CHATFUEL Terms of Use

PLEASE NOTE THAT YOUR USE OF AND ACCESS TO OUR SERVICES (DEFINED BELOW) ARE SUBJECT TO THE FOLLOWING TERMS; IF YOU DO NOT AGREE TO ALL OF THE FOLLOWING, YOU MAY NOT USE OR ACCESS THE SERVICES IN ANY MANNER.

Effective date: October 12, 2026

Welcome to Chatfuel. These Terms of Use apply when you use the products and services of Chatfuel including our application programming interface, software, tools, data, documentation, application and website (“Services”). Please read on to learn the rules and restrictions that govern your use of our Services. If you have any questions, comments, or concerns regarding these terms or the Services, please contact us at [email protected], 490 Post Street, Suite 526, San Francisco, CA 94102, USA.

These Terms of Use (the “Terms”) are a binding contract between you or the organization on whose behalf you are accepting or otherwise agreeing to the terms and 200 Labs, Inc., d/b/a Chatfuel (“Chatfuel,” “we,” and “us”). Your use of the Services is also governed by and subject to the Meta Platform Terms (https://developers.facebook.com/policy), Meta Commercial Terms (https://www.facebook.com/legal/commercial_terms), Facebook Terms for WhatsApp Business (https://www.whatsapp.com/legal/FB-terms-whatsapp-business), OpenAI Policies (https://openai.com/policies/), including Sharing and Publication Policy (https://openai.com/policies/sharing-publication-policy/); and Community Guidelines (https://openai.com/policies/usage-policies), TikTok for business commercial terms of service (https://ads.tiktok.com/i18n/official/policy/commercial-terms-of-service). You are solely responsible and liable for complying with the Meta Platform Terms, Meta Commercial Terms, OpenAI Policies, TikTok for business commercial terms of service and Facebook Terms for WhatsApp Business applicable at the time of using the specific feature. If you connect the Services to a third-party AI assistant or other application, the terms of that application’s provider also apply to your use of it. These Third‑Party Terms are separate agreements between you and those providers and are not incorporated into these Terms.

You must agree to and accept all of the Terms, or you don’t have the right to use the Services. Your using the Services in any way means that you agree to all of these Terms, and these Terms will remain in effect while you use the Services. These Terms include the provisions in this document, as well as those in the Privacy Policy and Copyright Dispute Policy.

Will these Terms ever change?

We are constantly trying to improve our Services, so these Terms may need to change along with the Services. We reserve the right to change the Terms at any time, but if we do any material updates, we will bring it to your attention by placing a notice on the Chatfuel.com website, by sending you an email, and/or by some other means.

If you don’t agree with the new Terms, you are free to reject them; unfortunately, that means you will no longer be able to use the Services. If you use the Services in any way after a change to the Terms is effective, that means you agree to all of the changes.

Except for changes by us as described here, no other amendment or modification of these Terms will be effective unless in writing and signed by both you and us.

What about my privacy?

Chatfuel takes the privacy of its users very seriously. For the current Chatfuel Privacy Policy, please click here.

The Children’s Online Privacy Protection Act (“COPPA”) requires that online service providers obtain parental consent before they knowingly collect personally identifiable information online from children who are under 13. We do not knowingly collect or solicit personally identifiable information from children under 13; if you are a child under 13, please do not attempt to register for the Services or send any personal information about yourself to us. If we learn we have collected personal information from a child under 13, we will delete that information as quickly as possible. If you believe that a child under 13 may have provided us personal information, please contact us at [email protected].

What are the basics of using Chatfuel?

You may be required to sign up for an account and log-in to Chatfuel through your Google/Facebook or other third party account, and select a password and username (“Chatfuel User ID”). You promise to provide us with accurate, complete, and updated registration information about yourself. You may not transfer your account to anyone else without our prior written permission.

You represent and warrant that you are of legal age to form a binding contract (or if not, you’ve received your parent’s or guardian’s permission to use the Services and gotten your parent or guardian to agree to these Terms on your behalf). If you’re agreeing to these Terms on behalf of an organization or entity, you represent and warrant that you are authorized to agree to these Terms on that organization or entity’s behalf and bind them to these Terms (in which case, the references to “you” and “your” in these Terms, except for in this sentence, refer to that organization or entity).

You will only use the Services in a manner that complies with all laws that apply to you. If your use of the Services is prohibited by applicable laws, then you aren’t authorized to use the Services. We can’t and won’t be responsible for your using the Services in a way that breaks the law.

You may provide input to be processed by Chatfuel, and receive output generated and returned by Chatfuel based on the Input. Input and Output are your Content or Customer Data, as applicable. You will ensure that your Input and use of the Chatfuel will not violate any applicable law. You are solely responsible for the development, content, operation, maintenance, and use of your Content and Customer Data.

You may not use Services (i) to mislead any person that Output from the Services was solely human generated; (ii) to generate spam, content for dissemination in electoral campaigns, use the Services in a manner that violates any applicable laws or technical documentation, usage guidelines, or parameters.

You will not share your account or password with anyone, and you must protect the security of your account and your password. You’re responsible for any activity associated with your account.

API keys and connected applications

You may access the Services through API keys issued in your account or by authorizing third-party applications, including AI assistants that connect to the Services via the Chatfuel Model Context Protocol (MCP) server, to act on your behalf (“Connected Applications”). API keys and authorization tokens are credentials to your account. You are responsible for keeping them confidential and for all actions taken through them, including actions taken by a Connected Application, as if you had taken those actions yourself.

A Connected Application receives the same access to your account as you have, subject to limitations we set in our technical documentation. Data that a Connected Application retrieves from the Services is processed by the provider of that application under its own terms and privacy policy. Chatfuel does not control and is not responsible for such providers, including AI model providers, and their terms are separate agreements between you and them.

We may set and change limits on the frequency, volume and size of requests made through API keys and Connected Applications, and may suspend or revoke access of any API key or Connected Application that exceeds those limits, interferes with the proper working of the Services or otherwise violates these Terms.

You may revoke access at any time by deleting the API key or disconnecting the application in your account settings. Disconnecting the Services on the side of a Connected Application does not revoke its access in Chatfuel.

Your use of the Services is subject to the following additional restrictions:

You represent, warrant, and agree that you will not contribute any Content or User Submission (each of those terms is defined below) or otherwise create any Service Chatbots or use the Services in a manner that:

(a) Infringes or violates the intellectual property rights or any other rights of anyone else (including Chatfuel);

(b) Violates any law or regulation, including any applicable export control laws;

(d) Jeopardizes the security of your Chatfuel account or anyone else’s (such as allowing someone else to log in to the Services as you);

(e) Attempts, in any manner, to obtain the password, account, or other security information from any other user;

(f) Violates the security of any computer network, or cracks any passwords or security encryption codes;

(g) Runs Maillist, Listserv, any form of auto-responder or “spam” on the Services, or any processes that run or are activated while you are not logged into the Services, or that otherwise interfere with the proper working of the Services (including by placing an unreasonable load on the Services’ infrastructure);

(h) “Crawls,” “scrapes,” or “spiders” any page, data, or portion of or relating to the Services or Content (through use of manual or automated means);

(i) Copies or stores any significant portion of the Content;

(j) Decompiles, reverse engineers, or otherwise attempts to obtain the source code or underlying ideas or information of or relating to the Services.

Access through API keys issued in your account or through applications you have authorized to connect to the Services is not, by itself, a process that interferes with the Services, provided it complies with these Terms and our technical documentation.

A violation of any of the foregoing is grounds for termination of your right to use or access the Services.

What are the terms of using Chatfuel WhatsApp Business Solution?

You agree that You will not resell the WhatsApp Business Solution or allow third parties to integrate with, access or use the WhatsApp Business Solution other than as provided in Facebook Terms for WhatsApp Business (https://www.whatsapp.com/legal/FB-terms-whatsapp-business) or use any of the Meta or WhatsApp names and trademarks to promote your business or in any other way (unless otherwise prior approved in writing by Meta). You will expressly prohibit such activities under Your agreement with Your Client.

Meta may at any time prohibit any of our users’ use of the WhatsApp Business Solution, effective upon notice to Chatfuel and You. Chatfuel must immediately comply with any such prohibition.

Chatfuel will maintain an up-to-date list of each of our users and the types of User Data such users shared with us and will provide such information to Meta upon their request.

What are the terms of using provided by Chatfuel phone number for connecting to the Chatfuel WhatsApp Business Solution

Chatfuel provides the phone numbers on the following conditions:

(a) The received number should be connected to the Chatfuel WhatsApp Business Solution within 10 days, otherwise Chatfuel takes back unconnected numbers;

(b) To go on using the provided connected number, the business plan should be paid in time. If in 10 days after the due date Chatfuel doesn’t receive the payment, the numbers will be taken back.

What are my rights in Chatfuel?

The materials displayed or performed or available on or through the Services, including, but not limited to, text, graphics, data, articles, photos, images, illustrations, User Submissions, and so forth (all of the foregoing, the “Content”) are protected by copyright and/or other intellectual property laws. You promise to abide by all copyright notices, trademark rules, information, and restrictions contained in any Content you access through the Services, and you won’t use, copy, reproduce, modify, translate, publish, broadcast, transmit, distribute, perform, upload, display, license, sell or otherwise exploit for any purpose any Content not owned by you, (i) without the prior consent of the owner of that Content or (ii) in a way that violates someone else’s (including Chatfuel’s) rights.

You understand that Chatfuel owns the Services. You won’t modify, publish, transmit, participate in the transfer or sale of, reproduce (except as expressly provided in this Section), create derivative works based on, or otherwise exploit any of the Services.

The Services may allow you to copy or download certain Content; please remember that just because this functionality exists, doesn’t mean that all the restrictions above don’t apply – they do!

Do I have to grant any licenses to Chatfuel or to other users?

Anything you post, upload, share, store, or otherwise provide through the Services, including any Services Chatbots you create and/or communicate with through the Services, is your “User Submission.” Some User Submissions are viewable by other users. In order to display your User Submissions on the

Services, and to allow other users to enjoy them (where applicable), you grant us certain rights in those User Submissions. Please note that all of the following licenses are subject to our Privacy Policy to the extent they relate to User Submissions that are also your personally-identifiable information.

For all User Submissions, you hereby grant Chatfuel a license to translate, modify (for technical purposes, for example making sure your content is viewable on an iPhone as well as a computer) and reproduce and otherwise act with respect to such User Submissions, in each case to enable us to operate the Services, as described in more detail below. This is a license only – your ownership in User Submissions is not affected.If you store a User Submission in your own personal Chatfuel account, in a manner that is not viewable by any other user except you (a “Personal User Submission”), you grant Chatfuel the license above, as well as a license to display, perform, and distribute your Personal User Submission for the sole purpose of making that Personal User Submission accessible to you and providing the Services necessary to do so.

If you share a User Submission only in a manner that only certain specified users can view (for example, a private message to a chatbot) (a “Limited Audience User Submission”), then you grant Chatfuel the licenses above, as well as a license to display, perform, and distribute your Limited Audience User Submission for the sole purpose of making that Limited Audience User Submission accessible to such other specified users, and providing the Services necessary to do so. Also, you grant such other specified users a license to access that Limited Audience User Submission, and to use and exercise all rights in it, as permitted by the functionality of the Services.

If you share a User Submission publicly on the Services and/or in a manner that more than just you or certain specified users can view, or if you provide us (in a direct email or otherwise) with any feedback, suggestions, improvements, enhancements, and/or feature requests relating to the Services (each of the foregoing, a “Public User Submission”), then you grant Chatfuel the licenses above, as well as a license to display, perform, and distribute your Public User Submission for the purpose of making that Public User Submission accessible to all Chatfuel users and providing the Services necessary to do so, as well as all other rights necessary to use and exercise all rights in that Public User Submission in connection with the Services for any purpose. Also, you grant all other users of the Services a license to access that Public User Submission, and to use and exercise all rights in it, as permitted by the functionality of the Services.

You agree that the licenses you grant are royalty-free, perpetual, sublicensable, irrevocable, and worldwide.

If you are using the free version of the Services, all your Services Chatbots created through the Services will automatically include an attribution to Chatfuel. You agree not to remove, modify, or obscure the Chatfuel attribution. For clarity, the Services Chatbots are themselves deemed Public User Submissions and whether you are using the free or paid version of the Services in creating Services Chatbots, you hereby grant Chatfuel a nonexclusive, royalty-free, irrevocable, worldwide license to (a) use any Services Chatbots you create in Chatfuel’s marketing materials (such as on Chatfuel.com) and (b) provide any templates for the creation of such Services Chatbots to any other users of the Services, as part of the Services offerings.

In addition to the above, we may track and collect data regarding your usage of the Service (“User Data”). In addition to the licenses granted above, you grant Chatfuel a royalty-free, perpetual, sublicensable, irrevocable, and worldwide right and license to use, store, copy, create derivatives, and archive User Data and the Content that you generate or upload (i) to create anonymized compilations and analyses of User Data that is combined with data from numerous other users (“Aggregate Data”), and (ii) to create, develop, and enhance tools and functionalities in connection with the Services. Chatfuel shall have exclusive ownership rights to, and the exclusive right to use and distribute, such Aggregate Data for any purpose. Chatfuel shall not, however, distribute Aggregate Data in a manner that is identifiable as User Data. Finally, you understand and agree that Chatfuel, in performing the required technical steps to provide the Services to our users (including you), may need to make changes to your User Submissions to conform and adapt those User Submissions to the technical requirements of connection networks, devices, services, or media, and the foregoing licenses include the rights to do so.

Also you grant us a limited, non-exclusive, worldwide, royalty-free license to use your name and logo solely for the purpose of identifying you as a client of Chatfuel on Chatfuel’s website, marketing materials, and customer lists. You may revoke this permission at any time by providing written notice to Chatfuel by contacting us at [email protected], and we will promptly cease such use.

What if I see something on the Services that infringes my copyright?

You may have heard of the Digital Millennium Copyright Act (the “DMCA”), as it relates to online service providers, like Chatfuel, being asked to remove material that allegedly violates someone’s copyright. We respect others’ intellectual property rights, and we reserve the right to delete or disable Content alleged to be infringing, and to terminate the accounts of repeat alleged infringers; to review our complete Copyright Dispute Policy and learn how to report potentially infringing content, click here. To learn more about the DMCA, click here.

Who is responsible for what I see and do on the Services?

Any information or content publicly posted or privately transmitted through the Services, and any Services Chatbots, are the sole responsibility of the person from whom such content originated, and you access all such information and content at your own risk, and we aren’t liable for any errors or omissions in that information or content or for any damages or loss you might suffer in connection with it. We cannot control and have no duty to take any action regarding how you may interpret and use the Content or what actions you may take as a result of having been exposed to the Content, and you hereby release us from all liability for you having acquired or not acquired Content through the Services. We can’t guarantee the identity of any users with whom you interact in using the Services and are not responsible for which users gain access to the Services.

You are responsible for all Content you contribute, in any manner, to the Services, and you represent and warrant you have all rights necessary to do so, in the manner in which you contribute it. You will keep all your registration information accurate and current. You are responsible for all your activity in connection with the Services.

The Services may contain links or connections to third party websites or services that are not owned or controlled by Chatfuel. When you access third party websites or use third party services, you accept that there are risks in doing so, and that Chatfuel is not responsible for such risks. We encourage you to be aware when you leave the Services and to read the terms and conditions and privacy policy of each third party website or service that you visit or utilize.

Chatfuel has no control over, and assumes no responsibility for, the content, accuracy, privacy policies, or practices of or opinions expressed in any third party websites or by any third party that you interact with through the Services. In addition, Chatfuel will not and cannot monitor, verify, censor or edit the content of any third party site or service. By using the Services, you release and hold us harmless from any and all liability arising from your use of any third party website or service.

Your interactions with organizations and/or individuals found on or through the Services, including payment and delivery of goods or services, and any other terms, conditions, warranties or representations associated with such dealings, are solely between you and such organizations and/or individuals. You should make whatever investigation you feel necessary or appropriate before proceeding with any online or offline transaction with any of these third parties. You agree that Chatfuel shall not be responsible or liable for any loss or damage of any sort incurred as the result of any such dealings.

If there is a dispute between participants on this site, or between users and any third party, you agree that Chatfuel is under no obligation to become involved. In the event that you have a dispute with one or more other users, you release Chatfuel, its officers, employees, agents, and successors from claims, demands, and damages of every kind or nature, known or unknown, suspected or unsuspected, disclosed or undisclosed, arising out of or in any way related to such disputes and/or our Services. If you are a California resident, you shall and hereby do waive California Civil Code Section 1542, which says: "A general release does not extend to claims which the creditor does not know or suspect to exist in his or her favor at the time of executing the release, which, if known by him or her must have materially affected his or her settlement with the debtor."

Will Chatfuel ever change the Services?

We’re always trying to improve the Services, so they may change over time. We may suspend or discontinue any part of the Services, or we may introduce new features or impose limits on certain features or restrict access to parts or all of the Services. We’ll try to give you notice when we make a material change to the Services that would adversely affect you, but this isn’t always practical. Similarly, we reserve the right to remove any Content from the Services at any time, for any reason (including, but not limited to, if someone alleges you contributed that Content in violation of these Terms), in our sole discretion, and without notice.

Do the Services Cost Anything?

Chatfuel currently offers both a free version of the Services and paid versions of the Services, the paid plans described on our Pricing Terms page (“Paid Services”). If you are using a free version of the Services, we will notify you before any Services you are then using begin carrying a fee, and if you wish to continue using such Services, you must pay all applicable fees for such Services. Chatfuel reserves the right to charge for certain or all services in the future.

a. Paid Services. If you are using our Paid Services, you will be subject to payments. Please see our Pricing Terms page <https://chatfuel.com/pricing/> for a description of the current Paid Services. Payments for Paid Services may vary monthly as set forth in the Pricing Terms. You agree that we may accumulate charges incurred and submit them as one or more aggregate charges during or at the end of each billing cycle. Please note that any payment terms presented to you in the process of using or signing up for a Paid Service are deemed part of these Terms.

b. Billing. We may bill you directly through an invoice or use a third-party payment processor (the “Payment Processor”) to bill you through a payment account linked to your account on the Services (your “Billing Account”) for use of the Paid Services. If you are billed through a Payment Processor, the processing of payments will be subject to the terms, conditions and privacy policies of the Payment Processor in addition to these Terms. Currently, we use Stripe, Inc. as our Payment Processor. You can access Stripe’s Terms of Service at https://stripe.com/us/checkout/legal and their Privacy Policy at https://stripe.com/us/privacy. We are not responsible for any error by, or other acts or omissions of, the Payment Processor. By choosing to use Paid Services, you agree to pay us, either directly or through the Payment Processor, all charges at the prices then in effect for any use of such Paid Services in accordance with the applicable payment terms, and you authorize us, either directly or through the

Payment Processor, to charge your chosen payment provider (your “Payment Method”). You agree to make payment using that selected Payment Method. We reserve the right to correct any errors or mistakes that the Payment Processor makes even if it has already requested or received payment. All amounts due from you to Chatfuel shall be paid in full without any set-off, counterclaim, deduction or withholding. If we, either directly or through the Payment Processor, do not receive payment from you by the due date, you agree to pay all amounts due on your Billing Account upon demand. Additionally, we reserve the right to apply a late payment fee to the outstanding balance, calculated from the due date until payment is received in full.

c. Payment Method. The terms of your payment will be based on your Payment Method and may be determined by agreements between you and the financial institution, credit card issuer or other provider of your chosen Payment Method. Any agreement you have with your payment provider will govern your use of your Payment Method. If we, either directly or through the Payment Processor, do not receive payment from you, you agree to pay all amounts due on your Billing Account upon demand.

d. Recurring Billing. Some of the Paid Services may consist of an initial period, for which there is a one-time charge, followed by recurring period charges as agreed to by you. By choosing a recurring payment plan, you acknowledge that such Services have an initial and recurring payment feature and you accept responsibility for all recurring charges prior to cancellation. WE MAY SUBMIT PERIODIC CHARGES (E.G., MONTHLY) WITHOUT FURTHER AUTHORIZATION FROM YOU, UNTIL YOU PROVIDE PRIOR NOTICE (RECEIPT OF WHICH IS CONFIRMED BY US) THAT YOU HAVE TERMINATED THIS AUTHORIZATION OR WISH TO CHANGE YOUR PAYMENT METHOD. SUCH NOTICE WILL NOT AFFECT CHARGES SUBMITTED BEFORE WE REASONABLY COULD ACT. TO TERMINATE YOUR AUTHORIZATION OR CHANGE YOUR PAYMENT METHOD, GO TO YOUR ACCOUNT SETTINGS .

e. Current Information Required. YOU MUST PROVIDE CURRENT, COMPLETE AND ACCURATE INFORMATION FOR YOUR BILLING ACCOUNT. YOU MUST PROMPTLY UPDATE ALL INFORMATION TO KEEP YOUR BILLING ACCOUNT CURRENT, COMPLETE AND ACCURATE (SUCH AS A CHANGE IN BILLING ADDRESS, CREDIT CARD NUMBER, OR CREDIT CARD EXPIRATION DATE), AND YOU MUST PROMPTLY NOTIFY US OR OUR PAYMENT PROCESSOR IF YOUR PAYMENT METHOD IS CANCELED (E.G., FOR LOSS OR THEFT) OR IF YOU BECOME AWARE OF A POTENTIAL BREACH OF SECURITY, SUCH AS THE UNAUTHORIZED DISCLOSURE OR USE OF YOUR USER NAME OR PASSWORD. CHANGES TO SUCH INFORMATION CAN BE MADE AT YOUR ACCOUNT SETTINGS. IF YOU FAIL TO PROVIDE ANY OF THE FOREGOING INFORMATION, YOU AGREE THAT WE MAY CONTINUE CHARGING YOU FOR ANY USE OF PAID SERVICES UNDER YOUR BILLING ACCOUNT UNLESS YOU HAVE TERMINATED YOUR PAID SERVICES AS SET FORTH ABOVE.

f. Auto-Renewal for Paid Services. Unless you opt out of auto-renewal, which can be done through your account settings, any Paid Services you have signed up for will be automatically extended for successive renewal periods of the same duration as the subscription term originally selected, at the then-current non-promotional rate. To change or resign your Paid Services at any time, go to your account settings. If you terminate a Paid Service, you may use your subscription until the end of your then-current term, and your subscription will not be renewed after your then-current term expires. However, you will not be eligible for a prorated refund of any portion of the subscription fee paid for the then-current subscription period. IF YOU DO NOT WANT TO CONTINUE TO BE CHARGED ON A RECURRING MONTHLY BASIS, YOU MUST CANCEL THE APPLICABLE PAID SERVICE THROUGH YOUR ACCOUNT SETTINGS OR TERMINATE YOUR CHATFUEL ACCOUNT BEFORE THE END OF THE RECURRING TERM. PAID SERVICES CANNOT BE TERMINATED BEFORE THE END OF THE PERIOD FOR WHICH YOU HAVE ALREADY PAID, AND EXCEPT AS EXPRESSLY PROVIDED IN THESE TERMS, CHATFUEL WILL NOT REFUND ANY FEES THAT YOU HAVE ALREADY PAID.

g. Reaffirmation of Authorization. Your non-termination or continued use of a Paid Service reaffirms that we are authorized to charge your Payment Method for that Paid Service. We may submit those charges for payment and you will be responsible for such charges. This does not waive our right to seek payment directly from you. Your charges may be payable in advance, in arrears, per usage, or as otherwise described when you initially selected to use the Paid Service.

h. Refund policy. You can ask for a refund through the Chatfuel Dashboard or by contacting us at [email protected]. The refund will be processed within 30 days.

How long will my messenger’s history be kept

Anything you or your customers post, share, store, or otherwise provide through the Services is kept by Chatfuel for 3 months. This restriction is applied to both active or terminated accounts.

What if I want to stop using Chatfuel?

You’re free to stop using the Services at any time by contacting the support team at [email protected] or by using the Chatfuel interface. The change will take effect at the end of the current billing cycle, and you will no longer be charged for the plan. You may still receive charges for all amounts due for the usage before the termination (late fees). Please refer to our Privacy Policy, as well as the licenses above, to understand how we treat information you provide to us after you have stopped using our Services.

Chatfuel is also free to terminate (or suspend access to) your use of the Services or your account, for any reason in our discretion, including your breach of these Terms. Chatfuel has the sole right to decide whether you are in violation of any of the restrictions set forth in these Terms.

Account termination may result in destruction of any Services Chatbots and Content associated with your account, so keep that in mind before you decide to terminate your account. We will try to provide advance notice to you prior to our terminating your account so that you are able to retrieve any important User Submissions you may have stored in your account (to the extent allowed by law and these Terms), but we may not do so if we determine it would be impractical, illegal, not in the interest of someone’s safety or security, or otherwise harmful to the rights or property of Chatfuel.

Provisions that, by their nature, should survive termination of these Terms shall survive termination. By way of example, all of the following will survive termination: any obligation you have to pay us or indemnify us, any limitations on our liability, any terms regarding ownership of intellectual property rights, and terms regarding disputes between us.

What else do I need to know?

Warranty Disclaimer. Neither Chatfuel nor its licensors or suppliers makes any representations or warranties concerning any content contained in or accessed through the Services, and we will not be responsible or liable for the accuracy, copyright compliance, legality, or decency of material contained in or accessed through the Services. We (and our licensors and suppliers) make no representations or warranties regarding suggestions or recommendations of services or products offered or purchased through the Services. THE SERVICES AND CONTENT ARE PROVIDED BY CHATFUEL (AND ITS LICENSORS AND SUPPLIERS) ON AN “AS-IS” BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR THAT USE OF THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE. SOME STATES DO NOT ALLOW LIMITATIONS ON HOW LONG AN IMPLIED WARRANTY LASTS, SO THE ABOVE LIMITATIONS MAY NOT

APPLY TO YOU.

Limitation of Liability. TO THE FULLEST EXTENT ALLOWED BY APPLICABLE LAW, UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY (INCLUDING, WITHOUT LIMITATION, TORT, CONTRACT, STRICT LIABILITY, OR OTHERWISE) SHALL CHATFUEL (OR ITS LICENSORS OR SUPPLIERS) BE LIABLE TO YOU OR TO ANY OTHER PERSON FOR (A) ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND, INCLUDING DAMAGES FOR LOST PROFITS, LOSS OF GOODWILL, WORK STOPPAGE, ACCURACY OF RESULTS, OR COMPUTER FAILURE OR MALFUNCTION, OR (B) ANY AMOUNT, IN THE AGGREGATE, IN EXCESS OF THE GREATER OF (I) $100 OR (II) THE AMOUNTS PAID BY YOU TO CHATFUEL IN CONNECTION WITH THE SERVICES IN THE TWELVE (12) MONTH PERIOD PRECEDING THIS APPLICABLE CLAIM, OR (C) ANY MATTER BEYOND OUR REASONABLE CONTROL. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES, SO THE ABOVE LIMITATION AND EXCLUSIONS MAY NOT APPLY TO YOU.

Indemnity. To the fullest extent allowed by applicable law, You agree to indemnify and hold Chatfuel, its affiliates, officers, agents, employees, and partners harmless from and against any and all claims, liabilities, damages (actual and consequential), losses and expenses (including attorneys’ fees) arising from or in any way related to any third party claims relating to (a) your use of the Services (including any actions taken by a third party using your account), and (b) your violation of these Terms. In the event of such a claim, suit, or action (“Claim”), we will attempt to provide notice of the Claim to the contact information we have for your account (provided that failure to deliver such notice shall not eliminate or reduce your indemnification obligations hereunder).

Assignment. You may not assign, delegate or transfer these Terms or your rights or obligations hereunder, or your Services account, in any way (by operation of law or otherwise) without Chatfuel’s prior written consent. We may transfer, assign, or delegate these Terms and our rights and obligations without consent.

Choice of Law; Arbitration. These Terms are governed by and will be construed under the laws of the State of California, without regard to the conflicts of laws provisions thereof. Any dispute arising from or relating to the subject matter of these Terms shall be finally settled in San Francisco County, California, in English, in accordance with the Streamlined Arbitration Rules and Procedures of Judicial Arbitration and Mediation Services, Inc. ("JAMS") then in effect, by one commercial arbitrator with substantial experience in resolving intellectual property and commercial contract disputes, who shall be selected from the appropriate list of JAMS arbitrators in accordance with such Rules. Judgment upon the award rendered by such arbitrator may be entered in any court of competent jurisdiction. Notwithstanding the foregoing obligation to arbitrate disputes, each party shall have the right to pursue injunctive or other equitable relief at any time, from any court of competent jurisdiction. For all purposes of this Agreement, the parties consent to exclusive jurisdiction and venue in the state or federal courts located in, respectively, San Francisco County, California, or the Northern District of California. Any arbitration under these Terms will take place on an individual basis: class arbitrations and class actions are not permitted. YOU UNDERSTAND AND AGREE THAT BY ENTERING INTO THESE TERMS, YOU AND CHATFUEL ARE EACH WAIVING THE RIGHT TO TRIAL BY JURY OR TO PARTICIPATE IN A CLASS ACTION.

Miscellaneous. You will be responsible for paying, withholding, filing, and reporting all taxes, duties, and other governmental assessments associated with your activity in connection with the Services, provided that the Chatfuel may, in its sole discretion, do any of the foregoing on your behalf or for itself as it sees fit. The failure of either you or us to exercise, in any way, any right herein shall not be deemed a waiver of any further rights hereunder. If any provision of these Terms is found to be unenforceable or invalid, that provision will be limited or eliminated, to the minimum extent necessary, so that these Terms shall otherwise remain in full force and effect and enforceable. You and Chatfuel agree that these Terms are the complete and exclusive statement of the mutual understanding between you and Chatfuel, and that it supersedes and cancels all previous written and oral agreements, communications and other understandings relating to the subject matter of these Terms. You hereby acknowledge and agree that you are not an employee, agent, partner, or joint venture of Chatfuel, and you do not have any authority of any kind to bind Chatfuel in any respect whatsoever. You and Chatfuel agree there are no third party beneficiaries intended under these Terms.

Data Processing Addendum to the Chatfuel Terms of Use Regarding the Processing of Personal Data of Customers Worldwide (hereinafter referred to as "Chatfuel DPA")

by and between

200 LABS, INC., d/b/a Chatfuel, 490 Post Street, Ste 526, San Francisco, CA 94102, USA - hereinafter referred to as "Chatfuel" — and any Chatfuel customer that engages Chatfuel to process personal data in connection with the Services, regardless of the customer’s jurisdiction or the location of data subjects - hereinafter referred to as "Customer" —

Chatfuel and Customer hereinafter referred to as "Parties" and each as "Party" -

PREAMBLE

Chatfuel performs cloud-based analytics services for Customer ("Services") as agreed between the Parties in the Chatfuel Terms of Use ("Chatfuel Terms of Use"). This Chatfuel DPA form is a part of the Chatfuel Terms of Use. Capitalized terms used but not defined herein shall have the meaning given in the Chatfuel Terms of Use.

In connection with providing the Services, Chatfuel will process personal data within the meaning of applicable data protection laws, including without limitation Regulation (EU) 2016/679 (“GDPR”), UK data protection law, Swiss data protection law, as well as other relevant laws such as Brazil’s LGPD and applicable LATAM country laws, relating to (i) Customer and/or (ii) Customer’s customers (“Customer’s Customers”) or other data subjects for whom Customer or Customer’s customers act as controller or processor under applicable law (“Customer Personal Data”) or where Customers are for contractual reasons obliged to subject the data processing to data processing principles adequate to the one within the EEA or UK or Switzerland or New Zealand. Customer’s Customers are companies who render services to their end-customers and who engage Customer as their processor and Chatfuel as their sub-processor.

This Chatfuel DPA regulates the data protection obligations of the Parties when processing Customer Personal Data performed under the Chatfuel Terms of Use and will reasonably ensure such processing will only be rendered on behalf of and under the Instructions of Customer or Customer’s Customers.

To the extent the processing involves international transfers of Customer Personal Data from jurisdictions that impose transfer requirements, the Parties agree to use appropriate transfer mechanisms, including:

The EU Standard Contractual Clauses for the transfer of personal data to third countries, approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, with the applicable modules (including, as needed, Module Two “Controller to Processor” and/or Module Three “Processor to Processor”) (together, the “EU SCCs”);
- Where required, the UK International Data Transfer Addendum and/or the UK International Data Transfer Agreement (IDTA) for transfers from the United Kingdom;
- Where required, the Swiss adaptation of the SCCs for transfers from Switzerland;
- Where required, other legally recognized transfer mechanisms under applicable local laws (for example, contract clauses or other instruments recognized by competent authorities in LATAM jurisdictions, including Brazil under the LGPD), or narrowly applicable derogations expressly permitted by such laws.

In the event of any conflict between this Chatfuel DPA and the applicable SCCs/IDTA/addenda solely with respect to international data transfers, the SCCs/IDTA/addenda will prevail to the extent of such conflict.

1. DEFINITIONS

In addition to the definitions in Clause 1 and 4(a) SCC, the following definitions shall apply:

"Instruction" means any documented instruction, submitted by Customer to Chatfuel, directing Chatfuel to perform a specific action with regard to personal data. Instructions shall initially be specified in the Chatfuel Terms of Use and may, from time to time thereafter, be amended, supplemented or replaced by Customer by separate written or text form instructions, provided that such instructions still fall within the scope of the Services. Instructions issued for the purpose of complying with statutory claims under the GDPR such as rectification, erasure, restriction or portability of personal data fall within the scope of the Service;
"Applicable Law" means all laws, rules and regulations applicable to either party’s performance under this Chatfuel DPA, including but not limited to those applicable to the processing of personal data. This means, in particular, the GDPR and all national laws validly amending the applicable rules for the processing of personal data.

2. AMENDMENT OF CHATFUEL TERMS OF USE

This Chatfuel DPA amends the Chatfuel Terms of Use with respect to any processing of Customer Personal Data provided by Customer or by Customer’s Customers through Customer as amended from time to time by written agreement between both Parties. Chatfuel will, in the course of providing Services due under the Chatfuel Terms of Use, process Customer Personal Data which shall be subject to the following provisions contained in this Chatfuel DPA. When performing the Services, Chatfuel will act either as processor or sub-processor. Chatfuel’s function as processor or sub-processor will be determined by the function of Chatfuel’s Customer. If the Customer is the controller, then Chatfuel shall be the processor. If the Customer is the processor on behalf of its Customer’s Customers, then Chatfuel shall be the sub-processor, whereas Customer and Customer’s Customers, as communicated to Chatfuel by Customer, shall be entitled to issue Instructions under this Chatfuel DPA.

3. DATA PROCESSING, STANDARD CONTRACTUAL CLAUSES AND CONCLUSION

3.1. Any processing operation as described in Section 5 and Exhibit A. shall be subject to this Chatfuel DPA which includes the SCC in Exhibit C.

As explicitly allowed by Clause 2(a) s 2 of the SCC, Sections 1 through 14 of the Chatfuel DPA are meant to supplement the SCC, in particular, by way of providing guidance for their practical implementation and are not intended to contradict, directly or indirectly, any clauses of the SCC. In the event of any conflict between the SCC, the Chatfuel Terms of Use or this Chatfuel DPA, the order of prevalence between the terms included therein shall be as follows (in accordance with Clause 5 of the SCC):

the SCC, the terms in Exhibit A of the Chatfuel DPA which are the SCC and, in through Exhibit C meant to fill in particular, it's the required information for Appendix,
the remaining provisions of the Chatfuel DPA, and
Chatfuel Terms of Use and other contractual documents.

3.2. The Parties agree that by the Customer accepting the Chatfuel Terms of Use, to whom this Chatfuel DPA is attached, this Chatfuel DPA and the SCC included in Exhibit C will, by default, also be concluded between Chatfuel as data importer (as defined in the SCC) and Customer as data exporter (as defined in the SCC), whereas the following will apply:

3.2.1. In the cases where the Customer is acting as the controller of the personal data it provides, the terms of the SCC Controller to Processor will apply.

3.2.2. In the cases where the Customer is acting as a processor for one or more of Customer’s Customers, the terms of the SCC Processor to Processor will apply in relation to the personal data initially provided by Customer’s Customers. As to such cases, Customer warrants that it (i) is authorized by Customer’s Customers to enter into this Chatfuel DPA as their processor as well as to engage Chatfuel as their subprocessor and (ii) has concluded appropriate data processing agreements with its Customer’s Customers as the controller.Since the Customer is the only Party which has a direct relationship with Customer’s Customers, the Parties agree that whenever Chatfuel may be obligated to notify Customer’s Customers under this Chatfuel DPA including under the SCC Processor to Processor, such as under its Clause 9 (option 2) or Clause 10(a), the Customer warrants to promptly forward such notification from Chatfuel to the relevant Customer’s Customers.

Subject to the Chatfuel Terms of Use, additional Customer’s Customers may be added by Customer to obtain the Services. In such cases, the Parties agree that Chatfuel will process the personal data of such additional Customer’s Customers as a subprocessor under this Chatfuel DPA including the SCC under the same conditions and with the same effect as outlined in the previous paragraphs (Clause 7 of the SCC shall remain unaffected).

4. SAFEGUARDS AND SUPPORT FOR INTERNATIONAL DATA TRANSFERS

Chatfuel undertakes to provide reasonable support to Customer to ensure compliance with the requirements imposed on the transfer of personal data to third countries with respect to data subjects located in the EEA, UK and Switzerland. In accordance with Clause 14(c) of the SCC and without prejudice to the content of that Clause, Chatfuel will do so, in particular, by providing information to Customer which is reasonably necessary for Customer to complete a transfer impact assessment ("TIA"). Chatfuel further agrees to implement the supplementary measures agreed upon under Exhibit D in order to help Customer achieve compliance with requirements imposed on the transfer of personal data to third countries. Customer warrants that it will have successfully completed an appropriate TIA prior to initiating any processing under this Chatfuel DPA.

5. DETAILS OF DATA PROCESSING

The details of data processing (such as subject matter, nature and purpose of the processing, categories of personal data and data subjects), as also referenced in Annex I, A., B., C. of the Appendix of the SCC in Exhibit C, are described in the Chatfuel Terms of Use and in Exhibits A, B, and C.

6. CHATFUEL’S OBLIGATIONS

Chatfuel’s obligations are stipulated in the SCC, whereas these obligations shall be specified in accordance with Clause 2(a) s 2 of the SCC as follows, without prejudice to the obligations set out in the SCC:Chatfuel is permitted to anonymize Customer Personal Data through a reliable state of the art anonymization procedure and use such anonymized data for its own research and development purposes.

6.1. Technical and Organizational Data Security Measures

6.1.1. In accordance with Clause 8.6(a) SCC and Art. 32 GDPR, Chatfuel will implement the technical and organizational measures described in Annex II of the Appendix of the SCC in Exhibit C.

6.1.2. Without prejudice to Clause 8.6(a) SCC, if Chatfuel significantly modifies measures specified in Annex II of the Appendix of the SCC in Exhibit C, such modifications have to meet the obligations pursuant to Clause 8.6(a) SCC. Chatfuel shall make available to Customer a description of such modified measures which enables Customer to assess compliance with Art. 32 GDPR and Clause 8.6(a) SCC. Unless Customer explicitly rejects the modified measures within fourteen (14) days from receipt, the modified measures shall be deemed as accepted by Customer and Customer’s Customers, whereas Customer and Customer’s Customer shall not reject any modification that meets the requirements pursuant to Art. 32 GDPR as well as Clause 8.6(a) SCC.

6.2. Documentation and Audit Rights

6.2.1. In order to comply with its obligation to make available all information to demonstrate compliance in accordance Clauses 8.9(c) SCC, without prejudice to the content of these Clauses, Chatfuel shall, upon request and subject to an appropriate non-disclosure agreement, provide to Customer a comprehensive documentation of the technical and organizational data security measures in accordance with industry standards. The effectiveness of Chatfuel’s technical and organizational security measures will be audited by an independent third-party on an annual basis. In addition, Chatfuel may, in its discretion, provide data protection compliance certifications issued by a commonly accepted certification issuer which has been audited by a data security expert, by a publicly certified auditing company or by another customer of Chatfuel.

6.2.2. Chatfuel will allow for and contribute to audits in accordance with Clause 8.9(c) SCC Controller to Processor and Clause 8.9(d) SCC Processor to Processor, without prejudice to the content of this Clause, if Customer has justifiable reason to believe that Chatfuel is not complying with this Chatfuel DPA and, in particular, with the obligation to implement and maintain the agreed technical and organizational data security measures, once per year (unless there are specific indications that require a more frequent inspection). The customer agrees to be subject to an appropriate non-disclosure agreement when performing the audit. In deciding on a review or audit, Customer may take into account relevant certifications held by Chatfuel (the corresponding Clause 8.9(c) s 2 SCC Controller to Processor and Clause 8.9(d) s 3 SCC Processor to Processor shall remain unaffected). The costs associated with such audits and/or for providing additional information shall be borne by Customer unless such audit reveals Chatfuel’s material breach with this Chatfuel DPA.

6.2.3. In accordance with Clause 8.9(c) and (d) SCC and without prejudice to the content of these Clauses, the aforementioned audit right can be exercised by (i) requesting additional information, (ii) accessing the databases which process Customer Personal Data or (iii) by inspecting Chatfuel's working premises whereby in each case no access to personal data of other customers or Chatfuel’s confidential information will be granted.

6.2.4. If Customer intends to conduct an audit at Chatfuel’s premises or physical facilities, Chatfuel will allow for such audits in accordance Clause 8.9(d) s 2 SCC Controller to Processor and Clause 8.9(f) s 2 SCC Processor to Processor, without prejudice to the content of this Clause, whereas Customer shall, where appropriate, give reasonable notice to Chatfuel and agree with Chatfuel on the time and duration of the audit while inspections shall be made during regular business hours and in such a way that business operations are not disturbed. At least one employee of Chatfuel may accompany the auditors at any time. Chatfuel may memorialize the results of the audit in writing which shall be confirmed by Customer.

6.2.5. In accordance with Clause 8.9(d) s 1 SCC Controller to Processor and Clause 8.9(f) s 1 SCC Processor to Processor and without prejudice to the content of this Clause, Customer may also engage third party auditors to perform the audit in accordance with Sections 6.3.2, 6.3.3 and 6.3.4 on its behalf. Customer may not appoint a third party as auditor who (i) Chatfuel reasonably considers to be in a competitive relationship to Chatfuel, or (ii) is not sufficiently qualified to conduct such an audit, or (iii) is not independent (the corresponding Clause 8.9(d) s 1 SCC Controller to Processor and Clause 8.9(f) s 1 SCC Processor to Processor shall remain unaffected). Any such third-party auditor shall only be engaged if the auditor is bound by an appropriate non-disclosure agreement in favor of Chatfuel prior to conducting any audit or is bound by statutory confidentiality obligations.

6.3. Notification Duties

Without prejudice to Clauses 10(a) and 15.1(a) SCC,

Chatfuel shall inform Customer without undue delay in text form (e.g. letter, fax or e-mail) of threats to Customer Personal Data in possession of Chatfuel by garnishment, confiscation, insolvency and settlement proceedings or other similar incidents or measures by third parties;
In such a case, Chatfuel shall immediately inform the respective responsible person/entity that Customer holds the sovereignty and ownership of the personal data.

6.3.1. Data Subject Rights Requests

Without prejudice to Clause 10(a) SCC,

Chatfuel will promptly notify Customer of any request it has received from a data subject, who will, where appropriate, promptly notify Customer’s Customer about such request;
if a data subject addresses Chatfuel with claims for access, rectification, erasure, restriction, objection or data portability, Chatfuel shall refer the data subject to Customer, who will, where appropriate, refer data subject to Customer’s Customer.

In the case that claims based on Art. 82 GDPR are raised against Customer, Chatfuel shall reasonably support Customer with its defense to the extent the claim arises in connection with the processing of personal data by Chatfuel in connection with performing the Services to Customer.

7. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA (ART. 9 GDPR)

7.1. Categories of Special Data

Customer hereby informs Chatfuel, and Chatfuel acknowledges, that Customer and/or Customer’s Customers intentionally process special categories of personal data under Art. 9(1) GDPR, including but not limited to personal data concerning health (“Special Data”), through the Services.

7.2. Legal Basis (Art. 9 GDPR)

Customer warrants and represents that processing of Special Data is lawful under Art. 9(2) GDPR and is based on at least one of the following:

(a) Explicit consent of the data subject (Art. 9(2)(a) GDPR);

(b) Processing necessary for purposes of preventive or occupational medicine, medical diagnosis or health care (Art. 9(2)(h) GDPR);

(d) Any other applicable ground under Art. 9(2) GDPR or equivalent Swiss/UK legal provisions.

Customer is solely responsible for determining and documenting a valid legal ground prior to initiating processing of Special Data through the Services.

7.3. Prohibition Without Lawful Basis

Chatfuel must not process Special Data unless:

Customer has expressly notified Chatfuel that Special Data is included in Customer Personal Data, and
Customer has provided documented Instructions in accordance with Section 1 of this DPA confirming that the processing is lawful.

Chatfuel is entitled to suspend the processing of Special Data if Customer fails to provide evidence of compliance with Art. 9 GDPR.

7.4. Customer Obligations for Special Data

Customer shall:

(a) Obtain and maintain verifiable explicit consent when required by Art. 9(2)(a) GDPR;

(b) Provide appropriate notices to data subjects under Art. 13/14 GDPR;

(d) Ensure that special categories of data are not collected inadvertently (“accidental input”) and establish mechanisms for their deletion if such input occurs.

7.5. Chatfuel Responsibilities and Technical Measures

For Special Data, Chatfuel will apply, in addition to the security measures in Annex II, the following enhanced measures:

(a) Encryption of Special Data in transit (TLS 1.2+) and at rest (AES-256);

(b) Restricted access controls limited strictly to personnel with a demonstrated “need to know”;

(d) Segregation of Special Data from other customer data wherever technically possible;

(e) Prohibition on training machine learning models using Special Data unless explicitly authorized by Customer in writing;

(f) A shorter default retention schedule, unless Customer instructs otherwise in writing.

7.6. Restrictions on Subprocessing Special Data

Chatfuel may engage only those subprocessors who:

(a) implement security measures suitable for Special Data;

(b) have executed Art. 28-compliant agreements and SCC 2021;

Customer is responsible for notifying Customer’s Customers about any subprocessing activities.

7.7. Data Breach Notifications for Special Data

In case of a Personal Data Breach involving Special Data, Chatfuel shall:

notify Customer without undue delay and no later than 24 hours after becoming aware;
include all information required under Art. 33(3) GDPR;
cooperate fully to support Customer’s obligations under Art. 33 and Art. 34 GDPR.

7.8. Liability Allocation for Special Data Processing

Notwithstanding Section 9 of this DPA or any limitation of liability in the Terms of Use:

(a) Customer shall be fully responsible for ensuring that processing of Special Data has a lawful basis under Art. 9 GDPR;

(b) Customer shall indemnify Chatfuel for any claims, fines, or damages arising from Customer’s failure to meet obligations under Art. 9 GDPR;

(c) Chatfuel’s liability for breaches relating to Special Data that arise from failure to implement the agreed technical and organizational measures remains subject to the liability caps in the Terms of Use;

(d) The Parties agree that claims by Customer’s Customers or end-users shall be subject to the same liability framework.

7.9. International Transfers of Special Data

Chatfuel confirms that:

SCC 2021 (Module 2 or Module 3) apply fully to Special Data;
Supplementary measures under Exhibit D are implemented;
Customers must complete a Transfer Impact Assessment (TIA) before transferring Special Data

7.10. Data Minimization and Retention of Special Data

Unless otherwise instructed by Customer, Chatfuel shall:

(a) Retain Special Data no longer than necessary;

(b) Delete or pseudonymize Special Data earlier than other data categories if feasible;

8. CUSTOMER’S OBLIGATIONS

Customer’s obligations shall be as stipulated in the SCC, whereas these obligations shall be specified in accordance with Clause 2(a) s 2 of the SCC as follows, without prejudice to the obligations set out in the SCC:

8.1. Customer shall provide all Instructions of its own and/or of its Customer’s Customers pursuant to this Chatfuel DPA to Chatfuel in written, electronic or verbal form (the corresponding Clause 8.1(a) SCC

Controller to Processor and Clause 8.1(b) s 1 SCC Processor to Processor shall remain unaffected). Verbal Instructions shall be confirmed immediately in written form thereafter.

8.2. Customer shall notify Chatfuel in writing of the names of the persons who are entitled to issue Instructions to Chatfuel. Any consequential costs incurred resulting from Customer’s failure to comply with the preceding sentence shall be borne by Customer. In any event, the managing directors of Customer are entitled to issue Instructions.

8.3. Customer shall inform Chatfuel immediately if processing by Chatfuel might lead to a violation of data protection laws and regulations.

8.4. In the case that claims based on Art. 82 GDPR are raised against Chatfuel, Customer shall reasonably support Chatfuel with its defense to the extent the claim arises in connection with the processing of personal data by Chatfuel in connection with performing the Services to Customer.

8.5. Customer shall name a person responsible for dealing with questions relating to applicable data protection law and data security in the context of performing this Chatfuel DPA.

9. SUBPROCESSING

9.1. In accordance with Clause 9(a) SCC option 2, and without prejudice to the content of this Clause, Chatfuel has Customer’s and/or Customer’s Customers general authorization for the engagement of the sub-processor(s) listed in Exhibit B.

9.2. In accordance with Clause 9(b) SCC and without prejudice to the content of this Clause, any sub-processor is obliged before initiating the processing, to commit itself by way of written contract to comply with, in substance, the same data protection obligations as the ones under this Chatfuel DPA.

9.3. In order to fulfill its obligation under Clause 9(a) option 2 SCC and without prejudice to the content of this Clause, Chatfuel may provide a website or provide another written notice that lists all sub-processors to access Customer Personal Data as well as the limited or ancillary services they perform. In accordance with Clause 9(a) option 2 s 2 SCC and without prejudice to the content of this Clause, Chatfuel will update its website and/or notify Customer in light of any change of sub-processors, whereas Customer will immediately forward such notification to Customer’s Customers, and grant Customer and Customer’s Customers the opportunity to object to such change in conformity with the time period specified in the aforementioned Clause before authorizing any new sub-processor to access personal data. In the case that Customer and/or Customer’s Customer, as immediately communicated by Customer to Chatfuel, object/s to the change of sub-processors, Chatfuel can choose to either not engage the sub-processor or to terminate the Chatfuel Terms of Use with two (2) months prior written notice. Until the termination of the Chatfuel Terms of Use, Chatfuel may suspend the portion of the Services which is affected by the objection of Customer and/or Customer’s Customer. Customer and/or Customer’s Customers shall not be entitled to a pro-rata refund of the remuneration for the Services, unless the objection is based on justified reasons of non-compliance with applicable data protection law.

9.4. Customer herewith agrees for itself and also on behalf of Customer’s Customers, whereas Customer warrants to be duly authorized by Customer’s Customers to do so, to the sub-processors as set out in Exhibit B.

10. LIABILITY

In clarification of Clause 12 SCC and without prejudice to the content of this Clause, as regards the internal liability and without any effect as regards the external liability towards data subjects, the Parties agree that notwithstanding anything contained hereunder, when providing the Services, Chatfuel’s liability for breach of any terms and conditions under this Chatfuel DPA shall be subject to the liability limitations agreed in the Chatfuel Terms of Use. Further, no Customer Affiliate shall become beneficiary of this Chatfuel DPA without being bound by this Chatfuel DPA and without accepting this liability limitation. Customer will indemnify Chatfuel against any losses that exceed the liability limitations in the Chatfuel Terms of Use suffered by Chatfuel in connection with any claims of Customer Affiliates or data subjects who claim rights based on alleged violation of this Chatfuel DPA including the SCC.

11. COSTS FOR ADDITIONAL SERVICES

If Customer’s and/or Customer’s Customers’ Instructions lead to a change from or increase of the agreed Services or in the case of Chatfuel’s compliance with its obligations pursuant to Clauses 8.6(c), (d), and 10(b) SCC as well as Section 7.4 to assist Customer with Customer’s own statutory obligations, Chatfuel is entitled to charge reasonable fees for such tasks which are based on the prices agreed for rendering the Services and/or notified to Customer in advance. This shall be without prejudice to the obligations of Chatfuel under the aforementioned Clauses of the SCC.

12. CONTRACT PERIOD

The duration of this Chatfuel DPA depends on the duration of the Chatfuel Terms of Use. It commences with the initiation of the Services and shall terminate upon termination of the agreed Services under the Chatfuel Terms of Use, unless otherwise stipulated in the provisions of this Chatfuel DPA.

13. MODIFICATIONS

Chatfuel may modify or supplement this Chatfuel DPA, with two (2) weeks prior notice to Customer, (i) if required to do so by a supervisory authority or other government or regulatory entity, (ii) if necessary to comply with Applicable Law, (iii) to implement amended standard contractual clauses laid down by the European Commission or (iv) to adhere to a code of conduct or certification mechanism approved or certified pursuant to Art. 40, 42 and 43 of the GDPR. Customer shall notify Chatfuel if it does not agree to a modification, in which case Chatfuel may terminate this Chatfuel DPA and the Chatfuel Terms of Use with two (2) weeks' prior written notice, whereby in the case of an objection not based on non-compliance of the modifications with applicable data protection law, Chatfuel shall remain entitled to claim its agreed remuneration until the end of the agreed Services.

14. CHOICE OF LAW AND PLACE OF JURISDICTION

This Chatfuel DPA is governed by, and shall be interpreted in accordance with, the law that is stipulated by the Parties under Clause 17 SCC in Exhibit C, whereas the place of jurisdiction shall be as stipulated by the Parties under Clause 18(b) SCC in Exhibit C.

15. CUSTOMER PERSONAL DATA SUBJECT TO UK AND SWISS DATA PROTECTION LAWS

15.1 To the extent that the processing of Customer Personal Data is subject to UK data protection laws, the UK Addendum set out in Exhibit E shall apply.

15.2 To the extent that the processing of Customer Personal Data is subject to Swiss data protection laws, the Swiss Addendum set out in Exhibit F shall apply.

16. MISCELLANEOUS

In the event a clause under the Chatfuel Terms of Use has been found to violate the GDPR or any other Applicable Law, the Parties will mutually agree on modifications to the Chatfuel Terms of Use to the extent necessary to comply with Applicable Law.

Exhibit A – Specifications of the Processing

Data Exporter

The Customer and/or Customer’s Customers are creators of chatbots using Chatfuel’s bot-building platform.

Data Importer

Chatfuel is engaged in providing a platform-as-a-service-platform to Customers and Customer’s Customers to build, host, and manage chatbots to be used on Facebook/Instagram/WhatsApp/TikTok.

Categories of data subjects

The categories of data subjects whose personal data are transferred: Individual online consumers of Customer and Customer’s Customers.

Categories of personal data

The transferred categories of personal data are:

Customer and Customer’s Customers’ online consumers / bot users’ first name, last name, Facebook/Instagram/WhatsApp/TikTok avatar photo, time zone, language settings and gender, as long as those pieces of information are available in the public Facebook/Instagram/WhatsApp/TikTok profiles, as well as any other data contained in the chatbot conversation transcripts.

Special categories of personal data (if applicable)

The transferred personal data includes the following special categories of data: Chatfuel is not aware of any such data but Customers can create bots that could potentially also collect all sorts of special categories of personal data.

The applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures are: As Chatfuel is not aware of special categories of personal data being processed by Customers through bots, the safeguards and measures outlined under Annex II of the Appendix of the SCC in Exhibit C will apply.

Frequency of the transfer

The frequency of the transfer is: The transfer is performed on a continuous basis.

Subject matter of the processing

The subject matter of the processing is: Chatfuel is a platform that allows its Customer’s and Customer’s Customers’ online consumers to get in contact with the Customer or Customer’s Customers by communicating with the provided chatbots via Facebook/ Instagram/ WhatsApp/TikTok.

Nature of the processing

The nature of the processing includes the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, erasure of data.

Purpose(s) of the data transfer and further processing

The purpose of the data transfer and further processing is: Chatfuel uses personal data to enable bot admins to customize and improve bot experiences based on users’ public Facebook/Instagram/WhatsApp/TikTok profiles and data users share with the bot. Where Customer connects a third-party application, including an AI assistant, to its Chatfuel account, any disclosure of personal data to that application is made on Customer’s documented instruction. The provider of such application is engaged by Customer and is not a sub-processor of Chatfuel.

Duration

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period is: The duration shall be as stipulated and referenced in Section 11 of the Terms of the Processing.

Sub-processor (if applicable)

For transfers to sub-processors, specify subject matter, nature and duration of the processing: As stipulated in the second column to the right of the table set out in Exhibit B of the Chatfuel DPA or, where applicable, in a separate document which Chatfuel uses to inform / notify Customer in relation to utilized sub-processors.

Exhibit B – List of Sub-processors

Below is the list of the key sub-processors which are utilized by Chatfuel at the commencement of the processing:

Name and address of the sub-processor	Contact person’s name, position and contact details	Description of processing (including subject matter, nature and duration of the processing as well as a clear delimitation of responsibilities in case several sub-processors are authorised) (as referenced in Annex I B. and Annex III of the Appendix of the SCC)	Specific technical and organisational measures to be taken by the sub-processor to be able to provide assistance to Customer (as referenced in Annex II of the Appendix of the SCC)
Microsoft Corporation, One Microsoft Way, Redmond WA 98052-6399, USA	See Microsoft’s customer support or use Microsoft’s privacy web form which is available at http://go.microsoft.com/?linkid=9846224. Microsoft’s mailing address as to data privacy Is: Microsoft Enterprise Service Privacy Microsoft Corporation One Microsoft Way Redmond, Washington 98052 USA The mailing address of the privacy representative of Microsoft Ireland Operations Limited, who is responsible for the European Economic Area and Switzerland, can be reached at the following address: Microsoft Ireland	Chatfuel utilizes the cloud-based service Microsoft Azure for hosting its cloud database and cloud services. Chatfuel partners with Microsoft Clarity to capture how the clients use and interact with Chatfuel website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Microsoft provides its services on the basis of its own on standardized terms and conditions which are similar but not identical to the ones under this agreement. The terms and conditions of Microsoft are also based on Standard Contractual Clauses. Customer can view such terms and conditions at: https://www.microsoft.com/e n-us/licensing/product-licen sing/products.aspx For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement at: https://privacy.microsoft.com/en-us/privacystatement The nature of the processing includes the collection, storage and erasure of the data. The duration in relation to Customer and Customer’s Customer shall be as stipulated and referenced in Section 11 of the Terms of the Processing. Cha	As set out in Appendix A – Security Measures of the Microsoft Products and Services Data Protection Addendum which can be found under http://www.aka.ms/DPA
Google, Inc., 1600 Amphitheat re Parkway, Mountain View, CA 94043, USA	Google’s Cloud data privacy team can be contacted at https://support.google.com /cloud/contact/dpo	Google, Inc. is providing cloud services for hosting data importer’s cloud database and cloud services, and large language model services (Gemini, via Google Cloud) used to deliver the AI features of the Chatfuel service. Google provides its services on the basis of its own on standardized terms and conditions which are similar to the ones under this agreement. The terms and conditions of Google are based on Standard Contractual Clauses. Customer can view such terms and conditions at: https://cloud.google.com/ter ms/data-processing-term s. The nature of the processing includes the collection, storage and erasure of the data. The duration in relation to Customer and Customer’s Customer shall be as stipulated and referenced in Section 11 of the Terms of the Processing.	As set out in Appendix 2: Security Measures of the Data Processing Amendment to Google Workspace and/or Complementary Product Agreement which can be found under https://workspace.googl e.com/terms/dpa_terms .html

Other sub-processors for the provision of Chatfuel services

Entity name	Purpose of processing	Location
Atlassian Pty Ltd	Hosting, technology and communication providers	Australia
Pagerduty Inc.	Hosting, technology and communication providers	United States
Cloudflare Inc.	Hosting, technology and communication providers	United States
GitHub Inc.	Hosting, technology and communication providers	United States
Netlify Inc.	Hosting, technology and communication providers	United States
Typeform, S.L.	Support and customer service	Spain
Shopify Inc.	Product fulfillment and delivery providers	Canada
Zapier Inc.	Product fulfillment and delivery providers	United States
Twilio Inc.	Product fulfillment and delivery providers	United States
OpenAI, LLC	AI features (large language model processing)	United States
Stripe, Inc.	Payment processor	United States
Meta Platforms, Inc.	Ad network	United States
Close CRM	Marketing providers	United States
Pipedrive	Marketing providers	United States
QlikTech,Inc. (Stitchdata)	Analytics Partners	United States
PostHog, Inc.	Analytics Partners	United States

Exhibit C – Standard Contractual Clauses for International Data Transfers (Module Two: Transfer controller to processor / Module Three: Transfer processor to processor)

Standard Contractual Clauses

Customer is hereinafter referred to as the "data exporter" with respect to the personal data provided to Chatfuel. Whenever the Customer is acting as a processor for Customer’s Customers as outlined under Section 3.2.2., the Clauses of Module three (processor to processor) as highlighted below shall respectively apply.

Chatfuel is hereinafter referred to as the "data importer".

The data exporter and the data importer, each a "party" and collectively "the parties" HAVE AGREED on the following SCC in order to implement adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

SECTION I

Clause 1. Purpose and scope

(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (1) for the transfer of personal data to a third country.

(b) The Parties:

(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and

(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)

have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).

(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2. Effect and invariability of the Clauses

(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3. Third-party beneficiaries

(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:

(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;

(ii) Clause 8 – Clause 8.1(b), 8.9(a), (c), (d) and (e); Module Three: Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g);

(iii) Clause 9 –Clause 9(a), (c), (d) and (e); Module Three: Clause 9(a), (c), (d) and (e);

(iv) Clause 12 –Clause 12(a), (d) and (f);

(v) Clause 13;

(vi) Clause 15.1(c), (d) and (e);

(vii) Clause 16(e);

(viii) Clause 18 – Clause 18(a) and (b).

(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

Clause 4. Interpretation

(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5. Hierarchy.

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6. Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

SECTION II — OBLIGATIONS OF THE PARTIES

MODULE TWO: Transfer controller to processor

Clause 8. Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

8.1 Instructions

(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.

(b) The data importer shall immediately inform the data exporter if it is unable to follow those instructions.

8.2 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.

8.3 Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.4 Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.

8.5 Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

8.6 Security of processing

(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.

(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.

8.7 Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B. Customers are explicitly prohibited from processing special categories of data (Art. 9 GDPR) unless the Customer has obtained explicit consent and provided documented instructions to Chatfuel.

8.8 Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union¹ (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:

(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;

(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;

(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or

(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.9 Documentation and compliance

(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.

(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.

(c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.

(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.

(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.

¹ The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.

MODULE THREE: Transfer processor to processor

Clause 8. Data protection safeguards

8.1 Instructions

(a) The data exporter has informed the data importer that it acts as processor under the instructions of its controller(s), which the data exporter shall make available to the data importer prior to processing.

(b) The data importer shall process the personal data only on documented instructions from the controller, as communicated to the data importer by the data exporter, and any additional documented instructions from the data exporter. Such additional instructions shall not conflict with the instructions from the controller. The controller or data exporter may give further documented instructions regarding the data processing throughout the duration of the contract.

(c) The data importer shall immediately inform the data exporter if it is unable to follow those instructions. Where the data importer is unable to follow the instructions from the controller, the data exporter shall immediately notify the controller.

(d) The data exporter warrants that it has imposed the same data protection obligations on the data importer as set out in the contract or other legal act under Union or Member State law between the controller and the data exporter (5).

8.2 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I. B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, or from the data exporter.

8.3 Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.

8.4 Accuracy

8.5 Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

8.6 Security of processing

(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter or the controller. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.

(b) The data importer shall grant access to the data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify, without undue delay, the data exporter and, where appropriate and feasible, the controller after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the data breach, including measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(c) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify its controller so that the latter may in turn notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.

8.7 Sensitive data

8.8 Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the controller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union² (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:

(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;

(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679;

(iii) the onward transfer is necessary for the establishment, exercise or defense of legal claims in the context of specific administrative, regulatory or judicial proceedings; or

(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.9 Documentation and compliance

(a) The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller that relate to the processing under these Clauses.

(c) The data importer shall make all information necessary to demonstrate compliance with the obligations set out in these Clauses available to the data exporter, which shall provide it to the controller.

(d) The data importer shall allow for and contribute to audits by the data exporter of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. The same shall apply where the data exporter requests an audit on instructions of the controller. In deciding on an audit, the data exporter may take into account relevant certifications held by the data importer.

² The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purposes of these Clauses

(e) Where the audit is carried out on the instructions of the controller, the data exporter shall make the results available to the controller.

(f) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.

(g) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.

MODULE TWO: Transfer controller to processor

Clause 9. Use of sub-processors

(a) The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least two (2) weeks in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.

(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. (8) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.

(c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.

(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.

(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

MODULE THREE: Transfer processor to processor

Clause 9. Use of sub-processors

1. The data importer has the controller’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least two (2) weeks in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the controller with the information necessary to enable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s).

2. Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.

3. The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.

4. The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.

5. The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

MODULE TWO: Transfer controller to processor

Clause 10. Data subject rights

(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.

(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organizational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.

(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.

MODULE THREE: Transfer processor to processor

Clause 10. Data subject rights

1. The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request it has received from a data subject, without responding to that request unless it has been authorised to do so by the controller.

2. The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.

3. In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the controller, as communicated by the data exporter.

Clause 11. Redress

(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.

(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.

(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:

(d) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;

(i) refer the dispute to the competent courts within the meaning of Clause 18.

(e) The Parties accept that the data subject may be represented by a not-for-profit body, organization or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.

(f) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.

(g) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.

Clause 12. Liability

(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.

(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.

(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.

(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage. Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.

(e) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.

(f) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.

Clause 13. Supervision

(a) Where the data exporter is established in an EU Member State: The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679: The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679: The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.

(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14. Local laws and practices affecting compliance with the Clauses

(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.

(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:

(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;

(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards³;

(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.

(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.

(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.

³ As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.

(e) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation [for Module Three:, if appropriate in consultation with the controller].. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by [for Module Three: the controller or] the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.

Clause 15. Obligations of the data importer in case of access by public authorities

15.1 Notification

(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it: receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or

(i) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.

[For Module Three: The data exporter shall forward the notification to the controller.]

(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.

(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.). [For Module Three: The data exporter shall forward the information to the controller.]

(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.

(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to

Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.

15.2 Review of legality and data minimisation

(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects ofthe request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).

(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request. [For Module Three: The data exporter shall make the assessment available to the controller.]

(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.

SECTION IV – FINAL PROVISIONS

Clause 16. Non-compliance with the Clauses and termination

(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.

(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).

(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:

(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;

(ii) the data importer is in substantial or persistent breach of these Clauses; or

(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses. In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.

(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.

Clause 17. Governing law

These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of the Federal Republic of Germany.

Clause 18. Choice of forum and jurisdiction

(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.

(b) The Parties agree that those shall be the courts of the Federal Republic of Germany.

(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.

(d) The Parties agree to submit themselves to the jurisdiction of such courts.

APPENDIX

EXPLANATORY NOTE:

It must be possible to clearly distinguish the information applicable to each transfer or category of transfers and, in this regard, to determine the respective role(s) of the Parties as data exporter(s) and/or data importer(s). This does not necessarily require completing and signing separate appendices for each transfer/category of transfers and/or contractual relationship, where this transparency can be achieved through one appendix. However, where necessary to ensure sufficient clarity, separate appendices should be used.

ANNEX I

A. LIST OF PARTIES

Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

The Customer, in its role as a controller or processor as outlined in the Chatfuel DPA, whereas identity, contact details, and information on the contact person are as provided by Customer when signing up for Chatfuel services.

The activities of the data exporter relevant to the data transferred are stipulated in Section 1 under Exhibit A.

Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]

Chatfuel, in its role as a processor or sub-processor as outlined in the Chatfuel DPA, whereas identity and contact details, can be found in the beginning of this Chatfuel DPA and in the next paragraph.

Data privacy inquiries in relation to this Chatfuel DPA may be sent to [email protected] or via postal mail to us at 200 Labs, Inc., d/b/a Chatfuel, 490 Post Street, Suite 526, San Francisco, CA 94102 USA.

The EEA representative of Chatfuel is Mr. Alexander Viedge, GDPR AV Services UG who may be contacted under [email protected] or via postal mail under Fraunhoferstraße 8a, 48161 Münster, Germany. The activities of the data importer relevant to the data transferred under these Clauses are stipulated in Section 2 under Exhibit A.

DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

As stipulated in Exhibit A of the Chatfuel DPA.

Categories of personal data transferred

As stipulated in Exhibit A of the Chatfuel DPA.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

As referenced in Exhibit A of the Chatfuel DPA.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

As stipulated in Exhibit A of the Chatfuel DPA.

Nature of the processing

As stipulated in Exhibit A of the Chatfuel DPA

Purpose(s) of the data transfer and further processing

As stipulated in Exhibit A of the Chatfuel DPA

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

As stipulated in Exhibit A of the Chatfuel DPA

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

As stipulated in Exhibit B of the Chatfuel DPA

B. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13

Each supervisory authority of the EU and EEA is competent for the performance of the tasks assigned to and the exercise of the powers on the territory of its own Member State. A list of the supervisory authorities across the European Union and EEA can be found under the following link:

https://edpb.europa.eu/about-edpb/about-edpb/members_en

As to Germany, the supervisory authority mentioned under the aforementioned link called “Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit“ is responsible for supervising public authorities of the federal government, public-sector companies, insofar as they participate in the competition, and companies which process data from natural and legal persons in order to commercially provide telecommunication services while the responsibility for supervision does not already come from Section 115 para 4 of the Telecommunication Act (“Telekommunikationsgesetzes”). Additionally, there is also a supervisory authority in each federal state (“Bundesland”) in Germany which is responsible for private entities established in its respective federal state. Please find a list of these German supervisory authorities under the following link:

https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html;jsessionid=1D7E 4 92F9E963C3ADC18161A232AADBD.intranet241

Where the data exporter is established in an EU Member State: The competent supervisory authority is the one at the establishment of the data exporter.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR: The competent supervisory authority is the one of the Member State in which the representative is established.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of the GDPR: The competent supervisory authority is the supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located.

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

This Annex II forms part of the Clauses and must be completed by the parties.

Description of the technical and organizational security measures implemented by the data importer / Chatfuel (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, as well as the risks for the rights and freedoms of natural persons.

1. Access control to premises and facilities:

Only authorized representatives have access to Chatfuel’s premises and facilities. Measures include:

Chatfuel has physical offices in office buildings located in San Francisco, CA, USA. Keys to the office locations are issued to all employees in accordance with their need to have access. The distribution and usage of keys are managed and monitored by the Office Manager.
The San Francisco office is secured and monitored by SimpliSafe security system on a 24/7 basis, which includes access to police dispatch. Key points within the San Francisco office building are monitored by security cameras.
Offices are secured outside of regular business hours.

2. Physical access:

Chatfuel ensures physical access to Customer Personal Data is protected. Measures include:

Chatfuel runs its services from professional, third-party production data centers that meet a broad set of international and industry-specific compliance standards, such as ISO 27001, HIPAA, FedRAMP, SOC 1 and SOC 2, as well as country-specific standards like Australia IRAP, UK G-Cloud, and Singapore MTCS. Rigorous third-party audits, such as by the British Standards Institute, verify adherence to the strict security controls these standards mandate.
Power and telecommunications cabling carrying Customer Personal Data or supporting information services at the production data center are protected from interception, interference and damage.
Production data centers and their equipment are physically protected against natural disasters, malicious attacks and accidents.
Equipment at production data centers is protected from power failures and other disruptions caused by failures in supporting utilities, and is correctly maintained.

3. Access control to systems:

Chatfuel’s data processing systems are used only by approved, authenticated users. Measures include:

Access to Chatfuel internal systems is granted only to Chatfuel personnel and/or to permitted employees of Chatfuel’s subcontractors and access is strictly limited as required for those persons to fulfill their function.
Access to production servers is secured against unauthorized use through the encrypted data transmission over SSL/SSH.
All users access Chatfuel systems with a unique identifier (user ID).
Each computer has a password-protected screensaver.
Chatfuel has a thorough procedure to deactivate users and their access when a user leaves the company or a function.

4. Access control to data:

Persons entitled to use data processing systems gain access only to the Customer Personal Data that they are authorized to access.

Measures include:

Chatfuel restricts personnel access to files and programs on a "need-to-know” basis.
The production environment is separate from the development and testing environment.
Chatfuel uses well-configured firewalls for their backend infrastructure.
Chatfuel Platform contains capabilities to set roles and permissions to let Customers manage authorizations to set that Customer Personal Data is only made available to appropriate users when needed.

5. Data Transmission:

Chatfuel takes steps to prevent Customer Personal Data from being read, copied, altered or deleted by unauthorized parties during transfer.

Measures include:

All Customer Personal Data that is coming to Chatfuel Platform from Facebook/Instagram/WhatsApp/TikTok is transmitted in encrypted form over HTTPS protocol.
Chatfuel Platform supports integrations with third-party services over HTTPS protocol.
To protect Customer Personal Data Chatfuel uses the Advanced Encryption Standard (AES) in Galois/Counter Mode (GCM) with a 128-bit key (AES-128-GCM) to implement encryption at the network layer.
Chatfuel uses an encryption key management infrastructure which is designed with technical security controls with very limited direct access to keys.

The Customer is responsible for the security of Customer Personal Data once it has been transmitted from Chatfuel to the Customer including when downloaded or accessed by Customer users.

6. Confidentiality and Integrity:

Customer Personal Data remains confidential throughout processing and remains intact, complete and current during processing activities.

Measures include:

Chatfuel has a central, secured repository of product source code, which is accessible only to authorized personnel.
All changes to Chatfuel Platform’s source code are being tracked, thoroughly reviewed, and tested in an isolated environment before being accepted.
All releases to the production environment are additionally tested in an isolated staging environment, reviewed and approved before being deployed.

7. Availability:

Customer Personal Data is protected from accidental destruction or loss, and there is timely access, restoration or availability to Customer Personal Data in the event of an incident.

Measures include:

Chatfuel uses a high level of redundancy at the production data center so that an availability failure of a single system or component is unlikely to impact general availability.
Chatfuel deploys its infrastructure only on reliable cloud providers whose data centers have multiple power supplies, generators on-site and with battery backup to safeguard power availability to the data center, and multiple access points to the Internet to safeguard connectivity.
Chatfuel uses commercially reasonable efforts to create frequent backup copies of Customer Personal Data.
Chatfuel has a system in place to ensure that any failures of backup to operate correctly are flagged and dealt with.
Chatfuel’s infrastructure and services are monitored 24x7x365 for availability and technical issues. Current availability of the Chatfuel Platform can be seen at http://status.chatfuel.com.

8. Job Control:

Customer Personal Data processed on a Customer’s behalf is processed solely in accordance with the relevant agreement and related instructions of the Customer including in the use of sub-processors. Measures include:

Chatfuel acts as data processor or sub-processor (as regards to Customer’s Customers) with respect to Customer Personal Data and stores and processes Customer Personal Data in order to operate the Chatfuel Platform.
Chatfuel does not access Customer Personal Data, except to provide services to the Customer which Chatfuel is obligated to perform in support of the Customer experience including for general operation and monitoring of Chatfuel Platform, troubleshooting and maintenance purposes, for security reasons, as required by law, or on request by Customer.
Chatfuel uses a limited number of sub-processors to help it provide the Service. A list of individual sub-processors can be found in Exhibit B.

10. Description of the specific technical and organisational measures to be taken by the to assist with the fulfillment of data subject requests (Clause 10 (b) SCC)

In order to for the data importer / Chatfuel to assist the data exporter / Customer with fulfilling its obligations to respond to data subjects’ requests in accordance with Clause 10 (b) SCC, the Parties will set out the appropriate technical and organizational measures in the following, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required: Chatfuel has put in place technological measures which allow for the personal data of a specific data subject to be efficiently and quickly obtained, rectified, restricted or erased in order to assist the Customer and Customer’s Customers with the fulfilment of data subject request. Furthermore, (i) work instructions have been put in place and (ii) a number of employees of Chatfuel have been trained on how to properly deal with data subject requests.

11. Technical and Organizational Security Measures in relation to special categories of data (where applicable) (Appendix, Annex I B. SCC; Exhibit A)

If special categories of personal are processed as outlined in Exhibit A of the Chatfuel DPA, the applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures are: Please see Exhibit A, Section 5.

12. For transfers to (sub-) processors, technical and organizational measures to be taken by the (sub-) processor to assist to the data exporter

For transfers to (sub-) processors, the technical and organizational measures to be taken by the (sub-) processor to be able to provide assistance to the data importer / Customer are: As stipulated in the right column of the table set out in Exhibit B of the Chatfuel DPA or, where applicable, in a separate document which Chatfuel uses to notify Customer in relation to sub-processors.

ANNEX III LIST OF SUB-PROCESSORS

EXPLANATORY NOTE:

This Annex must be completed, in case of the specific authorisation of sub-processors (Clause 9(a), Option 1).

The controller has authorized the use of the following sub-processors: Not applicable as Option 2 of Clause 9(a) shall apply.

Exhibit D — Supplementary Measures for International Data Transfers

Chatfuel commits to implementing the following supplementary measures based on guidance provided by EU supervisory authorities in order to enhance the protection for Customer Personal Data in relation to the processing in a third country.

1. Encryption

a) The personal data is transmitted (between the Parties and by Chatfuel between data centers as well as to a sub-processor and back) using strong encryption.

Hereby, it is ensured that the encryption protocols employed are state-of-the-art and provide effective protection against active and passive attacks with resources known to be available to the public authorities of a third country, specific protective and state-of-the-art measures are used against active and passive attacks on the sending and receiving systems providing transport encryption, including tests for software vulnerabilities and possible backdoors, in case the transport encryption does not provide appropriate security by itself due to experience with vulnerabilities of the infrastructure or the software used, personal data is also encrypted end-to-end on the application layer using state-of-the-art encryption methods, the encryption algorithm and its parameterization (e.g., key length, operating mode, if applicable) conform to the state-of-the-art and can be considered robust against cryptanalysis performed by the public authorities when data is transiting to this third country taking into account the resources and technical capabilities (e.g., computing power for brute-force attacks) available to them⁵, the strength of the encryption takes into account the specific time period during which the confidentiality of the encrypted personal data must be preserved, the encryption algorithm is implemented correctly and by properly maintained software without known vulnerabilities the conformity of which to the specification of the algorithm chosen has been verified, e.g., by certification, the keys are reliably managed (generated, administered, stored, if relevant, linked to the identity of the intended recipient, and revoked).

b) The personal data at rest is stored by Chatfuel using strong encryption.

The encryption algorithm and its parameterization (e.g., key length, operating mode, if applicable) conform to the state-of-the-art and can be considered robust against cryptanalysis performed by the public authorities in the recipient country taking into account the resources and technical capabilities (e.g., computing power for brute-force attacks) available to them³. The strength of the encryption and key length takes into account the specific time period during which the confidentiality of the encrypted personal data must be preserved. The encryption algorithm is implemented correctly and by properly maintained software without known vulnerabilities the conformity of which to the specification of the algorithm chosen has been verified, e.g., by certification. The keys are reliably managed (generated, administered, stored, if relevant, linked to the identity of an intended recipient, and revoked).

⁴ EDPB, Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, V 2.0, 18 June 2021, Annex 2.

⁵ For the assessment of the strength of encryption algorithms, their conformity with the state-of-the-art, and their robustness against cryptanalysis over time, Customer can rely on technical guidance published by official cybersecurity authorities of the EU and its member states. See e.g. ENISA Report « What is "state of the art" in IT security? », 2019, https://www.enisa.europa.eu/news/enisa-news/what-is-state-of-the-art-in-it-security; guidance given by the German Federal Office for Information Security in its Technical Guidelines of the TR-02102 series and ”Algorithms, Key Size and Protocols Report (2018), H2020-ICT-2014 – Project 645421, D5.4, ECRYPT-CSA, 02/2018” at https://www.ecrypt.eu.org/csa/documents/D5.4-FinalAlgKeySizeProt.pdf.

2. Organizational Measures

2.1 Transparency and accountability measures

Regular publication of transparency reports or summaries regarding governmental requests for access to data and the kind of reply provided, insofar publication is allowed by local law.

2.2 Organizational methods and data minimization measures

Already existing organizational requirements under the accountability principle, such as the adoption of strict and granular data access and confidentiality policies and best practices, based on a strict need-to-know principle. Data minimization should be considered in this regard, in order to limit the exposure of personal data to unauthorized access. For example, in some cases it might not be necessary to transfer certain data.

2.3 Others

Adoption and regular review by Chatfuel of internal policies to assess the suitability of the implemented complementary measures and identify and implement additional or alternative solutions when necessary, to ensure that an essentially equivalent level of protection to that guaranteed within the EEA of the personal data transferred is maintained.

3. Additional Contractual Measures

3.1 Transparency obligations

a) Chatfuel declares that (1) it has not purposefully created back doors or similar programming that could be used to access the system and/or personal data, (2) it has not purposefully created or changed its business processes in a manner that facilitates access to personal data or systems, and (3) that national law or government policy does not require Chatfuel to create or maintain back doors or to facilitate access to personal data or systems or for Chatfuel to be in possession or to hand over the encryption key.

b) Chatfuel will verify the validity of the information provided for the TIA questionnaire in regular intervals and provide notice to Customer in case of any changes without delay. Clause 14(e) SCC shall remain unaffected.

3.2 Obligations to take specific actions

In case of any order to disclose or to grant access to the personal data, Chatfuel commits to inform the requesting public authority of the incompatibility of the order with the safeguards contained in the Article 46 GDPR transfer tool and the resulting conflict of obligations for Chatfuel.

3.3 Empowering data subjects to exercise their rights

Chatfuel commits to fairly compensate the data subject for any material and non-material damage suffered because of the disclosure of his/her personal data transferred under the chosen transfer tool in violation of the commitments it contains.

Notwithstanding the foregoing, Chatfuel shall have no obligation to indemnify the data subject to the extent the data subject has already received compensation for the same damage.

Compensation is limited to material and non-material damages as provided in the GDPR and excludes consequential damages and all other damages not resulting from Chatfuel´s infringement of the GDPR.

Exhibit E — UK Addendum

As stipulated in Section 14.1 of this Chatfuel DPA, this UK Addendum shall apply to any processing of Customer Personal Data subject to the UK GDPR under this Chatfuel DPA.

1. Interpretation of this Addendum

1.1. Where this Addendum uses terms that are defined in the Standard Contractual Clauses set out in Exhibit C to this Chatfuel DPA, those terms shall have the same meaning as in the Standard Contractual Clauses. In addition, the following terms have the following meanings:

This Addendum	This Addendum to the Clauses
Clauses	The Standard Contractual Clauses set out in Exhibit C to this Chatfuel DPA
UK Data Protection Laws	All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.
UK GDPR	The United Kingdom General Data Protection Regulation, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.
UK	The United Kingdom of Great Britain and Northern Ireland

1.2. This Addendum shall be read and interpreted in the light of the provisions of UK Data Protection Laws, and so that if fulfils the intention for it to provide the appropriate safeguards as required by Article 46 UK GDPR.

1.3. This Addendum shall not be interpreted in a way that conflicts with rights and obligations provided for in UK Data Protection Laws.

1.4. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, reenacted and/or replaced after this Addendum has been entered into.

2. Hierarchy

In the event of a conflict or inconsistency between this Addendum and the provisions of the Clauses or other related agreements between the Parties, existing at the time this Addendum is agreed or entered into thereafter, the provisions which provide the most protection to data subjects shall prevail.

3. Incorporation of the Clauses

3.1. In relation to any processing of personal data subject to the UK GDPR, this Addendum amends this Chatfuel DPA including the Clauses in its Exhibit C to the extent necessary so they operate:

a. for transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that transfer; and

b. to provide appropriate safeguards for the transfers in accordance with Article 46 of the UK GDPR.

3.2. The amendments to the Chatfuel DPA including the Clauses in its Exhibit C as required by Section 5 above, include (without limitation):

a. References to the “Clauses” or the “SCC” means this Addendum as it amends the Clauses.

b. Clause 6 Description of the transfer(s) is replaced with:

"The details of the transfer(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer."

c. References to “Regulation (EU) 2016/679” or “that Regulation” or “GDPR” are replaced by “UK Data Protection Laws” and references to specific Article(s) of “Regulation (EU) 2016/679” or “GDPR” are replaced with the equivalent Article or Section of UK Data Protection Laws.

d. References to Regulation (EU) 2018/1725 are removed.

e. References to the “European Union”, “Union”, “EEA”, “EU” and “EU Member State” are all replaced with the “UK”.

f. Clause 13(a) and Part C of Annex II are not used; the “competent supervisory authority” is the Information Commissioner;

g. Clause 17 is replaced to state “These Clauses are governed by the laws of England and Wales”.

h. Clause 18 is replaced to state:

“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”

i. The footnotes to the Clauses do not form part of the Addendum.

Exhibit F — Swiss Addendum

As stipulated in Section 14.2 of this Chatfuel DPA, this Swiss Addendum shall apply to any processing of Customer Personal Data subject to Swiss data protection law under this Chatfuel DPA or to Swiss data protection law and the GDPR.

1. Interpretation of this Addendum

This Addendum

This Addendum to the Clauses

Clauses

The Standard Contractual Clauses set

out in Exhibit C to this Chatfuel DPA

Swiss Data Protection Laws

The Swiss Federal Act on Data Protection of 19 June 1992 and the Swiss Ordinance to the Swiss Federal Act on Data Protection of 14 June 1993, and any new or revised version of these laws that may enter into force from time to time.

1.2. This Addendum shall be read and interpreted in the light of the provisions of Swiss Data Protection Laws, and so that if fulfills the intention for it to provide the appropriate safeguards as required by Article 46 GDPR and/or Article 6(2)(a) of the Swiss Data Protection Laws, as the case may be.

1.3. This Addendum shall not be interpreted in a way that conflicts with rights and obligations provided for in Swiss Data Protection Laws.

2. Hierarchy

3. Incorporation of the Clauses

3.1. In relation to any processing of personal data subject to Swiss Data Protection Laws or to both Swiss Data Protection Laws and the GDPR, this Addendum amends this Chatfuel DPA including the Clauses in its Exhibit C to the extent necessary so they operate:

a. for transfers made by the data exporter to the data importer, to the extent that Swiss Data Protection Laws or Swiss Data Protection Laws and the GDPR apply to the data exporter’s processing when making that transfer; and

b. to provide appropriate safeguards for the transfers in accordance with Article 46 of the UK GDPR and/or Article 6(2)(a) of the Swiss Data Protection Laws, as the case may be.

3.2. To the extent that any processing of personal data is exclusively subject to Swiss Data Protection Laws, the amendments to the Chatfuel DPA including the Clauses in its Exhibit C as required by Section 3.1 above, include (without limitation):

a. References to the “Clauses” or the “SCC” means this Addendum as it amends the Clauses.

b. Clause 6 Description of the transfer(s) is replaced with:

"The details of the transfer(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where Swiss Data Protection Laws apply to the data exporter’s processing when making that transfer."

c. References to “Regulation (EU) 2016/679” or “that Regulation” or “GDPR” are replaced by “Swiss Data Protection Laws” and references to specific Article(s) of “Regulation (EU) 2016/679” or “GDPR” are replaced with the equivalent Article or Section of Swiss Data Protection Laws to the extent applicable.

d. References to Regulation (EU) 2018/1725 are removed.

e. References to the “European Union”, “Union”, “EEA”, “EU” and “EU Member State” are all replaced with “Switzerland”.Clause 13(a) and Part C of Annex II are not used; the “competent supervisory authority” is the Federal Data Protection and Information Commissioner (the “FDPIC”) insofar as the transfers are governed by Swiss Data Protection Laws;

f. Clause 17 is replaced to state “These Clauses are governed by the laws of Switzerland insofar as the transfers are governed by Swiss Data Protection Laws”.

g. Clause 18 is replaced to state:

“Any dispute arising from these Clauses relating to Swiss Data Protection Laws shall be resolved by the courts of Switzerland. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of Switzerland in which he/she has his/her habitual residence. The Parties agree to submit themselves to the jurisdiction of such courts.”

Until the entry into force of the revised Swiss Data Protection Laws, the Clauses shall also protect personal data of legal entities and legal entities shall receive the same protection under the Clause as natural persons.

3.3. To the extent that any processing of personal data is subject to both Swiss Data Protection Laws and the GDPR, the Chatfuel DPA including the Clauses in its Exhibit C will apply (i) as is and (ii) additionally, to the extent that a transfer is subject to Swiss Data Protection Laws, as amended by Sections 3.1 and 3.2 above, with the sole exception that Clause 17 shall not be replaced as stipulated under Section 3.2(g).

3.4. Customer warrants that it and/or Customer Affiliates have made any notifications to the FDPIC which are required under Swiss Data Protection Laws.