Data Processing Agreement (DPA)

The DPA sets out the conditions under which Resply processes, on behalf of the Customer, the personal data required to provide the automated customer support service (the « Service »). The terms « personal data », « processing », « controller », « processor », « data subject » and « personal data breach » have the meaning given to them in the GDPR.

Data relating to the accounts of the Customer's users (its team members) and to billing is processed by Resply as a controller; it is covered by the Privacy Policy and not by the DPA.

The data subjects, categories of data, nature, purpose and duration of the processing are described in Annex 1.

Resply processes personal data only on the Customer's documented instructions. Documented instructions consist of the Terms, the DPA and the configuration of the Service made by the Customer (settings, knowledge sources, AI tools, webhooks, mailbox connections).

Resply immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other applicable provisions.

Resply does not use the Customer's personal data for its own purposes, does not sell it and does not use it to train artificial intelligence models. Resply may produce aggregated operational data (conversation volumes, Service consumption) that does not contain the content of conversations, for billing and to operate the Service.

• Have a legal basis for the processing entrusted to Resply and inform data subjects, in particular by mentioning in its own privacy policy the use of an AI-powered customer support provider.
• Not solicit, through the Service, special categories of data (Article 9 GDPR) or data relating to criminal convictions, unless necessary and under its own responsibility.
• Ensure that the content it adds to its knowledge base is lawful.
• Configure the Service in line with its own obligations (retention periods, enabled features such as screen recording or mailbox connection).

Resply ensures that any person authorized to process the Customer's personal data is bound by a confidentiality obligation. At the date of the DPA, only the publisher has access to production systems.

Resply implements the technical and organizational measures described in Annex 2 to ensure a level of security appropriate to the risk (Article 32 GDPR). Resply may update these measures provided that the overall level of protection is not reduced.

The Customer grants Resply a general authorization to engage the sub-processors listed in Annex 3.

Resply informs the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds by writing to contact@resply.io. If no satisfactory solution is found, the Customer may terminate its subscription before the change takes effect.

Resply contractually imposes on each sub-processor data protection obligations at least equivalent to those of the DPA and remains liable to the Customer for their performance.

Some sub-processors may process data outside the European Economic Area (see Annex 3). Such transfers are governed by an adequacy decision of the European Commission (in particular the EU-U.S. Data Privacy Framework, where the sub-processor is certified) or by the standard contractual clauses adopted by the European Commission (Decision 2021/914).

The Customer is responsible for responding to data subject requests. Resply assists it through appropriate technical and organizational measures:

• export of conversations from the dashboard (CSV format);
• deletion of a data subject's data upon the Customer's written request to contact@resply.io, within 30 days;
• forwarding to the Customer, without delay, any request received directly from a data subject, without responding itself unless instructed by the Customer.

Resply notifies the Customer of any personal data breach affecting it without undue delay and no later than 72 hours after becoming aware of it, by email to the address of the administrator account.

The notification describes, where possible: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not available at the time of the first notification is provided as soon as possible.

Resply provides the Customer, to a reasonable extent and taking into account the information available to it, with the assistance required to carry out data protection impact assessments and, where applicable, prior consultation with the supervisory authority.

The DPA applies for as long as Resply processes personal data on behalf of the Customer.

The Customer may export its conversations at any time and then delete its account from its settings. Account deletion immediately erases the Customer's data from the production database. Associated files (attachments, screen recordings) and any backup copies are erased within 30 days. Cancelling the subscription without deleting the account does not erase the data; the Customer may request its deletion at any time.

Resply makes available to the Customer, on request, the information necessary to demonstrate compliance with the DPA, in particular by answering a written questionnaire, no more than once a year.

The Customer may also have an audit carried out by an independent auditor bound by confidentiality, with 30 days' written notice, no more than once a year (except in the event of a confirmed data breach), at the Customer's expense and without disrupting the Service.

Each party's liability under the DPA is subject to the limitations set out in the Terms, without prejudice to the mandatory provisions of the GDPR, in particular Article 82.

The DPA is governed by French law. Disputes are submitted to the courts designated in the Terms.