EU Data Processing Agreement
This Data Processing Agreement (“DPA”) amends and forms part of the written agreement between
Concierge AI Technologies, Inc. (“Concierge AI”) and Customer (“Customer”) (each a “Party” and
collectively the “Parties”) titled Cloud Services Agreement (“the Agreement”), effective as of the
effective date identified in the Order or the date Concierge AI began Processing Customer Personal Data
(defined below), whichever is earlier. This DPA prevails over any conflicting term of the Agreement but does
not otherwise modify the Agreement.
Definitions.
1.1. In this DPA:
“Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”,
“Processor”, and “Supervisory Authority” have the meaning given to them in Data
Protection Law;“Customer Personal Data” means Personal Data Processed by Concierge AI as a
Processor on behalf of Customer or Third Party Controller;“Data Protection Law” means the General Data Protection Regulation (EU) 2016/679
(“GDPR”) and the e-Privacy Directive 2002/58/EC (as amended by Directive 2009/136/EC),
their national implementations in the European Economic Area (“EEA”), including the
European Union, and all other data protection laws of the EEA, the United Kingdom (“UK”),
and Switzerland, each as applicable, and as may be amended or replaced from time to time;“Data Subject Rights” means Data Subjects’ rights to information, access, rectification,
erasure, restriction, portability, objection, the right to withdraw consent, and the right not to be
subject to automated individual decision-making in accordance with Data Protection Law;“International Data Transfer” means any disclosure of Customer Personal Data by an
organization subject to Data Protection Law to another organization located outside the EEA,
the UK, or Switzerland;“Services” means the services provided by Concierge AI to Customer under the Agreement;
“Subprocessor” means a Processor engaged by Concierge AI to Process Customer
Personal Data;“SCCs” means the clauses annexed to the EU Commission Implementing Decision 2021/914
of June 4, 2021 on standard contractual clauses for the transfer of personal data to third
countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the
Council as amended or replaced from time to time;“Third-Party Controller” means a Controller for which Customer is a Processor; and
“UK Addendum” means the addendum to the SCCs issued by the UK Information
Commissioner under Section 119A(1) of the UK Data Protection Act 2018 (version B1.0, in
force March 21, 2022).
1.2. Capitalized terms used but not defined herein have the meaning given to them in the Agreement.
Scope
2.1. This DPA applies to the Processing of Customer Personal Data by Concierge AI subject to Data Protection Law to provide the Services.
2.2. The subject matter, nature and purpose of the Processing, the types of Customer Personal Data and categories of Data Subjects are set out in Annex I, which is an integral part of this DPA.
2.3. Customer is a Controller and appoints Concierge AI as a Processor on behalf of Customer. Customer is responsible for compliance with the requirements of Data Protection Law applicable to Controllers.
2.4. If Customer is a Processor on behalf of a Third-Party Controller, then Customer: is the single point of contact for Concierge AI; must obtain all necessary authorizations from such Third-Party Controller; and undertakes to issue all instructions and exercise all rights on behalf of such other Third-Party Controller.
2.5. Customer acknowledges that Concierge AI may Process Personal Data relating to the operation, support, or use of the Services for its own business purposes, such as billing, account management, data analysis, benchmarking, technical support, product development, and compliance with law. Concierge AI is the Controller for such Processing and will Process such data in accordance with Data Protection Law.
2.6. Concierge AI shall comply with the obligations of, and provide the level of privacy protection required by, Data Protection Law.
Instructions
3.1. Concierge AI will Process Customer Personal Data to provide the Services and in accordance with Customer’s documented instructions.
3.2. The Controller’s instructions are documented in this DPA, the Agreement, and any applicable statement of work.
3.3. Customer may reasonably issue additional instructions as necessary to comply with Data Protection Law. Concierge AI may charge a reasonable fee to comply with any additional instructions.
3.4. Unless prohibited by applicable law, Concierge AI will inform Customer if Concierge AI is subject to a legal obligation that requires Concierge AI to Process Customer Personal Data in contravention of Customer’s documented instructions.
Personnel
4.1. Concierge AI will ensure that all personnel authorized to Process Customer Personal Data are subject to an obligation of confidentiality.
Security and Personal Data Breaches
5.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Concierge AI will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the measures listed in Annex II.
5.2. Customer acknowledges that the security measures in Annex II are appropriate in relation to the risks associated with Customer’s intended Processing and will notify Concierge AI prior to any intended Processing for which Concierge AI’s security measures may not be appropriate.
5.3. Concierge AI will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data. If Concierge AI’s notification is delayed, it will be accompanied by reasons for the delay.
Subprocessing
6.1. Customer hereby authorizes Concierge AI to engage Subprocessors. A list of Concierge AI’s current Subprocessors is included in Annex III.
6.2. Concierge AI will enter into a written agreement with Subprocessors which imposes the same obligations as required by Data Protection Law.
6.3. Concierge AI will notify Customer prior to any intended change to Subprocessors by way of keeping its relevant list up to date at: https://concierge.ai/data-processing. Customer may object to the addition of a Subprocessor based on reasonable grounds relating to a potential or actual violation of Data Protection Law by providing written notice detailing the grounds of such objection within thirty (30) days following Concierge AI’s notification of the intended change. Customer and Concierge AI will work together in good faith to address Customer’s objection. If Concierge AI chooses to retain the Subprocessor, Concierge AI will inform Customer at least thirty (30) days before authorizing the Subprocessor to Process Customer Personal Data, and either party may immediately discontinue providing or using the relevant parts of the Services, as applicable, and may terminate the relevant parts of the Services within thirty (30) days.
Assistance
7.1. Taking into account the nature of the Processing, and the information available to Concierge AI, Concierge AI will assist Customer, including, as appropriate, by implementing technical and organizational measures, with the fulfillment of Customer’s own obligations under Data Protection Law to: comply with requests to exercise Data Subject Rights; conduct data protection impact assessments, and prior consultations with Supervisory Authorities; and notify a Personal Data Breach.
7.2. Concierge AI may charge a reasonable fee for assistance under this Section 7. If Concierge AI is at fault, Concierge AI and Customer shall each bear their own costs related to assistance.
Audit
8.1. Upon reasonable request, Concierge AI must make available to Customer all information necessary to demonstrate compliance with the obligations of this DPA and allow for and contribute to audits, including inspections, as mandated by a Supervisory Authority or reasonably requested no more than once per year by Customer, and performed by an independent auditor as agreed upon by Customer and Concierge AI. The foregoing shall only extend to those documents and facilities relevant and material to the Processing of Customer Personal Data and shall be conducted during normal business hours and in a manner that causes minimal disruption.
8.2. Concierge AI will inform Customer if Concierge AI believes that Customer’s instruction under Section 8.1 infringes Data Protection Law. Concierge AI may suspend the audit or inspection or withhold requested information until Customer has modified or confirmed the lawfulness of the instructions in writing.
8.3. Concierge AI and Customer each bear their own costs related to an audit.
International Data Transfers
9.1. Customer hereby authorizes Concierge AI to perform International Data Transfers to any country deemed to have an adequate level of data protection by the European Commission or the competent authorities, as appropriate; on the basis of adequate safeguards in accordance with Data Protection Law; or pursuant to the SCCs and the UK Addendum referred to in Sections 9.2 and 9.3.
9.2. By signing this DPA, Concierge AI and Customer conclude Module 2 (controller-to-processor) of the SCCs and, to the extent Customer is a Processor on behalf of a Third-Party Controller, Module 3 (Processor-to-Subprocessor) of the SCCs, which are hereby incorporated and completed as follows: the “data exporter” is Customer; the “data importer” is Concierge AI; the optional docking clause in Clause 7 is implemented; Option 2 of Clause 9(a) is implemented and the time period therein is specified in Section 6.3 above; the optional redress clause in Clause 11(a) is struck; Option 1 in Clause 17 is implemented and the governing law is the law of Ireland; the courts in Clause 18(b) are the Courts of Ireland; Annex I and II to Module 2 and 3 of the SCCs are Annex I and II to this DPA respectively. For International Data Transfers from Switzerland, Data Subjects who have their habitual residence in Switzerland may bring claims under the SCCs before the courts of Switzerland.
9.3. By signing this DPA, Concierge AI and Customer conclude the UK Addendum, which is hereby incorporated and applies to International Data Transfers outside the UK. Part 1 of the UK Addendum is completed as follows: (i) in Table 1, the “Exporter” is Customer and the “Importer” is Concierge AI, their details are set forth in this DPA, and the Agreement; (ii) in Table 2, the first option is selected and the “Approved EU SCCs” are the SCCs referred to in Section 9.2 of this DPA; (iii) in Table 3, Annexes 1 (A and B) and II to the “Approved EU SCCs” are Annex I and II respectively; and (iv) in Table 4, both the “Importer” and the “Exporter” can terminate the UK Addendum.
9.4. If Concierge AI’s compliance with Data Protection Law applicable to International Data Transfers is affected by circumstances outside of Concierge AI’s control, including if a legal instrument for International Data Transfers is invalidated, amended, or replaced, then Customer and Concierge AI will work together in good faith to reasonably resolve such non-compliance. In the event that additional, replacement or alternative standard contractual clauses or UK standard contractual clauses are approved by Supervisory Authorities, Concierge AI reserves the right to amend the Agreement and this DPA by adding to or replacing, the standard contractual clauses or UK standard contractual clauses that form part of it at the date of signature in order to ensure continued compliance with Data Protection Law.
. Notifications
10.1. Customer will send all notifications, requests and instructions under this DPA to Concierge AI via email to support@concierge.ai.
10.2. Concierge AI will send all notifications under this DPA to Customer’s contact at support@concierge.ai.
. Liability
11.1. Where Concierge AI has paid compensation, damages or fines, Concierge AI is entitled to claim back from Customer that part of the compensation, damages or fines, corresponding to Customer’s part of responsibility for the compensation, damages or fines.
. Termination and return or deletion
12.1. This DPA is terminated upon the termination of the Agreement.
12.2. Customer may request return of Customer Personal Data up to ninety (90) days after termination of the Agreement. Unless required or permitted by applicable law, Concierge AI will delete all remaining copies of Customer Personal Data within one hundred eighty (180) days after returning Customer Personal Data to Customer.
. Applicable law and jurisdiction
13.1. This DPA is governed by the laws of Ireland. Any disputes relating to this DPA will be subject to the exclusive jurisdiction of the courts of Ireland.
. Modification of this DPA
14.1. This DPA may only be modified by a written amendment signed by both Concierge AI and Customer.
. Invalidity and severability
15.1. If any provision of this DPA is found by any court or administrative body of a competent jurisdiction to be invalid or unenforceable, then the invalidity or unenforceability of such provision does not affect any other provision of this DPA and all provisions not affected by such invalidity or unenforceability will remain in full force and effect.
Concierge AI Technologies, Inc.
Customer: As defined in the Agreement or the Order
Name: Rohan Agrawal
Name: As identified in the Agreement or the Order
Job title, contact details including email address:
Job title, contact details including email address: As identified in the Agreement or the Order
Address:
101 Jefferson Dr #1 Menlo Park, CA 94025 USA
Address: As identified in the Agreement or the Order
Signature: Entering into the Agreement is considered acceptance of this DPA, which forms part of the Agreement
Signature: Entering into the Agreement is considered acceptance of this DPA, which forms part of the Agreement.
Date: The effective date of the Agreement, as defined above.
Date: The effective date of the Agreement, as defined above.
Annex I – Description of the Transfer
List of Parties
Data exporter:
Name: Customer (as defined above)
Address: See signature page above.
Contact person’s name, position and contact details: See signature page above.
Activities relevant to the data transferred under these Clauses: Customer receives Concierge AI’s services as described in the Agreement and Customer provides Personal Data to Concierge AI in that context.
Signature and date: See signature page above.
Role (controller/processor): Controller, or Processor on behalf of Third-Party Controller
Data importer:
Name: Concierge AI (as defined above)
Address: See signature page above.
Contact person’s name, position and contact details: See signature page above.
Activities relevant to the data transferred under these Clauses: Concierge AI provides its services to Customer as described in the Agreement and Processes Personal Data on behalf of Customer in that context.
Signature and date: See signature page above
Role (controller/processor): Processor on behalf of Customer, or Subprocessor on behalf of Third-Party Controller
B. Description of International Data Transfer
Categories of Data Subjects whose Personal Data is transferred:
#
Category of Data Subjects
1.
Users of Customer’s website
2.
Customer’s personnel, staff and contractors
Categories of Personal Data transferred:
#
Category of Personal Data
1.
Name
2.
Email address
3.
Company name, contact information, and any other information that the Company requests from the user
4.
Contents of communications between the chatbot provided by Concierge AI and users of Customer’s website.
5.
Device information (such as IP address and device identifiers)
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures:
#
Category of Sensitive Data
Applied restrictions or safeguards
1.
None
None
The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis): On a continuous basis.
Nature of the processing: The Personal Data will be processed and transferred as described in the Agreement. To perform services on behalf of the Customer pursuant to the Agreement and any related order form, including all Processing reasonably necessary to provide an AI chatbot embedded in Customer’s website for use by Customer’s end customers, buying prospects, and other external stakeholders.
Purpose(s) of the data transfer and further processing: The Personal Data will be transferred and further processed for the provision of the Services as described in the Agreement to deliver the services set out in this Agreement.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Personal Data will be retained for as long as necessary taking into account the purpose of the Processing, and in compliance with applicable laws, including laws on the statute of limitations and Data Protection Law. Unless required or permitted by applicable law, Concierge AI will delete all remaining copies of Customer Personal Data within one hundred eighty (180) days after returning Customer Personal Data to Customer upon termination of this Agreement.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: For the subject matter and nature of the Processing, reference is made to the Agreement and this DPA. The Processing will take place for the duration of the Agreement.
C. Competent Supervisory Authority
The competent authority for the Processing of Personal Data relating to Data Subjects located in the EEA is the Supervisory Authority a) of Customer’s country of establishment, or, where not applicable, b) of the country where Customer’s EU data protection representative is located, or, where not applicable, c) of one of the EEA countries where the Data Subjects are located.
The competent authority for the Processing of Personal Data relating to Data Subjects located in the UK is the UK Information Commissioner.
The competent authority for the Processing of Personal Data relating to Data Subjects located in Switzerland is the Swiss Federal Data Protection and Information Commissioner.
Annex II – Technical and Organizational Measures Including Technical and Organizational Measures to Ensure the Security of the Data
Concierge AI will, at a minimum, implement the following types of security measures:
Physical access control
Technical and organizational measures to prevent unauthorized persons from gaining access to the data processing systems available in premises and facilities (including databases, application servers and related hardware), where Customer Personal Data are Processed, include:
Establishing access authorizations for employees and third parties;
Access control system (ID reader, magnetic card, chip card);
Key management, card-keys procedures;
Door locking (electric door openers etc.);
Security staff; and
Securing decentralized data processing equipment and personal computers.
Virtual access control
Technical and organizational measures to prevent data processing systems from being used by unauthorized persons include:
User identification and authentication procedures;
ID/password security procedures (special characters, minimum length and complexity requirements, change of password);
Automatic blocking (e.g. password or timeout);
2 factor authentication (for secure login); and
Encryption at rest.
Data access control
Technical and organizational measures to ensure that persons entitled to use a data processing system gain access only to such Customer Personal Data in accordance with their access rights, and that Customer Personal Data cannot be read, copied, modified or deleted without authorization, include:
Internal policies and procedures;
Control authorization schemes;
Default configuration;
Differentiated access rights (profiles, roles, transactions and objects);
Monitoring and logging of accesses;
Disciplinary action against employees who access Customer Personal Data without authorization;
Reports of access;
Access procedure;
Change procedure;and
Deletion procedure.
Disclosure control
Technical and organizational measures to ensure that Customer Personal Data cannot be read, copied, modified or deleted without authorization during electronic transmission, transport or storage on storage media (manual or electronic), and that it can be verified to which companies or other legal entities Customer Personal Data are disclosed, include:
Encryption;
Logging; and
Transport security.
Control of instructions
Technical and organizational measures to ensure that Customer Personal Data are Processed solely in accordance with the instructions of the Controller include:
Unambiguous wording of the contract;
Formal commissioning (request form); and
Criteria for selecting the Processor.
Availability control
Technical and organizational measures to ensure that Customer Personal Data are protected against accidental destruction or loss (physical/logical) include:
Backup procedures;
Remote storage; and
Anti-virus.
Separation control
Technical and organizational measures to ensure that Customer Personal Data collected for different purposes can be Processed separately include:
“Internal client” concept / limitation of use;
Segregation of functions (production/testing); and
Procedures for storage, amendment, deletion, transmission of data for different purposes.
Testing controls
Technical and organizational measures to test, assess and evaluate the effectiveness of the technical and organizational measures implemented in order to ensure the security of the processing include:
Testing and evaluation of software updates before they are installed.
IT governance
Technical and organizational measures to improve the overall management of IT and ensure that the activities associated with information and technology are aligned with the compliance efforts include:
Processes for data minimization;
Processes for data quality;
Processes for ensuring accountability; and
Data subject rights policies.
Concierge AI will contractually require its Subprocessors to implement the same or at least equivalent technical and organizational measures to be able to provide assistance to Customer.
Annex III – List of Subprocessors
Customer authorizes Concierge AI to engage the following Subprocessors:
#
Name
Address
Contact person’s name, position and contact details
Description of the processing (including a clear delimitation of responsibilities in case several sub-processors are authorized
Anthropic PBC
San Francisco, California, United States
AI model via API for core product
2.
Google LLC
Mountain View, California, United States
Cloud services (GCP), database (GCP), AI model via API for core product (Gemini), customer communication (Gmail)
3.
OpenAI, Inc.
San Francisco, California, United States
AI model via API for core product
4.
Perplexity AI, Inc.
San Francisco, California, United States
AI model via API for core product
5.
X.AI Corp.
San Francisco Bay Area, California, United States
AI model via API for core product
7.
Retool, Inc.
San Francisco, California, United States
Product analytics and visibility
9.
Databricks Inc.
San Francisco, California, United States
Database hosting (Neon)
10.
Clerk, Inc.
San Francisco, California, United States
Authentication and user management
11.
Salesforce, Inc.
San Francisco, California, United States
Customer communication (Slack)
12.
Vercel Inc.
Covina, California, United States
Frontend Cloud platform for web app
13.
Stripe, Inc.
San Francisco, California, United States
Payment processing