Data Processing Agreement

1. Parties and roles

The customer (the team owner) is the controller. Sota Labs Technology JSC (Công ty Cổ phần Công nghệ Sota Labs), business registration no. 0109975847, CIC Tower, 2 Nguyễn Thị Duệ, Cầu Giấy, Hà Nội, Việt Nam is the processor. Each party complies with the data protection laws applicable to it.

2. Subject matter and duration

Processing of personal data of the customer's end users (recipients, chat visitors, customers, invoice recipients) for the purpose of providing the Service, for the duration of the customer's account plus the 30-day retention period.

3. Nature and purpose

Storage, transmission, delivery, indexing and AI-assisted drafting of messages; identity verification; issuing invoices; analytics limited to the customer's own data. Categories: contact details, message content, transaction data, technical identifiers. No special categories are intended to be processed.

4. Processor obligations

Sota Labs undertakes to:

• Process personal data only on the customer's documented instructions, including those given through the API and dashboard.
• Ensure staff with access are bound by confidentiality.
• Implement the technical and organisational measures described in the Privacy Policy.
• Assist the customer with data subject requests and impact assessments.
• Notify the customer of a personal data breach without undue delay and within 72 hours of becoming aware, with the information needed to report it.
• Delete or return all personal data at the end of the Service, unless retention is required by law.

5. Sub-processors

The customer authorises the sub-processors listed in the Privacy Policy. Sota Labs remains responsible for their performance, imposes equivalent obligations on them by contract, and gives 30 days' notice of additions, during which the customer may terminate the affected service.

6. International transfers

Data is hosted in Singapore. Transfers out of Việt Nam are carried out under the customer's instruction and documented in a transfer impact assessment dossier as required by Decree 13/2023/NĐ-CP. Where the GDPR applies, Standard Contractual Clauses are incorporated by reference.

7. Audit

On request and no more than once a year, Sota Labs provides its current SOC 2 Type II report and answers reasonable security questionnaires. Where these do not suffice, the customer may conduct an audit at its own cost with 30 days' notice.

8. Liability

Liability under this agreement is subject to the limits in the Terms of Service.

9. Order of precedence

In case of conflict, this agreement prevails over the Terms of Service for matters of personal data protection.