Data Processing Agreement

This agreement forms part of the Aideno Terms of Service for Business Customers. Its schedules cover processing, security, subprocessors, and international transfers.

1. Parties, scope, and priority

The parties are the Business Customer identified in its Account or accepted order (Customer) and Oleksandr Dmytriv, sole trader, dr. Jana Piltza 43, 30-392 Kraków, Poland, NIP 5732940047, support@aideno.chat (Aideno). For the self-service pilot the Customer is the sole proprietor whose full name and address are provided in onboarding. The accepting person must have authority for the Customer. The name, address and contact email must be accurate in the Account or order; an Instagram handle does not identify the contracting party.

This agreement applies to personal data Aideno processes on the Customer’s behalf (Customer Personal Data). The Customer is controller and Aideno is processor. Under applicable Ukrainian law, these correspond to володілець and розпорядник персональних даних. Customers acting as processors for another controller must agree that arrangement with Aideno in writing before submitting that controller’s data.

Applicable data-protection law includes Regulation (EU) 2016/679 (GDPR), applicable Polish law, and the Ukrainian Law on Personal Data Protection where applicable. This agreement is accepted with the version of the Terms incorporating it, or separately in writing, and lasts while Aideno holds Customer Personal Data. It prevails over conflicting general Terms on data protection; mandatory law and applicable Standard Contractual Clauses prevail over both. Aideno’s independent account, support, billing, and legal-compliance processing is described in the Privacy Policy and is not expanded by this agreement.

2. Instructions and Customer responsibilities

Aideno will process Customer Personal Data only on documented instructions: this agreement, the accepted order, enabled features and settings, and subsequent written instructions from an authorized Customer contact. This includes instructions on disclosures and transfers. If EU or Member State law requires other processing, Aideno will inform the Customer beforehand unless that law prohibits notification on important public-interest grounds. Aideno will immediately inform the Customer if an instruction appears to infringe applicable data-protection law and suspend the affected instruction while the parties resolve it.

The Customer determines its purposes, lawful bases, notices, authorized users, appropriate retention, and the accuracy and minimization of data it supplies. It must have authority to connect its accounts and authorize the processing and transfers described here. Aideno remains responsible for its own legal and contractual obligations; Customer authorization does not waive them. Customer Personal Data will not be sold, used for Aideno’s advertising, or opted into general-purpose model training.

3. Confidentiality and security

Aideno will ensure that people authorized to process Customer Personal Data are bound by confidentiality obligations and receive access only as needed for their duties. Aideno will maintain technical and organizational measures appropriate to the risk under GDPR Article 32, including the measures in Schedule B, and regularly assess their effectiveness. Changes must not materially reduce the overall protection. No certification or dedicated infrastructure is promised unless expressly agreed.

4. Subprocessors

The Customer gives general written authorization for the subprocessors and conditional processing described in Schedule C. Aideno will bind each subprocessor to data-protection obligations providing the protection required by this agreement and applicable law, and remains responsible to the Customer for the subprocessor’s performance of those obligations. Information about relevant further subprocessors is available through the linked vendor lists and from Aideno.

Before adding or replacing a subprocessor, Aideno will notify the Account contact by email at least 30 days before the new subprocessor processes Customer Personal Data. The Customer may object during that period on reasonable data-protection grounds. The parties will seek a suitable alternative or remedy. If none is available, either may end the affected feature or Service before the new processing begins; Aideno will refund prepaid fees for the unused affected period. Merely posting an updated list does not replace this notice.

5. Rights requests and assistance

Aideno will promptly forward requests concerning Customer Personal Data to the Customer, without responding substantively except on instructions or as required by law. Taking account of the processing, Aideno will assist through appropriate technical and organizational measures with access, correction, deletion, restriction, portability, and objection requests, including locating and exporting relevant records. Requests can be made to support@aideno.chat; a dedicated self-service privacy portal is not required.

Taking account of the processing and information available to it, Aideno will assist the Customer with security, breach response, data-protection impact assessments, and prior consultation under GDPR Articles 32–36. Any exceptional work and reasonable charges must be agreed beforehand and must not prevent or delay legally required assistance. Aideno will provide information necessary to meet applicable response deadlines.

6. Personal data breaches

Aideno will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, using the Account contact. The notification will describe the nature of the breach, affected data and people and approximate numbers where known, likely consequences, measures taken or proposed, and a contact for follow-up. Missing information will follow without undue further delay. Aideno will take reasonable steps to contain, investigate, and remedy the breach and cooperate with the Customer. The Customer decides its regulatory and individual notifications; this does not remove Aideno’s independent legal duties.

7. Return, deletion, and retention

During the Service, Aideno will act on lawful deletion or restriction instructions. On ending the processing services, the Customer chooses return of Customer Personal Data in a commonly usable electronic format followed by deletion, or deletion without return. The Customer should communicate its choice before Account deletion. If no choice has been received, Aideno will contact the Customer and provide 30 days to request return before deleting the data. A valid earlier deletion instruction takes precedence.

Aideno will complete return or deletion without undue delay and normally within 30 days of the applicable instruction or expiry of that election period, and confirm completion and any remaining lawful retention. This obligation includes relevant subprocessor copies and persistent AI state, not just local database rows. If a legal deadline requires earlier action, that deadline governs. Aideno will explain any operational obstacle promptly; it is not an indefinite extension of the Customer’s or an individual’s rights.

Existing copies will be deleted unless EU or Member State law requires storage. Restricted backup copies remain protected, are excluded from ordinary processing, and are erased through their documented expiry cycle; Aideno will communicate the applicable cycle on request and at termination and reapply deletions after any restoration. Records retained to meet a legal requirement are limited to that purpose and period. Customer instructions do not authorize indefinite retention of all conversations for general security or improvement.

Copies in the Customer’s own Instagram or Google account remain subject to its control and the platform’s terms. Ending Aideno access does not automatically erase those copies or cancel appointments. Aideno will distinguish these records from copies it must delete as processor and provide reasonable assistance.

8. Demonstrating compliance

Aideno will make available information necessary to demonstrate compliance with this agreement and GDPR Article 28, and allow and contribute to audits, including inspections by the Customer or its mandated auditor. The parties will first use relevant documentation where sufficient and agree reasonable confidentiality, access, timing, and security arrangements protecting other customers. These arrangements do not exclude a necessary inspection, restrict a supervisory authority, or delay an urgent investigation or statutory duty.

9. Transfers and changes

International processing is subject to Schedule D. Neither accepting the Terms nor connecting an account is blanket data-subject consent to a transfer. Aideno will not begin or continue a transfer that lacks a required lawful mechanism. Material changes to this agreement follow the Terms’ notice procedure and cannot diminish mandatory protection. Existing agreements are not retroactively replaced merely by changing the version on this page.

Schedule A — Details of processing

• Subject and purpose: operating the Customer’s Instagram inbox, AI-assisted service conversations, scheduling and appointment changes, operational notifications, and associated support and security.
• Nature: receiving, storing, organizing, retrieving, generating and classifying text, privately storing and serving Instagram media files, transmitting replies, checking calendar occupancy, creating and deleting booking events, controlling access, returning and deleting data, and keeping necessary operational records.
• People: people messaging the connected business, prospective and existing customers, appointment participants, and the Customer’s staff or representatives appearing in those records.
• Data: names, Instagram identifiers and usernames, message text, reactions, attachment metadata, links and stored attachment files, Instagram account and contact profile pictures, timestamps, language and conversation status, service preferences, appointment details, internal notes, calendar metadata and occupied periods, integration credentials, AI inputs and outputs, provider identifiers, webhook payloads, delivery records, and notification subscription and routing data.
• Duration and frequency: ongoing while the relevant features are enabled, then only as needed to return or delete data under Section 7. Retention follows necessary service purposes and lawful Customer instructions, not an unrestricted right to retain data for the whole Account lifetime.
• Excluded intended uses: medical records, health assessments, deliberate special-category or criminal-offence data processing, identity-document or payment-card collection, and services directed to children. Unsolicited sensitive content must be protected and addressed promptly; it is not an authorized expansion of the processing purpose.

Schedule B — Security measures

Aideno’s application uses tenant-scoped access controls and PostgreSQL row-level security; hashed passwords; encrypted stored Instagram access tokens and Google refresh tokens; and role-restricted administrative access. Hosted access uses HTTPS. Production secrets and encryption keys must be restricted to authorized personnel. Signed Meta callbacks and configured webhook signature checks protect inbound integration requests.

Aideno will maintain access reviews, confidentiality commitments, security updates, incident handling, necessary audit and delivery records, and protected backups with documented retention and restore procedures. Support access is limited to the relevant purpose and data. Google-derived data remains subject to Google’s Limited Use restrictions. These are operational obligations, not a representation that Aideno holds ISO or SOC certification or that all stored message content is end-to-end encrypted.

Schedule C — Providers and roles

Render Services, Inc. — infrastructure subprocessor

Provides application and worker hosting, PostgreSQL, and associated logs, backups, and infrastructure support. May process all categories in Schedule A. Render is a US provider; deployment region alone does not exclude US or other international support and subprocessor access. Applicable terms and further providers: Render DPA and Render trust center. The actual production hosting region and applicable safeguards can be requested from Aideno; no exclusive EU-residency commitment is made here.

OpenAI — AI subprocessor when enabled

Processes relevant message history, business context, instructions, derived scheduling information, and AI outputs and metadata. OAuth secrets are not supplied as prompt context. Under OpenAI’s published terms for an EEA-based customer, the contracting entity is OpenAI Ireland Ltd.; its affiliates and subprocessors can process data in the US and other listed locations. Applicable terms and further providers: OpenAI DPA and subprocessor list. No zero-retention or EU-only processing arrangement is promised. Persistent conversation state, where used, requires deletion separately from local records.

Cloudflare, Inc. — private object-storage subprocessor

Provides private R2 object storage for copies of Instagram message attachments and profile pictures. Aideno stores these objects in separate EU-jurisdiction buckets for Staging and Production and serves them to authorized users through the application. Cloudflare may process related object and access metadata under its applicable terms and subprocessors. Applicable terms: Cloudflare DPA. EU bucket jurisdiction does not itself promise that all support or other provider processing stays in the EU.

Optional browser push delivery

If the Customer’s authorized users enable notifications, the browser or operating system selects a push service, such as Apple, Google, or Mozilla. It receives subscription/routing metadata and encrypted alert payloads, which can contain a client name or username and conversation link. Provider locations and terms depend on the user’s browser. Enabling notifications instructs this conditional delivery; Aideno must establish any required processor terms and transfer safeguards before using that route. Users can disable notifications and use the inbox instead. This permission does not authorize an unidentified future Aideno-selected subprocessor.

Connected platforms and Aideno’s own service providers

Meta/Instagram and Google Calendar provide the Customer’s connected accounts under the Customer’s own platform relationship; connecting them instructs the necessary exchange of data. Their independent platform processing is governed by their terms and notices. They are not classified as Aideno subprocessors merely because an integration exists. Resend, for account-verification, password-recovery and security emails and configured demo inquiries, processes Aideno’s own controller data; it is not currently authorized here to receive the Customer’s conversation content. Any expansion to that use requires the applicable subprocessor procedure.

Schedule D — International data transfers

Ukraine to Poland

The Customer instructs processing by Aideno in Poland. Where Ukrainian law applies, the Customer must establish a lawful processing basis and provide the required notices; Article 29 of Ukraine’s Law on Personal Data Protection governs the international transfer. Poland is in the EEA, a category recognized by that provision as providing adequate protection. That does not independently authorize every onward transfer. Aideno will cooperate in documenting any further required safeguards.

Transfers from the EEA to providers or Customer users elsewhere

Aideno will identify the exporter, importer, countries, data, purpose, and onward recipients and apply GDPR Chapter V where required, including for remote access. It will use a currently applicable adequacy decision covering the recipient and data, or appropriate safeguards such as the unmodified European Commission Standard Contractual Clauses under Decision (EU) 2021/914, with the correct module and completed annexes. Where required, it will assess destination-country risks and apply supplementary measures. Routine processing will not rely on exceptional-transfer consent or contractual derogations as a default solution.

Making data available from Poland to a separate Customer controller or other recipient in Ukraine can itself require a transfer mechanism, even when the Customer originally supplied the data. Schedule E incorporates processor-to-controller SCC Module Four into this agreement where its conditions are met, with electronic acceptance and completion of the parties’ details. It does not apply to every Customer. Ukrainian transfer requirements and GDPR requirements must each be considered; they are not interchangeable.

Evidence and transfer suspension

Aideno will maintain the applicable vendor terms, completed transfer instruments, assessments, and details of actual processing locations, and provide relevant copies on request with necessary confidentiality redactions. Links to vendor DPAs do not themselves execute vendor agreements. Schedule E governs acceptance of the Customer SCCs; neither acceptance nor a link replaces a required transfer assessment or proves Data Privacy Framework certification. If adequate protection cannot be maintained, the affected transfer must stop and the parties will arrange lawful alternatives or return/deletion. A generic standalone “data transfer agreement” does not replace a required transfer instrument.