Data Processing Agreement (DPA)

This Data Processing Agreement ('DPA') details the data-protection obligations of the parties arising from the customer's use of the software-as-a-service platform provided by Neltacore, LLC under the brand name 'Deskwoot' (the 'Main Agreement'). It applies to all activities in which employees of the Processor or third parties commissioned by it come into contact with personal data of the Controller. This DPA fulfills the requirements of Article 28 GDPR.

§ 1 Subject Matter and Duration

(1) The subject matter of the processing arises from the Main Agreement, which is referenced here (provision of the Deskwoot platform for customer-support operations).

(2) The duration of this DPA corresponds to the term of the Main Agreement. Upon termination of the Main Agreement, this DPA automatically ends, except where mandatory statutory retention periods apply.

§ 2 Specifics of the Processing

(1) Nature and purpose: processing of personal data to provide customer-support functions including multi-channel inbox, AI-assisted response automation, knowledge base, live-chat widget, reporting, and integration with the Controller's e-commerce systems and other business software the Controller connects (such as booking, practice management, CRM, job management and accounting systems).

(2) Types of personal data: master and contact data (name, email, phone), communication content (messages, tickets), order data (where the Controller uses the e-commerce integration), usage and access data (IP address, user agent, timestamps), and other data voluntarily submitted by data subjects; appointment data, CRM and lead data, and billing data (invoice and quote numbers, dates, amounts and payment status), in each case where the Controller connects such software; where the Controller is a health practice, the fact that a person is its patient.

(3) Aggregate bot-context data: where the Controller uses the AI bot or the AI Copilot feature, the Processor surfaces aggregate commerce statistics for the data subject associated with the conversation inside the AI model's system prompt so bot replies are context-aware without needing additional tool calls. The aggregates surfaced are: number of orders, date of the most recent order, cumulative order value with currency, and a freshness indicator describing whether the underlying integration syncs in real time. Detail-level personal data about specific orders (shipping address, payment method, line items) is only surfaced after the conversation has been verified to Tier 2 via the magic-link workflow.

(4) Categories of data subjects: end-customers of the Controller, employees and agents of the Controller (where they use the platform), visitors of websites operated by the Controller (where the live-chat widget is embedded) and, where the Controller connects such software, its patients, prospective buyers and tenants, and clients.

(5) Connected software: on the Controller's instruction, the Processor exchanges personal data with software the Controller connects under its own contract with that software's provider. These providers are not sub-processors of the Processor and may process data outside the EU/EEA (for example in the USA, Canada, the United Kingdom or Australia).

§ 3 Technical and Organizational Measures

(1) The Processor shall implement and maintain throughout the term of the Agreement the technical and organizational measures (TOMs) described in Annex A to protect personal data.

(2) The Processor reviews the measures regularly and adjusts them to the current state of the art. Material changes will be communicated to the Controller.

(3) The measures are designed and implemented to ensure a level of security appropriate to the risk (Art. 32 GDPR).

§ 4 Rectification, Restriction, and Erasure of Data

(1) The Processor will only rectify, erase, or restrict the processing of personal data on instruction of the Controller. This applies in particular to requests by data subjects under Art. 15-22 GDPR.

(2) Where a data subject contacts the Processor directly with such a request, the Processor will forward the request to the Controller without undue delay.

(3) The Processor provides functions in its platform that allow the Controller to handle data-subject requests itself (e.g., data export, account deletion).

§ 5 Obligations of the Processor

(1) The Processor processes personal data exclusively within the scope of the Controller's instructions and the Main Agreement.

(2) The Processor obliges its authorized employees to confidentiality (Art. 28(3)(b) GDPR) or ensures that they are subject to an appropriate statutory duty of confidentiality.

(3) The Processor designates a contact person for data-protection matters upon request. Inquiries can be sent to: hello@deskwoot.com.

(4) The Processor assists the Controller, taking into account the nature of the processing and the information available to it, in complying with the obligations under Art. 32-36 GDPR.

(5) Records of processing activities under Art. 30(2) GDPR are documented by the Processor and made available to the Controller or supervisory authority on request.

§ 5a Protection of Professional Secrets

(1) This section applies where the Controller is under a statutory duty to keep the secrets of third parties, in particular as a member of a health profession under § 203(1) no. 1 of the German Criminal Code (StGB) (for example a physician, dentist, psychotherapist or physiotherapist). The Processor then takes part in the Controller's professional activity as an 'other contributing person' within the meaning of § 203(3) sentence 2 StGB.

(2) The Processor undertakes to keep secret all secrets of third parties that become known to it in the course of, or on the occasion of, its work for the Controller. These include in particular the content of all messages and files, and the mere fact that a person is in contact with the Controller or is the Controller's patient. This duty survives the end of the Main Agreement.

(3) The Processor obtains knowledge of such secrets, for itself and for the persons working for it, only to the extent required for the services under the Main Agreement, in particular for operation, security, troubleshooting, support and a setup the Controller has ordered.

(4) The Processor has been informed that under § 203(4) sentence 1 StGB it commits a criminal offense if it discloses such a secret without authorization, and under § 203(4) sentence 2 no. 2 StGB if it engages a further contributing person without ensuring that this person was bound to secrecy.

(5) Before they start work, the Processor binds to secrecy in text form all employees and other persons who contribute to the services and may obtain knowledge of such secrets, and informs them of the criminal consequences of a breach.

(6) The Controller permits the Processor to engage the sub-processors listed in Annex B as further contributing persons (§ 203(3) sentence 2, second half-sentence StGB). The Processor passes secrets on to them only to the extent required for their service. It ensures that every sub-processor is contractually bound to keep the Controller's data confidential and passes this duty on to its employees and to further sub-processors.

(7) If an authority or a court demands such data, the Processor informs the Controller without undue delay, where legally permitted, and discloses only what it is legally obliged to disclose.

§ 6 Sub-processors

(1) The Controller consents to the engagement of the sub-processors listed in Annex B.

(2) The Processor will inform the Controller in advance of any intended addition or replacement of other processors, giving the Controller the opportunity to object to such changes.

(3) For sub-processors located in third countries (outside the EEA), the Processor ensures an appropriate level of data protection, in particular through the conclusion of EU Standard Contractual Clauses (SCCs).

(4) The Processor selects its sub-processors carefully and regularly reviews their data-protection levels.

(5) The Processor imposes on every sub-processor, by contract, the same data protection obligations that this DPA sets out for the respective service (Art. 28(4) GDPR). Where a sub-processor fails to fulfill its data protection obligations, the Processor remains liable to the Controller for the performance of those obligations.

§ 7 Audit Rights

(1) The Controller satisfies itself, prior to and during the data processing, of the technical and organizational measures of the Processor. To this end, it may, for example, obtain information, review existing certifications (e.g., ISO 27001, SOC 2), or self-audits.

(2) The Processor ensures that the Controller can verify compliance with its obligations. Upon request, the Controller receives all information necessary for this purpose.

§ 8 Notification of Breaches

(1) The Processor notifies the Controller without undue delay, and in any case within 72 hours of becoming aware, of any personal-data breach within the meaning of Art. 33 GDPR.

(2) The notification includes at minimum: nature of the breach, categories and approximate number of data subjects affected, likely consequences, measures taken or proposed.

§ 9 Authority to Issue Instructions

(1) Verbal instructions of the Controller are confirmed by the Controller without undue delay in writing or by email.

(2) The Processor must inform the Controller without undue delay if it is of the opinion that an instruction violates applicable data-protection law.

(3) The Processor is entitled to suspend the execution of the relevant instruction until it is confirmed or modified by the responsible Controller.

§ 10 Erasure and Return of Personal Data

(1) Upon termination of the Main Agreement, the Processor shall, at the choice of the Controller, return or delete all personal data that has come into its possession in a manner compliant with data protection.

(2) Statutory retention obligations remain unaffected.

(3) The platform provides the Controller with self-service functions for data export and account deletion. On separate written request, the Processor will perform the deletion manually.

§ 11 Final Provisions

(1) The law of the country in which the Controller is established applies, provided that this is mandatory EU law. Otherwise the laws of the State of Wyoming, USA, apply, with concurrent application of the GDPR for processing of personal data of EU/EEA data subjects.

(2) Should individual provisions of this DPA be or become invalid, the validity of the DPA in other respects shall not be affected. The parties shall replace the invalid provision with a valid provision that comes closest to the economic purpose of the invalid provision.

(3) Amendments and supplements to this DPA require written form; electronic acceptance via the Processor's platform is sufficient pursuant to Art. 28(9) GDPR.

(4) In the event of conflicts between this DPA and the Main Agreement, the provisions of this DPA shall take precedence.

Annex A - Technical and Organizational Measures (TOMs) under Art. 32 GDPR

The Processor has implemented the technical and organizational measures described below to protect personal data.

Annex B - List of Approved Sub-processors

The Controller consents to the engagement of the sub-processors listed below. The Processor will inform the Controller in advance of changes (cf. § 6(2)).