

Effective with the agreement between Customer and Voitella

1 Scope roles and priority

This DPA applies when Relay processes personal data within Customer Content for Customer under the agreement. “Applicable Data Protection Law” means privacy and data protection law applicable to that processing. “Personal Data,” “Controller,” “Processor,” “Processing,” and “Personal Data Breach” have their meanings under that law, including GDPR where applicable. Customer is a Controller, or a Processor acting with its Controller’s authority; Relay is its Processor or subprocessor accordingly.

The parties’ roles for their separate account administration, legal compliance, and independently determined security activities remain governed by law and the Privacy Policy. Relay must not convert instructed Customer Content into data for its own unrelated commercial purposes. Mandatory transfer clauses prevail over this DPA; this DPA prevails over conflicting terms for the processing it covers.

2 Instructions and customer duties

Relay will process Personal Data only on Customer’s documented lawful instructions in the agreement, enabled service settings, authenticated API requests, and subsequent written instructions, including instructions concerning transfers. If applicable law requires otherwise, Relay will inform Customer before processing unless legally prohibited. Relay will promptly inform Customer if it considers an instruction to infringe Applicable Data Protection Law and may pause that instruction while the parties resolve the issue.

Customer determines permitted purposes, recipients, connected accounts, retention needs, and lawful grounds. It is responsible for necessary transparency and authority, including authority from its Controller if acting as a Processor. Customer must not instruct unauthorized group collection, covert monitoring, or processing beyond its lawful entitlement. These responsibilities do not displace Relay’s direct legal obligations or its duty to follow lawful instructions.

3 Confidentiality and security

Relay will ensure that persons authorized to process Personal Data are bound by confidentiality duties and receive access only as needed. Relay will maintain technical and organizational measures appropriate to the risk and Applicable Data Protection Law, including the applicable requirements of GDPR Article 32. The parties will use the processing description and security schedule below to assess suitability; the service must not be used where its safeguards are inadequate for the intended data.

Relay will maintain access controls, secure deployment and secret management procedures, vulnerability and patch management, incident handling, and measures for availability and restoration appropriate to the agreed service. Material changes must not reduce the overall level of protection during the term. A listed implementation feature is not a certification or guarantee. Customer must secure its own devices, endpoints, keys, and downstream recipients.

4 Subprocessors

Customer specifically authorizes only the subprocessors identified in a completed Schedule 3. Relay will enter written contracts imposing materially equivalent data protection duties on them, assess their suitability, and remain responsible to Customer for their performance of those duties as required by law.

For additional or replacement subprocessors, Relay will give at least 30 days’ prior written notice, allowing Customer to object on reasonable data protection grounds before access begins. The parties will seek an alternative or mitigation. If no reasonable solution is available, either may terminate the affected service before the change, with a refund of unused prepaid fees. An emergency replacement needed to address a serious security or availability issue requires prompt notice and equivalent protections; it does not eliminate any legally required prior authorization.

An infrastructure brand in an architecture diagram is not sufficient identification or authorization. Customer-selected third-party recipients acting outside Relay’s engagement are not automatically subprocessors, and their actual legal roles must be assessed. WhatsApp’s role is determined under the relevant product terms and facts, not assumed from this DPA.

5 Assistance and individual requests

Taking account of the nature of processing, Relay will use appropriate measures to help Customer respond to individuals’ rights requests. Relay will forward a request concerning Customer’s instructed data without undue delay and will not substantively respond except on Customer’s instructions or as legally required. Relay will not disclose another tenant’s or individual’s data when providing assistance.

Relay will provide reasonable information and assistance for security assessments, impact assessments, regulatory consultations, and breach notifications, considering the information available to it. Any charge for exceptional assistance must be reasonable, agreed in advance, and must not prevent mandatory assistance or apply to work required because of Relay’s breach.

6 Personal data breaches

Relay will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting data processed under this DPA. Relay’s operational target is an initial notification within 24 hours of awareness; missing that target does not extend the legal requirement. Notification must not be delayed until investigation is complete.

To the extent known, notification will describe the incident, affected categories and approximate numbers of people and records, likely consequences, measures taken or proposed, and a contact for follow-up. Relay may provide information in phases and will preserve relevant evidence, investigate, mitigate, and reasonably cooperate with Customer. Notification is not an admission of liability. Customer determines its own external notifications unless law requires Relay to act directly.

7 Information and audit

Relay will make available information reasonably necessary to demonstrate compliance with this DPA and applicable processor obligations. Customer may conduct, or appoint an independent confidential auditor to conduct, a proportionate audit or inspection. The parties will ordinarily use documentary evidence first and agree reasonable notice, scope, and safeguards to protect systems and other customers.

Routine audits may ordinarily be limited to once annually during business hours, but those limits do not prevent an audit required by law, a regulator, a credible material breach, or a significant incident. Confidentiality cannot prevent disclosure to a competent regulator. Each party bears its routine costs; Relay bears reasonable corrective costs attributable to its breach. No audit right permits unauthorized access to other tenants’ content.

8 Return deletion and end of processing

At Customer’s choice, Relay will return Personal Data in a reasonably accessible agreed format or delete it at the end of the service, and delete remaining copies unless law requires retention. Customer should state its choice within 30 days of termination. Relay will make an export available for that period where lawful and technically safe, and complete production deletion within 30 days after the chosen return or deletion instruction. If no choice is received, Relay will delete production copies within 60 days of termination.

The parties must complete a backup retention period in Schedule 2 before relying on a backup exception. Any retained backup must be isolated from ordinary use, protected, and deleted on the agreed cycle. If restored, deletion instructions must be reapplied. Legally required retention must be limited, access-restricted, and notified where lawful. Relay will confirm completion of deletion on written request and state any exception.

Revoking a session is not deletion of all Customer Content. Return and deletion cover relevant dashboard records, gateway tables, queue payloads, events, files, and operational copies under Relay’s control. They do not cover recipients’ independent copies or a third-party system outside Relay’s engagement. Duties protecting retained data survive termination until deletion.

9 International transfers and local requirements

Neither party may initiate a restricted international transfer without a valid legal mechanism and any required assessment or supplementary measures. Schedule 3 must identify destinations and onward access. This DPA alone is not a complete set of EU standard contractual clauses or a UK transfer addendum.

Where required, the parties will execute the appropriate unmodified transfer clauses, complete their annexes, select the correct module and supervisory authority, and adopt the necessary UK or other local adaptations before transfer. A general acceptance of the service does not replace those steps. If no lawful arrangement can be implemented, the affected processing must not begin or must be suspended and the data returned or deleted as required.

Where California law applies to Customer Personal Data and Relay acts as a service provider or contractor, Relay will not sell or share it, use it outside the specified business purposes or direct business relationship, or combine it with other sources except as legally permitted. Relay will provide the required level of protection, notify Customer if unable to comply, and allow reasonable steps to verify compliance and stop or remediate unauthorized use. These restrictions do not assert that every customer or operation is covered by California law. Other mandatory local duties prevail over conflicting provisions.

Schedule 1 Processing description

Subject matter and duration: operation of Customer’s linked-account gateway and dashboard during the service, followed only by the limited return, deletion, or legally required retention period.

Nature and purpose: account linking, synchronization, storage, retrieval, message submission, keyword matching, event creation, customer-directed webhook transmission, support, and security necessary to provide those instructed functions. Processing may be continuous while a session is connected and may include historical data received during synchronization.

Data subjects: Customer administrators and authorized users, account owners, business contacts, message senders and recipients, group participants and administrators, and people whose information appears in submitted content. No specially regulated category is authorized merely by appearing in this description.

Data types: identifiers and contact details; display names; chat and group identifiers, names, membership details and available metadata; message and attachment content or references; timestamps and delivery events; session credentials; rule definitions and matches; scheduled payloads; API, support, and event records. Content can incidentally reveal sensitive information. Customer must minimize and exclude it where not authorized.

Customer’s rights and duties: determine lawful purposes and instructions, maintain notices and permissions, exercise oversight, set appropriate retention, and use its rights under this DPA. The service is not approved for intentional processing of specially regulated data absent a separate signed arrangement and adequate safeguards.

Schedule 2 Security and retention commitments

The source implements authenticated dashboard access, tenant checks on gateway requests, channel-bound API credentials, hashing of API key tokens, encryption of selected session and content payloads, signed webhooks, and host allowlists for certain outbound requests. Gateway encryption keys are service-held. Routing metadata and some workspace fields are outside that field encryption. These features require deployment verification; they do not establish that every control below is already operational.

Before processing production personal data, Relay must verify HTTPS, secret storage and rotation, administrator access restrictions and multifactor authentication where available, tenant isolation, access logging, vulnerability response, staff confidentiality, incident escalation, export, complete deletion, and appropriate restoration capability. Record testing and the responsible owners in a security schedule available to Customer. No independent audit or certification is represented.

Retention settings to complete before production: Customer Content [ACTIVE RETENTION PERIOD AND TRIGGER]; technical and security logs [PERIOD AND PURPOSE]; account and support records [PERIOD AND PURPOSE]; financial or legal records [APPLICABLE PERIOD]; backups [NONE OR MAXIMUM PERIOD AND DELETION METHOD]. Termination processing follows section 8. The pilot currently has no automated history expiry and no configured gateway backup cycle. Final settings must be implemented and tested, not merely entered in this schedule.

Schedule 3 Subprocessor and transfer register

Complete one entry per actual contracting entity before Customer authorizes processing. Each entry must state legal name, service, data categories, processing and support countries, role, contract and security review date, retention implications, and the transfer mechanism where required.

Planned infrastructure requiring verification: the entity supplying ChatGPT Sites and associated authentication and hosting; Cloudflare services supporting the dashboard runtime and database, with the contracting chain confirmed; and Railway’s gateway hosting entity after provisioning. Do not list these as fully approved contractual subprocessors until the actual agreements, onward providers, locations, and scope have been checked. Customer-selected webhook or media providers must be recorded separately according to their actual role.

Customer legal name and address: [DETAILS]. Relay legal name and address: [DETAILS]. Customer privacy contact: [CONTACT]. Relay privacy and incident contact: [CONTACT]. Acceptance date and authorized signatories, or recorded electronic acceptance: [DETAILS]. No restricted production transfer is authorized while essential entries remain incomplete.