Data processing agreement

1. Parties and scope

This agreement is between the customer who holds a AdminSmith account ("you", the controller) and Zhivko Komarov ("we", the processor). It forms part of our terms of service and applies whenever we process personal data on your behalf under the EU General Data Protection Regulation (GDPR), the UK GDPR or similar laws.

2. Details of the processing

Subject and duration

Providing the AdminSmith tools you use, for as long as your account exists, plus the deletion period below.

Nature and purpose

Storing, organising, analysing and sending data as the tools do when you set them up: checking websites, sending payment reminders and e-invoices from your email account, finding subscriptions in statements, and answering your customers through the AI receptionist.

Types of personal data

Names, email addresses, phone numbers and postal addresses of your customers and contacts; invoice details; payee names and descriptions in payments out; messages and contact details given in conversations, and the address of the web page where a chat started; any personal data in content you upload.

Data subjects

Your customers, prospects, suppliers and website visitors, and your staff using the account.

Special categories

Not intended. Do not ask customers for health or other special category data through the AI receptionist, and configure it accordingly.

3. Our obligations

• We process personal data only on your documented instructions, which are these terms and how you set up the tools, unless the law requires otherwise; we will tell you if we think an instruction breaks the law.
• Everyone who can access the data is bound to confidentiality.
• We keep appropriate technical and organisational security measures (Article 32 GDPR), including HTTPS, encryption of stored secrets, hashed passwords, access control, separation between customer accounts, backups and logging of security events.
• We help you, as far as reasonably possible, to answer requests from data subjects and to meet your duties on security, breach notification, impact assessments and consultation with authorities.
• We notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need.
• We make available the information needed to show compliance with this agreement and allow reasonable audits, normally by written questionnaire, with 30 days’ notice and at your cost, no more than once a year unless there is a breach.

4. Sub-processors

You authorise us to use these sub-processors: DATACENTRE_OPERATOR=GoDaddy.com, LLC, which runs the data centre in Cologne, Germany, where our servers are (hosting); and EMAIL_PROVIDER=GoDaddy.com, LLC, through its mail relay (email delivery). We impose data protection obligations on them equivalent to this agreement and remain responsible for them. We will tell you at least 30 days before adding or replacing a sub-processor; if you object on reasonable grounds and we cannot resolve it, you may end the affected plan with a refund of prepaid fees for the remaining period.

Providers you connect yourself (your email server, AI provider, Twilio, Meta for WhatsApp) are not our sub-processors. You choose them, you have your own agreement with them, and we send data to them on your instruction.

5. International transfers

Where our processing involves a transfer of personal data from the EU or EEA to a country without an adequacy decision, the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this agreement, with you as data exporter and us as data importer; for transfers from the UK, the UK International Data Transfer Addendum applies. Clause 7 (docking) does not apply, the option in Clause 9(a) is general authorisation with the notice period above, Clause 11 has no independent dispute body, and Clauses 17 and 18 refer to the law and courts of Ireland.

6. Deletion at the end

When you delete data or your account, we delete it from the live system straight away and from backups within 30 days, unless the law requires us to keep it. Before deleting your account you can export what the tools offer to export.

7. Precedence

If this agreement conflicts with the terms of service on data protection, this agreement wins; if the standard contractual clauses apply and conflict with either, the clauses win.