Data Processing Agreement
Last updated: 2026-02-27
Introduction
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Radd ("Processor") and the customer ("Controller") who subscribes to the Service. This DPA is entered into pursuant to Article 28 of the General Data Protection Regulation (GDPR) and governs the processing of personal data by Radd on behalf of the Controller.
1. Scope and Purpose of Processing
Radd processes personal data solely to provide the AI chatbot platform service, which includes: generating AI-powered responses to visitor inquiries; capturing and storing leads submitted through chatbot conversations; storing and managing conversation histories; processing payments for subscriptions and credit top-ups; sending transactional emails and notifications. The categories of data subjects include: website visitors who interact with the Controller's chatbots; leads who voluntarily submit their contact information; employees of the Controller who access the platform.
2. Types of Personal Data Processed
The personal data processed includes: visitor messages and conversation content; anonymized IP addresses (last octet zeroed); lead contact information (name, email, phone, when voluntarily submitted); social media platform identifiers (for WhatsApp, Instagram, and Messenger channels); payment information (processed by Tap Payments, Radd does not store card details); account information (name, email, business name, language preference).
3. Processor Obligations
Radd shall: process personal data only on documented instructions from the Controller, including with regard to transfers to third countries; ensure that persons authorized to process personal data have committed to confidentiality; implement appropriate technical and organizational security measures, including encryption at rest and in transit, access controls, and regular security audits; not engage another processor without prior written authorization from the Controller; assist the Controller in responding to data subject requests (access, deletion, portability, restriction); delete or return all personal data upon termination of the service, within 30 days; make available all information necessary to demonstrate compliance and allow for audits.
4. Sub-Processors
The Controller authorizes the use of the following sub-processors: OpenAI (USA): AI model provider for chatbot responses; Anthropic (USA): AI model provider for chatbot responses; Google AI (USA): AI model provider for chatbot responses; Pinecone (USA): Vector database for knowledge retrieval; Tap Payments (Bahrain): Payment processing; Resend (USA): Transactional email delivery; Cloudflare R2 (Global): File storage for attachments. For sub-processors located outside the EEA, Radd relies on Standard Contractual Clauses (SCCs) or adequacy decisions. The Processor will inform the Controller of any intended changes to sub-processors, providing a reasonable opportunity to object.
5. Security Measures
Radd implements the following security measures: encryption of data in transit (TLS 1.2+) and at rest; secure password hashing (bcrypt, cost factor 12); HMAC-SHA256 session token hashing; rate limiting and IP-based access controls; admin IP allowlisting with CIDR support; two-factor authentication for admin accounts; regular automated cleanup of expired data; audit logging of all administrative actions.
6. Data Breach Notification
In the event of a personal data breach, the Processor shall notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach. The notification shall include: the nature of the breach; the categories and approximate number of data subjects affected; the likely consequences; and the measures taken to mitigate the breach.
7. Data Subject Rights
The Processor provides the following self-service tools to assist the Controller in fulfilling data subject requests: data export (profile, conversations, billing, leads) via the dashboard; account deletion with cascading removal of all associated data; right to restrict processing (pauses all bots, retains data without active processing); conversation expiry (automatic deletion after 24 hours).
8. Data Retention and Deletion
Conversations expire after 24 hours by default. Expired sessions are purged automatically by a scheduled cleanup job. Audit logs are retained for 90 days. Upon account deletion or service termination, all customer data is permanently removed within 30 days, including data held by sub-processors (vector databases, file storage). Invoices are kept for as long as accounting and tax law requires, with all personal details removed.
9. International Data Transfers
Some sub-processors are located in the United States. For these transfers, Radd relies on Standard Contractual Clauses (SCCs) as adopted by the European Commission, or applicable adequacy decisions. The Controller acknowledges and authorizes these transfers as necessary for the provision of the Service.
10. Term and Termination
This DPA shall remain in effect for the duration of the Controller's use of the Service. Upon termination, the Processor shall, at the Controller's choice, delete or return all personal data within 30 days, unless retention is required by applicable law.
11. Governing Law
This DPA shall be governed by the same laws that govern the Terms of Service. Any disputes arising from this DPA shall be resolved in accordance with the dispute resolution provisions of the Terms of Service.
12. Contact
For questions about this Data Processing Agreement, contact our Data Protection Officer at [email protected].