Data Processing Addendum

When your business uses Arvisflows, the agent serves your customers and processes their data. That data is yours, not ours. This addendum is the processing agreement required by Article 28 of the General Data Protection Regulation and sets out what we can and cannot do with it.

1. Parties and the role of each

Arvisflows does not determine the purposes or the essential means of the processing of this data and does not use it for its own purposes.

2. Subject matter, duration and purpose

Subject matter. The processing of the personal data of the business's end customers that is necessary for the artificial intelligence agent to serve them.

Nature and purpose. Collection, recording, storage, consultation, use and erasure of that data in order to hold conversations, answer calls, check availability, manage appointments, bookings, orders, deliveries and transport journeys, and send the notices configured by the business; and, if the business enables payments, to prepare the payment for the transaction in the business's Stripe account and record its outcome.

Duration. For as long as the service contract is in force, plus the period provided for in clause 11 for return or deletion. The content of conversations held with the assistant (WhatsApp, phone and web chat) is kept for six months from each message and is then deleted automatically, regardless of whether the contract is still in force. Data on appointments, bookings, quotes, orders, deliveries and transport journeys is not affected by that period and is kept in accordance with clause 11.

3. What data and whose

4. Obligations of Arvisflows

Arvisflows undertakes to:

• Process the data only on the customer's documented instructions. These Terms, this addendum and the configuration set by the customer in the Manager Panel are deemed documented instructions.
• Not use the data for its own purposes, disclose it, or use it to train its own or third-party artificial intelligence models.
• Ensure that the persons authorised to process the data have committed themselves to confidentiality, indefinitely, even after their relationship with Arvisflows ends.
• Apply and maintain the security measures in clause 8.
• Assist the customer, as far as possible, so that it can respond to data subjects' rights requests.
• Help the customer comply with its obligations regarding security, breach notification and impact assessment, taking into account the information available to it.
• Inform the customer immediately if it considers that an instruction received infringes data protection law.
• Make available to the customer the information necessary to demonstrate compliance with these obligations.

5. Obligations of the customer

The customer, as controller, undertakes to:

• Have a valid legal basis to process the data of its end customers and to disclose it to Arvisflows.
• Inform its end customers that they may be served by an automated system, of the controller's identity and of how to exercise their rights. Arvisflows recommends including this in the agent's first message and in the business's privacy policy.
• Configure the agent and the panel in compliance with the law, and not enter into them data it does not need to provide its service.
• Respond to the rights requests it receives from its end customers, with Arvisflows' assistance.
• Keep up to date the list of people in its organisation with access to the panel and revoke access for anyone who no longer needs it.

6. Authorised sub-processors

The customer gives Arvisflows general authorisation to engage the following sub-processors, which are necessary to provide the service:

When the customer enables booking payments, Stripe provides the payment service under the contract the customer enters into directly with Stripe, and not as a sub-processor of Arvisflows. On the customer's behalf, Arvisflows only sends Stripe the amount, the currency, the name of the service and an internal booking identifier. The customer is responsible for informing its end customers of that processing by Stripe.

Arvisflows enters into obligations with each sub-processor equivalent to those in this addendum and is liable to the customer for their performance.

Before adding or replacing a sub-processor, Arvisflows will notify the customer at least 30 calendar days in advance. If the customer objects on reasonable and well-founded data protection grounds, it may terminate the contract without penalty before the change takes effect.

Latest change to this list: on 6 September 2026 Anthropic was added as a sub-processor, and OpenAI's function came to be shared with it. Both process the same category of data, in the same country and with the same safeguards described in the next section, and neither of them uses the content of conversations to train its models. This change was notified by email to all customers on 6 September 2026.

Change of 30 October 2026: OpenAI became the main provider and Anthropic became the backup. Both process the same category of data, in the same country and with the same safeguards described in the next section.

7. International transfers

The data resides in the European Union. However, Arvisflows is a US company and some of the sub-processors above process data in the United States, so international transfers take place.

Those transfers rely on standard contractual clauses approved by the European Commission, supplemented by any additional measures that are necessary, or on the adequacy decision for the EU-US Data Privacy Framework where the sub-processor is certified under it. Arvisflows will provide the customer with a copy of the applicable safeguards on request.

8. Security measures

Taking into account the state of the art and the risk of the processing, Arvisflows applies at least the following measures:

• Encryption in transit. All communications between the browser, the application and the providers are encrypted using TLS.
• Credentials. Panel login passwords are stored using a salted derivation function, never in plain text, and cannot be recovered even by Arvisflows staff.
• Access control. Access to the panel requires authentication and is managed through time-limited session tokens, which expire when the browser is closed.
• Segregation. Each business's data is logically separated and every query is limited to the authenticated business.
• Least privilege. Administrative access to the systems is limited to the people who need it to operate the service.
• Regular backups of the database, with the ability to restore.
• Activity logging of system executions and errors, to be able to detect and analyse incidents.
• Review. These measures are reviewed periodically and updated when the risk changes.

9. Security breaches

If Arvisflows becomes aware of a security breach affecting data processed on the customer's behalf, it will notify the customer without undue delay and, at the latest, within 48 hours of becoming aware of it.

The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken or proposed to remedy it. It is for the customer, as controller, to decide on notification to the supervisory authority and to the data subjects.

10. Data subject rights

If an end customer contacts Arvisflows directly to exercise their rights, Arvisflows will not respond to the substance of the request and will forward it to the relevant business without delay, informing the requester that the controller is that business.

Arvisflows provides the customer with the tools needed to handle those requests itself from the Manager Panel, and gives it additional assistance when the consultation or erasure cannot be carried out from the panel.

The customer can itself delete, from the Manager Panel, the complete conversation of a specific person, including the record the assistant uses to remember previous conversations. The deletion is immediate and cannot be undone.

11. Return and deletion at the end

When the provision of the service ends, and at the customer's choice, Arvisflows will return the data in a structured, commonly used format or delete it, together with any existing copies.

The customer has 30 calendar days from cancellation to request its return. Once that period has passed without a request, Arvisflows will delete it. Data that must be kept by law is excepted and will remain blocked and unused until the corresponding period expires.

12. Audit

Arvisflows will make available to the customer the information reasonably necessary to demonstrate compliance with this addendum, and will cooperate in audits or inspections carried out by the customer or an auditor appointed by it.

Audits must be requested at least thirty days in advance, will be limited to one per year unless an incident justifies another, will take place during working hours without disrupting operations, and will be subject to confidentiality. Costs will be borne by the customer, unless the audit reveals a material breach attributable to Arvisflows.

13. Changes to this addendum

Arvisflows may update this addendum to adapt it to changes in the law, to new decisions of the supervisory authorities or to changes in the service. Material changes will be notified at least 30 calendar days in advance. In the event of a conflict between this addendum and the Terms of Service, this addendum will prevail in all matters relating to data protection.