Data Processing Agreement

This Data Processing Agreement (“DPA”) applies where Ninjabot processes personal data on behalf of a customer in connection with the Ninjabot service, and forms part of the service agreement. A countersigned copy is available on request: privacy@ninjabot.eu.

1. Roles & scope

The customer is the data controller of the personal data in its lists, conversations, and CRM records; Ninjabot is the data processor. Processing covers contact and conversation data needed to respond to, qualify, and book the customer’s leads.

2. Processor obligations

• Process personal data only on documented instructions from the customer.
• Ensure persons authorized to process the data are bound by confidentiality.
• Implement appropriate technical and organizational measures (encryption in transit and at rest, role-based access, logging).
• Assist the customer with data subject requests and with obligations under Articles 32–36 GDPR.
• Delete or return personal data at the end of the engagement, at the customer’s choice.
• Make available information necessary to demonstrate compliance and allow audits.

3. Sub-processors

Ninjabot uses vetted sub-processors (hosting, telephony, email delivery, AI model providers) under written agreements imposing equivalent obligations. The current sub-processor list is available on request; customers are notified of changes with an opportunity to object.

4. International transfers

Data is stored in the EU. Where a sub-processor processes data outside the EU/EEA, transfers rely on adequacy decisions or Standard Contractual Clauses.

5. Security incidents

Ninjabot notifies the customer without undue delay after becoming aware of a personal data breach affecting customer data, with information reasonably needed for the customer’s own notification obligations.

For the signable version of this DPA, required by many clinics, brokers, and legal buyers, contact privacy@ninjabot.eu.