1. Parties and roles
- [BUSINESS NAME], NIF/KvK [NIF/KvK], [ADDRESS], represented by [REPRESENTATIVE] (the "Business"), controller of its customers' data;
- [LEGAL NAME], tax ID [TAX ID], [ADDRESS], [CONTACT E-MAIL] ("Ziqanova"), processor, which processes that data on the Business's behalf.
For the account data it needs to manage its relationship with the Business (login e-mail, security, support, future billing), Ziqanova acts as a controller. [Note for the lawyer: confirm this split of roles and the need for a Ziqanova privacy notice addressed to businesses.]
2. Subject matter and duration
Ziqanova processes personal data on the Business's behalf to provide the service described in the Pilot Agreement. This agreement applies for as long as the Pilot Agreement applies and until the data is deleted or returned (clause 11).
3. Nature and purpose of the processing
Receiving, recording, organising, storing, showing to the Business's team, transmitting (to the Business and to the sub-processors in Annex 2) and deleting the data needed for the Business to receive and handle requests from its customers: collection in the chat, on the public page and on WhatsApp; automatic extraction of facts by the AI assistant; recording of the request in the dashboard; alerts to the Business; notes, visits and reminders for the team; quotes; export; automatic deletion and deletion on request. Details are in Annex 1.
4. Categories of data and data subjects
Data subjects: customers and prospective customers of the Business who contact it through the assistant, the public page or WhatsApp; members of the Business's team with a dashboard account. Data: as listed in Annex 1. Ziqanova does not ask for special categories of data (for example health data) and the assistant asks the customer not to share them; if a customer writes them anyway, they form part of the request description and the Business can delete them.
5. Instructions of the Business
Ziqanova processes the data only on the Business's documented instructions: this agreement, the Pilot Agreement, the settings the Business chooses in the dashboard (for example switching WhatsApp on or deleting a request) and later reasonable written instructions. If EU or Member State law requires it to process the data otherwise, Ziqanova informs the Business beforehand, unless the law forbids it, and tells the Business if it believes an instruction infringes the GDPR.
Ziqanova does not use the data of the Business's customers for its own purposes, does not sell it, does not use it for advertising or to train AI models, and does not contact those customers on its own initiative.
6. Confidentiality
Only Ziqanova's operator has access to production data, is bound by confidentiality and accesses it only when necessary (support, fixing faults, requests from the Business). If Ziqanova ever has other people with access, it binds them to confidentiality in writing.
7. Security measures
Ziqanova applies the technical and organisational measures in Annex 3, appropriate to the risk: encryption in transit and at rest, database access only through the server, isolation between businesses, usage limits, logs without personal data and encrypted backups. It may improve them but does not reduce them without telling the Business.
8. Sub-processors
The Business gives general authorisation for the sub-processors in Annex 2. Ziqanova enters into a contract with each of them containing data-protection obligations equivalent to those in this agreement and remains liable to the Business for their performance.
Ziqanova notifies the Business by e-mail 30 days before adding or replacing a sub-processor. The Business may object in writing, on reasonable grounds, within that period; if no solution is found, it may end the Pilot Agreement at no cost and request the export and deletion of its data.
9. Assistance to the Business
Ziqanova helps the Business respond to data-subject requests (access, rectification, erasure, restriction, portability, objection). The dashboard lets the Business view, correct and delete a customer's data at any time. If a data subject contacts Ziqanova directly, Ziqanova forwards the request to the Business within 5 working days and does not answer on its behalf unless instructed. Ziqanova also gives the Business, on request, the information it needs to meet its obligations on security, breach notification, impact assessment and prior consultation (GDPR Articles 32 to 36).
10. Personal data breaches
Ziqanova informs the Business by e-mail without undue delay and at the latest 48 hours after becoming aware of a personal data breach affecting the Business's data, with what it knows at the time: nature, categories and approximate number of data subjects and records, likely consequences, measures taken and a contact. It completes the information as it obtains it and cooperates on notification to the authority (CNPD or Autoriteit Persoonsgegevens) and to data subjects, which is the Business's decision.
11. Return and deletion
During the agreement, the Business can delete customer data in the dashboard and request a complete export of its data (requests, notes, visits, quotes, photos, settings) in a machine-readable format, delivered through a secure channel within 15 days.
At the end of the Pilot Agreement, Ziqanova delivers that export if the Business requests it within 30 days after the end, and deletes all of the Business's data, including photos and copies at sub-processors where possible, within 30 days after the end or after delivery of the export, if later. Encrypted backups are deleted by the normal rotation cycle, at most 30 days later, and are never used to restore deleted data. Ziqanova confirms deletion by e-mail and keeps only what the law requires it to keep.
12. Audits
Ziqanova provides the Business, on written request and within 15 working days, with the information needed to demonstrate compliance with this agreement: description of the measures, list of sub-processors, provider documentation and answers to reasonable questions.
The Business, or an independent auditor it appoints who is bound by confidentiality, may carry out an on-site audit at most once a year, with 30 days' notice, during office hours, at its own cost and without access to other businesses' data. An audit is also accepted whenever a supervisory authority requires it.
13. International transfers
The data is stored and processed in the European Union (Ireland). Some sub-processors process data in the United States of America, in particular OpenAI and Anthropic (assistant replies and fact extraction), under the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses. [Note for the lawyer: for each sub-processor in Annex 2, confirm the contracting entity, Data Privacy Framework certification and the inclusion of standard contractual clauses in its data processing terms.] Ziqanova does not transfer data outside the EU/EEA by any other route without appropriate safeguards and without informing the Business.
14. Liability
The liability clause of the Pilot Agreement applies (limit of EUR 500 during the free pilot). That limitation does not affect either Party's liability towards data subjects or authorities (GDPR Articles 82 and 83), nor liability for wilful misconduct. The Business is responsible for the lawfulness of collection and for informing its customers; Ziqanova, for complying with this agreement.
15. Governing law
Portuguese law and the courts of Lisbon apply, as in the Pilot Agreement. [Note for the lawyer: see the same note about Dutch businesses.] On personal-data matters, this agreement prevails over the Pilot Agreement.
Annex 1 — Processing details
- Purpose: to receive and organise requests from the Business's customers and help the Business respond to them (operations in clause 3).
- Data subjects: customers and prospective customers of the Business; members of the Business's team.
- Customer data: name, phone, e-mail, address or postcode, problem description, photos (up to 3 per conversation, without location data), chat messages, preferred times, urgency, language, quotes (name, phone, postcode, description, amounts). An irreversible code derived from the IP address, to prevent abuse, kept for 2 days; the address itself is not stored. With the anti-robot check switched on, the first message of each chat conversation goes through a Cloudflare check, which receives the IP address and technical details of the browser (Annex 2), but not the messages.
- Team member data: name, e-mail, phone, password (hashed), the Business's logo and fiscal details, dashboard settings.
- Data sent to OpenAI: the customer's messages, the assistant's previous replies and the Business's reception settings; OpenAI does not use them for training and does not keep them as a history (storage disabled), but may keep them for up to 30 days in its abuse-monitoring logs, or longer where the law requires it. [Note for the lawyer: confirm against OpenAI's current terms; zero data retention requires OpenAI's approval and has not been requested.] Ziqanova does not keep the full transcript: only the extracted facts, the last reply and the temporary context.
- Data sent to Anthropic when Ziqanova chooses Claude for the Business's chat, instead of OpenAI, or as a reserve, to answer a message OpenAI could not answer: the same data; Anthropic does not use them for training and deletes them within 30 days, unless they are flagged as breaking its usage policy (then kept for up to 2 years) or the law requires keeping them longer. [Note for the lawyer: confirm against Anthropic's current terms (Commercial Terms and Data Processing Addendum); zero data retention requires Anthropic's approval and has not been requested.]
- Retention periods: conversation context, 24 hours; abuse-prevention code, 2 days; photos without an associated request, 2 days; requests without activity, 24 months, with automatic deletion; photos of a request, until the request is deleted; WhatsApp conversations, 24 hours after the last message; WhatsApp alert records, 7 to 90 days; messages sent to Ziqanova through the contact page, 12 months. The Business can delete a customer's data at any time in the dashboard.
- Location: database and files in the European Union (Ireland); application in the European Union (Dublin); transfers as in Annex 2.
Annex 2 — Sub-processors
- Supabase — database, authentication and files — data in the EU (Ireland, eu-west-1); headquartered in the USA — always.
- Vercel — hosting and running the application — functions in the EU (Dublin), global delivery network for static content; headquartered in the USA — always.
- OpenAI — AI assistant replies and fact extraction, via API, without training and with storage disabled; abuse-monitoring logs for up to 30 days — USA; EU-US Data Privacy Framework and/or standard contractual clauses [to be confirmed by the lawyer] — whenever the chat is used; when Ziqanova has chosen Claude for it, only to answer a message Claude could not answer.
- Anthropic (Claude) — AI assistant replies and fact extraction, via API, without training, instead of OpenAI for the businesses whose chat Ziqanova switches to Claude, or as a reserve, to answer a message OpenAI could not answer; data deleted within 30 days (up to 2 years if flagged as breaking Anthropic's usage policy) — USA; standard contractual clauses (Anthropic's Data Processing Addendum, modules 2 and 3) [to be confirmed by the lawyer] — only when Ziqanova chooses Claude for the Business's chat, as its main or reserve provider.
- Resend — e-mails to the Business with request data, reminders, invitations and summaries — sending from the EU; headquartered in the USA; standard contractual clauses [to be confirmed by the lawyer] — always.
- Meta (WhatsApp Business Platform) — alerts to the Business with the customer's name, phone and request description, and customer conversations on WhatsApp — Ireland, with processing in the USA under Meta's terms [to be confirmed by the lawyer] — only when the Business switches WhatsApp on in the dashboard.
- Cloudflare (Turnstile) — anti-robot check on the first message of each chat conversation; receives the customer's IP address and technical details of the browser, not the messages — headquartered in the USA; EU-US Data Privacy Framework and/or standard contractual clauses [to be confirmed by the lawyer] — only while the check is switched on.
- Paddle (Paddle.com Market Limited) — resells the paid plans as merchant of record: charges, works out the VAT and issues the invoices in its own name; data of the Business (payer), not of its customers; the card stays with Paddle and Ziqanova never sees it — United Kingdom (EU adequacy decision) [to be confirmed by the lawyer] — only when billing is switched on, after the free pilot.
- Google (Google Workspace) — Ziqanova's mailbox for support and privacy requests; only what the Business or data subjects send by e-mail — EU and USA [to be confirmed by the lawyer] — when support e-mails are exchanged.
Monitoring and source-code hosting services receive no personal data and are therefore not on this list.
Annex 3 — Security measures
- Encryption in transit (HTTPS, TLS 1.3, HSTS) and at rest (database, files and backups encrypted by the providers).
- Access to production data limited to Ziqanova's operator, with personal credentials.
- Database closed to the outside: all tables with row-level security and no permissions for public roles; only the server has access, with the service key; the browser never talks to the database directly.
- Isolation between businesses: the business is always derived from the verified session on the server; identifiers coming from the browser are rejected.
- Dashboard accounts: sign-up by invitation only, e-mail confirmation, passwords of 12 to 128 characters with rejection of leaked passwords, optional second factor (TOTP).
- Usage limits that fail closed, per visitor, per business and platform-wide; bounded request bodies; honeypot fields in forms; an anti-robot check (Cloudflare Turnstile) on the first chat message, when switched on.
- Photos resized in the browser with location data removed, format verified on the server, private storage, visible only to the Business's members.
- Technical logs with error codes only, without messages, contact details or other personal data; secrets server-side only and absent from previews.
- OpenAI calls with storage disabled, and Anthropic calls through its messages API, which keeps no conversation history; model output validated on the server before being stored.
- Daily encrypted backups, with periodic restore testing; automatic deletion by retention period (Annex 1).
- Incidents: operational alerts, analysis, remediation and notice to the Business under clause 10.