Data Processing Terms

GoBrise LLC

Effective date: 26 September 2026

Last updated: 26 September 2026

Plain-language summary. These terms describe how GoBrise processes personal data on behalf of the businesses that use our platform. They are written for customers reviewing us as a vendor, not for end visitors, whose privacy relationship is with the business whose website they are visiting. Where we say a control or certification is not in place, we mean exactly that: we would rather tell you what is true today than imply otherwise. This summary is for orientation only; the operative terms follow.

1. Scope and application

1.1 These Data Processing Terms (the "DPT") govern the processing of Personal Data by GoBrise LLC, a Wyoming limited liability company, United States ("GoBrise", "we", "us", "our"), on behalf of the business that uses the Service (the "Customer", "you", "your").

1.2 This DPT is incorporated into and forms part of the GoBrise Terms of Service (the "Terms"). By accepting the Terms, or by using the Service, you accept this DPT. Together with the Terms and the Privacy Policy, it forms the parties' agreement on the processing of Personal Data in connection with the Service (the "Agreement").

1.3 This DPT applies to the extent GoBrise processes Personal Data on your behalf as a Processor, and to the extent Applicable Data Protection Law applies to that processing.

1.4 Signed version. This DPT is binding as published and needs no signature. Customers whose compliance framework requires a countersigned Data Processing Agreement may request one at sales@gobrise.com, and we will provide these terms in signable form.

1.5 Where an executed Data Processing Agreement, Order Form or enterprise agreement conflicts with this DPT, that executed instrument prevails for its subject matter, as set out in Section 21.

1.6 This DPT does not apply to Personal Data that GoBrise processes as a Controller for its own purposes, which is governed by the Privacy Policy and Section 3.3.

2. Definitions

"Applicable Data Protection Law" means all laws applicable to the processing of Personal Data under the Agreement, including, where applicable, Regulation (EU) 2016/679 (the "GDPR"); the GDPR as incorporated into United Kingdom law (the "UK GDPR"); the Swiss Federal Act on Data Protection (the "FADP"); the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA") and other United States state privacy laws; and any other applicable data protection or privacy law.

"Controller" means the entity that determines the purposes and means of processing Personal Data, including a "business" under the CCPA.

"Processor" means the entity that processes Personal Data on behalf of the Controller, including a "service provider" under the CCPA.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates, including a "consumer" under the CCPA.

"Personal Data" means any information relating to a Data Subject that GoBrise processes on the Customer's behalf under the Agreement, including "personal information" under the CCPA.

"Special Category Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and genetic data, biometric data used for identification, health data, and data concerning a person's sex life or sexual orientation, together with any equivalent sensitive category under Applicable Data Protection Law, including "sensitive personal information" under the CCPA.

"Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure and destruction.

"Service", "Customer Data", "Knowledge Base Content", "Conversation Data", "End User", "Team Member", "Widget", "AI Output" and "AI Provider" have the meanings given in the Terms.

"Sub-processor" means any third party engaged by GoBrise to process Personal Data on the Customer's behalf to provide the Service, including AI Providers.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data processed by GoBrise or a Sub-processor on the Customer's behalf. It does not include unsuccessful attempts that do not compromise Personal Data, such as blocked login attempts, port scans, failed authentication, or mitigated denial-of-service attempts.

"EU SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced.

"UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as amended or replaced.

"Restricted Transfer" means a transfer of Personal Data to a country or recipient not covered by an adequacy decision or equivalent finding, where a transfer mechanism is required.

"Instruction" means a documented instruction given by the Customer to GoBrise under Section 4.

Capitalised terms not defined here have the meaning given in the Terms.

3. Roles of the parties

3.1 Customer as Controller, GoBrise as Processor. For Personal Data in Conversation Data (including leads, booking requests and tickets captured in conversations), Knowledge Base Content, Team Member records within the Customer's workspace and associated operational metadata, the Customer is the Controller and GoBrise is the Processor. The Customer decides what Personal Data is collected through its Widget, why, how the Service is configured, and how long data is kept.

3.2 Customer as Processor for a third party. Where the Customer is itself a Processor acting for a third-party controller (for example an agency or white-label reseller deploying the Service for its own client), the Customer appoints GoBrise as a Sub-processor, warrants that it has that controller's authority to do so, and remains responsible for compliance with that controller's instructions.

3.3 GoBrise as Controller for its own data. For Personal Data that GoBrise processes for its own business purposes (account registration, administrator and billing contacts, payment records, support and sales correspondence, usage and diagnostic data about the Customer's use of the Service, security logs, and gobrise.com visitor data), GoBrise is an independent Controller, as described in the Privacy Policy. This DPT does not apply to that processing.

3.4 End Users. End Users are not parties to the Agreement. Their privacy relationship is with the Customer whose website they are visiting, and the Customer is responsible for it under Section 6.

3.5 No joint controllership is created by this DPT, except where Applicable Data Protection Law requires otherwise.

4. Customer instructions

4.1 GoBrise will process Personal Data only:

(a) to provide, operate, secure, maintain and support the Service for the Customer under the Agreement;

(b) in accordance with the Customer's documented Instructions; and

(c) as required by applicable law, subject to Section 17.

4.2 The Customer's Instructions comprise the Agreement (including this DPT and the Terms); the Customer's configuration of the Service, including whether AI replies are enabled, AI agent and escalation settings, enabled AI actions, Widget deployment and Team Member permissions; the Customer's use of features and controls in the Service; and any further written instruction agreed by the parties.

4.3 Additional instructions. The Customer may give additional written Instructions. GoBrise will comply where consistent with the Agreement and technically and operationally feasible, and may charge a reasonable fee for Instructions outside the scope of the Service or requiring material extra effort, after notifying the Customer.

4.4 Unlawful instructions. GoBrise will inform the Customer without undue delay if, in its reasonable opinion, an Instruction infringes Applicable Data Protection Law, and may suspend performance of that Instruction, without liability, until it is withdrawn, amended or confirmed.

4.5 GoBrise will not process Personal Data processed on the Customer's behalf for its own independent purposes, and will not sell, rent, share or disclose it except as this DPT permits.

5. Details of the processing

5.1 The subject matter, duration, nature and purpose of processing, and the categories of Personal Data and Data Subjects, are set out in Annex I.

5.2 Purposes. GoBrise processes Personal Data on the Customer's behalf only to:

(a) host, store, transmit and display Customer Data within the Customer's account;

(b) generate AI Output in response to messages in the Customer's account, including transmitting message content and relevant Knowledge Base Content excerpts to AI Providers for that purpose;

(c) build and maintain search indexes and embeddings for retrieval within the Customer's own account, including pages imported from a website at the Customer's request;

(d) route, escalate, assign and deliver conversations to the Customer's Team Members, including human handoff;

(e) perform AI actions the Customer has enabled, such as lead capture, meeting booking and ticket creation;

(f) provide support, diagnose faults and maintain reliability and continuity;

(g) secure the Service, authenticate users, apply rate limits, prevent fraud, spam and abuse, and investigate Security Incidents;

(h) comply with applicable law, subject to Section 17; and

(i) any other purpose expressly instructed by the Customer under Section 4.3.

5.3 Duration. Processing continues for the duration of the Customer's account and thereafter only as provided in Section 15.

6. Customer responsibilities and warranties

6.1 The Customer represents, warrants and undertakes that:

(a) it has a valid lawful basis for all Personal Data submitted to or collected through the Service, including through its Widget and Knowledge Base Content, and for its processing by GoBrise and its Sub-processors, including AI Providers;

(b) it has given Data Subjects all notices required by Applicable Data Protection Law, including about AI processing, transmission to AI Providers, international transfers and retention;

(c) it has obtained all consents and permissions required by Applicable Data Protection Law, including any cookie or storage consent for the Widget and any consent required for recording chat transcripts;

(d) where required by law, including the EU AI Act, it clearly discloses to End Users that they are interacting with an AI system;

(e) its Instructions will not cause GoBrise or any Sub-processor to breach Applicable Data Protection Law;

(f) it has the right to submit, and authorise GoBrise to process, all Personal Data it submits, and its Knowledge Base Content, including any website it asks us to import, does not infringe third-party rights;

(g) it will respond to Data Subject requests and supervisory authority communications for data it controls, with GoBrise's assistance under Section 13; and

(h) it will decide the retention of End User data in line with its own privacy commitments and will not rely on GoBrise to determine an appropriate period.

6.2 The Customer is responsible for the accuracy, quality and legality of the Personal Data it submits and for limiting collection to what is necessary. GoBrise does not verify or moderate Customer Data.

6.3 The Customer is responsible for managing Team Member access and permissions, removing access promptly on role change or departure, and the acts and omissions of its Team Members.

6.4 The Customer is responsible for the security of its credentials and widget keys, the website on which the Widget is installed, any system to which it exports Personal Data, and configuring the Service so as not to expose Personal Data inappropriately to End Users.

7. Prohibited and restricted data

7.1 The Customer must not submit to the Service, and must ensure its Widget does not solicit:

(a) protected health information or data subject to the U.S. Health Insurance Portability and Accountability Act ("HIPAA");

(b) payment card numbers, security codes or other data subject to PCI DSS;

(c) government identification numbers, financial account credentials or passwords;

(d) Special Category Data;

(e) Personal Data of children below the age of valid consent under Applicable Data Protection Law, or data requiring verifiable parental consent;

(f) export-controlled data; or

(g) other data subject to sector-specific regulatory obligations,

unless GoBrise has expressly agreed in writing to support it for that Customer.

7.2 HIPAA. GoBrise does not currently provide HIPAA compliance and does not enter into Business Associate Agreements. The Service must not be used to process protected health information.

7.3 The Service has not been designed or assessed for the data in Section 7.1, and Annex II does not describe measures calibrated to it. The Customer is solely responsible for the consequences of submitting such data, and GoBrise may remove it on becoming aware of it and may suspend the account under the Terms.

7.4 The Customer must not use the Service to make automated decisions producing legal or similarly significant effects on a Data Subject.

8. GoBrise obligations as Processor

GoBrise will:

8.1 process Personal Data only under Section 4 and for the purposes in Section 5.2;

8.2 implement and maintain the measures in Section 10 and Annex II;

8.3 ensure its personnel and contractors who process Personal Data are bound by the confidentiality obligations in Section 9, with access restricted under Section 11;

8.4 engage Sub-processors only under Section 12;

8.5 notify Security Incidents under Section 14;

8.6 assist with Data Subject requests under Section 13;

8.7 provide reasonable assistance with data protection impact assessments and prior consultation with supervisory authorities under Articles 35 and 36 GDPR or their equivalents, to the extent related to the Service and the information is reasonably available to GoBrise;

8.8 make available information needed to demonstrate compliance, under Section 18;

8.9 delete or return Personal Data under Section 15; and

8.10 maintain records of processing as Processor where required by Article 30(2) GDPR or its equivalent.

9. Confidentiality

9.1 GoBrise will treat Personal Data processed on the Customer's behalf as confidential, will not disclose it except as this DPT permits, and will not use it for purposes other than those in Section 5.2.

9.2 GoBrise will ensure that everyone authorised to process Personal Data is bound by a written or statutory obligation of confidentiality that survives the end of their engagement, and is informed of the confidential nature of the data and the limits on its use.

9.3 The confidentiality provisions of the Terms also apply. For Personal Data, this Section 9 prevails in a conflict.

10. Security measures

10.1 Commitment. GoBrise will implement and maintain appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risks to Data Subjects, in accordance with Article 32 GDPR and equivalent law.

10.2 Current measures. The measures in place are described in Annex II. In summary: every record is scoped to the customer that owns it; access rules are enforced in the database itself, not only in the application; dashboard queries run with the signed-in user's own permissions; and Widget traffic can only reach the single business its widget key belongs to.

10.3 No certification claimed. GoBrise does not currently hold SOC 2, ISO 27001, HIPAA attestation, PCI DSS certification, GDPR certification under Article 42, or any other certification or third-party attestation. SOC 2 is on our roadmap and has not been obtained. Nothing in this DPT or Annex II represents that GoBrise's measures conform to any certification, framework or standard.

10.4 Not currently available. The following are roadmap items and not available on any plan: single sign-on and SAML; customer-facing audit logs; configurable automated retention; self-serve data export; regional data residency; and advanced security controls. The Customer must not rely on them in assessing GoBrise's measures.

10.5 GoBrise may update the measures in Annex II as the Service evolves, without materially reducing the overall level of security under this DPT.

10.6 No absolute guarantee. No method of transmission or storage is completely secure. Section 10.1 is an obligation to maintain appropriate measures, not a warranty of outcome.

10.7 The Customer is responsible for satisfying itself that the measures in Annex II are appropriate to the Personal Data it chooses to submit.

11. Authorised personnel and access to Customer conversations

11.1 Permitted purposes. Authorised GoBrise personnel and contractors may access Personal Data processed on the Customer's behalf, including Conversation Data and Knowledge Base Content, only where reasonably necessary for:

(a) support: investigating an issue reported by the Customer or detected by GoBrise on its behalf;

(b) security: investigating suspected unauthorised access or other Security Incidents;

(c) debugging and reliability: diagnosing errors, data problems, degraded performance or failed AI responses;

(d) abuse prevention: investigating suspected breach of the acceptable use terms in the Terms; and

(e) legal compliance: responding to a valid legal obligation, subject to Section 17.

11.2 Safeguards. Such access is:

(a) limited to a small number of personnel and contractors whose role requires it, on a need-to-know basis;

(b) subject to written confidentiality obligations under Section 9;

(c) performed using anonymised, aggregated or redacted data where sufficient; and

(d) for support, undertaken at the Customer's request or with its knowledge wherever practicable.

Customer-visible audit logs and access reporting are roadmap features and are not currently available.

11.3 Limits. GoBrise does not access Conversation Data for general browsing, marketing, data-set building, benchmarking against other customers or competitive purposes. Content accessed under this Section is not used for AI model training and remains subject to Section 20.

11.4 Location. Personnel and contractors exercising access under this Section may be located outside the United States, including in India, subject to Section 16.

12. Sub-processors

12.1 General authorisation. The Customer gives general written authorisation for GoBrise to engage Sub-processors for the purposes in Section 5.2, subject to this Section 12.

12.2 Categories. GoBrise engages Sub-processors in the functional categories listed in Annex III.

12.3 Naming. Sub-processors are described by function because providers may change at this stage. The Customer may request the identity of current Sub-processors, including the hosting provider and AI Providers, at sales@gobrise.com, and GoBrise will confirm them in writing.

12.4 Flow-down. Before a Sub-processor processes Personal Data, GoBrise will ensure it is bound by written terms imposing data protection obligations no less protective than this DPT for the processing concerned, including confidentiality, appropriate security measures, purpose limitation, incident assistance, deletion of data and, for a Restricted Transfer, an appropriate transfer mechanism under Section 16. Where a Sub-processor offers only standard published terms, GoBrise will engage it only where those terms provide such protection.

12.5 Notice of changes. GoBrise will notify the Customer of an intended new or replacement Sub-processor at least thirty (30) days before it begins processing Personal Data, by email to the Customer's administrators or by notice in the Service. Where a change must be made sooner to address a security, legal or continuity risk, GoBrise will notify the Customer as soon as reasonably practicable.

12.6 Objection. The Customer may object to a new Sub-processor on reasonable data protection grounds by written notice to privacy@gobrise.com within fifteen (15) days of notification under Section 12.5. The parties will discuss the objection in good faith, and GoBrise will use reasonable efforts to offer an alternative that avoids the objected-to Sub-processor. If it cannot do so within a reasonable period, the Customer may terminate the affected subscription by written notice and receive a prorated refund of prepaid fees for the unused remainder of the term. Without a timely objection, the Sub-processor is deemed authorised.

12.7 Sub-processors in the Annex III categories as at the effective date are authorised on acceptance of this DPT.

12.8 GoBrise remains responsible to the Customer for its Sub-processors' performance of their data protection obligations as if it were its own, subject to Section 19.

13. Data Subject rights assistance

13.1 If GoBrise receives a request from a Data Subject about Personal Data processed on the Customer's behalf, it will not respond to the substance, other than to acknowledge it and direct the Data Subject to the Customer, and will inform the Customer without undue delay, unless prohibited by law.

13.2 Taking into account the nature of the processing, GoBrise will provide reasonable assistance to enable the Customer to respond to requests to exercise rights of access, rectification, erasure, restriction, portability, objection or withdrawal of consent, and equivalent rights under United States state privacy laws.

13.3 The Customer can view and delete Conversation Data and Knowledge Base Content within its account and will use those tools first. GoBrise's assistance, including providing copies of data, applies to requests the Customer cannot fulfil itself through the Service.

13.4 GoBrise will respond to requests for assistance without undue delay and in time for the Customer to meet its own statutory deadline, provided the request is made with reasonable time remaining.

13.5 Assistance is free of charge where it involves reasonable effort. GoBrise may charge a reasonable fee for assistance that is repetitive, excessive or requires material engineering effort, after notifying the Customer.

13.6 Verifying the identity of a Data Subject and the validity of a request is the Customer's responsibility.

14. Security Incident notification

14.1 On becoming aware of a Security Incident affecting Personal Data processed on the Customer's behalf, GoBrise will notify the Customer without undue delay and in any event within seventy-two (72) hours, or any shorter period required by Applicable Data Protection Law.

14.2 The notification will include, to the extent available and updated as the investigation progresses:

(a) the nature of the Security Incident;

(b) the categories and approximate number of Data Subjects and records affected, where known;

(c) its likely consequences;

(d) the measures taken or proposed to address and mitigate it; and

(e) a contact point for further information.

14.3 Notification will be sent to the administrator email addresses on the Customer's account. The Customer is responsible for keeping them current and monitored.

14.4 GoBrise will take reasonable steps to contain, investigate and remediate the Security Incident, preserve relevant evidence where reasonably practicable, and cooperate to help the Customer meet its own notification obligations.

14.5 Notifying supervisory authorities and Data Subjects about Personal Data the Customer controls is the Customer's responsibility. GoBrise will not do so in the Customer's name except where required by law or at the Customer's written request.

14.6 A notification under this Section is not an admission of fault, breach or liability.

14.7 The Customer must notify GoBrise without undue delay at security@gobrise.com of any Security Incident, credential compromise or suspected unauthorised access affecting its account.

15. Deletion, return and retention of data

15.1 During the term. The Customer may delete Conversation Data, Knowledge Base Content and Team Member access from the Service at any time. Deletion is irreversible.

15.2 Export. Self-serve export is not yet available. The Customer may request a copy of its Customer Data in a commonly used format at support@gobrise.com, and should do so before closing its account or within the post-termination window in the Privacy Policy.

15.3 End of processing. On termination or expiry of the Customer's account, GoBrise will, at the Customer's election, delete or return the Personal Data it processes on the Customer's behalf and delete existing copies, except where continued storage is required by law. Without a contrary Instruction, GoBrise will delete it.

15.4 Controlling periods. Retention and deletion periods are those set out in the Privacy Policy, which is the single controlling statement of those periods across the Terms, this DPT and the Privacy Policy. No different period is stated or implied here.

15.5 Customer-determined retention. For End User data collected through its Widget, the Customer decides how long data is kept, using the deletion tools in the Service. Configurable automated retention is not yet available; until then, the Customer may request bulk deletion at privacy@gobrise.com.

15.6 Backups. Where backups of Personal Data exist, residual copies may persist after deletion from production and are overwritten in the ordinary backup cycle within the period stated in the Privacy Policy. Backups are used only for restoration and continuity and remain subject to Sections 9 and 10.

15.7 GoBrise may retain Personal Data longer where required by law or reasonably necessary to resolve a dispute or enforce the Agreement, limiting processing to that purpose and continuing to apply this DPT.

15.8 On written request made within the post-termination window, GoBrise will confirm in writing that deletion has been completed.

16. Data location and international transfers

16.1 Hosting location. Personal Data processed on the Customer's behalf is currently hosted on managed cloud infrastructure in the United States. Regional data residency is not currently available, and GoBrise gives no commitment that Personal Data will remain in any particular region. A Customer that needs data to stay in a specific region must raise this in writing before subscribing.

16.2 Onward and offshore processing. Personal Data may also be processed in other countries where GoBrise, its personnel, contractors or Sub-processors operate, including by remote access from GoBrise personnel and contractors located in India, for the purposes and under the safeguards in Section 11.

16.3 Restricted Transfers from the EEA. Where a transfer under this DPT is a Restricted Transfer subject to the GDPR, the EU SCCs are incorporated into this DPT by reference and apply as follows:

(a) Module Two (controller to processor) applies where the Customer is a Controller, and Module Three (processor to processor) applies where the Customer is a Processor under Section 3.2;

(b) the Customer is the data exporter and GoBrise is the data importer;

(c) the optional docking clause in Clause 7 applies;

(d) in Clause 9, Option 2 (general written authorisation) applies, with the notice period in Section 12.5;

(e) in Clause 11, the optional language does not apply;

(f) in Clause 17, the governing law is the law of Ireland;

(g) in Clause 18(b), disputes are resolved by the courts of Ireland;

(h) Annex I.A is completed by the Customer's account details and GoBrise's details in Section 24; Annex I.B by Annex I of this DPT; Annex I.C by the authority determined under Clause 13; Annex II by Annex II of this DPT; and Annex III, where applicable, by Annex III of this DPT.

16.4 Restricted Transfers from the United Kingdom. Where a transfer is a Restricted Transfer subject to the UK GDPR, the UK Addendum is incorporated by reference, with the EU SCCs as incorporated in Section 16.3 forming the Approved EU SCCs. Tables 1 to 3 are completed by the information in Section 16.3 and the Annexes to this DPT. In Table 4, both the importer and the exporter may end the UK Addendum as set out in its Section 19.

16.5 Restricted Transfers from Switzerland. Where a transfer is subject to the FADP, the EU SCCs as incorporated in Section 16.3 apply with these adaptations: references to the GDPR are read as references to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; "member state" does not prevent Data Subjects in Switzerland from enforcing their rights where they habitually reside; and the clauses protect data of legal entities to the extent the FADP requires.

16.6 Alternative mechanisms. If a transfer mechanism in this Section is invalidated or replaced, or a new adequacy decision or lawful mechanism becomes available, the parties will cooperate in good faith to adopt an appropriate alternative without undue delay, and GoBrise may update this Section under Section 22.

16.7 Onward transfers. Where a Sub-processor is in a country requiring a transfer mechanism, GoBrise will ensure an appropriate mechanism is in place with that Sub-processor under Section 12.4.

16.8 Transfer impact assessments. On reasonable written request, GoBrise will provide the information reasonably available to it that the Customer needs for a transfer impact assessment, including the categories of Personal Data, destination countries, purposes and the measures in Annex II.

16.9 If this DPT conflicts with the EU SCCs or the UK Addendum, those instruments prevail for the transfers they govern.

17. Legal requirements, government requests and regulatory cooperation

17.1 If GoBrise receives a legally binding request from a public authority for Personal Data processed on the Customer's behalf, it will, unless legally prohibited:

(a) notify the Customer promptly so it may seek protective relief;

(b) tell the authority that GoBrise is a Processor and refer it to the Customer where possible; and

(c) disclose only the minimum Personal Data necessary to comply.

17.2 GoBrise will review the legality of each such request and challenge any request it considers unlawful or overbroad where there are reasonable grounds to do so.

17.3 If GoBrise is prohibited from notifying the Customer, it will use reasonable efforts to obtain a waiver and share as much information as it lawfully can, as soon as it lawfully may.

17.4 On reasonable request and where lawfully permitted, GoBrise will confirm whether it has received any such request affecting the Customer's Personal Data.

17.5 GoBrise will not voluntarily give any government authority access to Personal Data processed on the Customer's behalf, and has not built and will not build any back door for that purpose.

17.6 GoBrise will reasonably assist the Customer with supervisory authority enquiries and investigations relating to processing under this DPT, and will comply with binding decisions of a competent supervisory authority that apply to it as Processor.

17.7 No Article 27 representative. As an early-stage company, GoBrise has not appointed a representative in the European Union or the United Kingdom under Article 27 GDPR or the UK GDPR. Communications may be sent to the contacts in Section 24.

18. Audits, documentation and security questionnaires

18.1 Documentation first. On reasonable written request, GoBrise will provide the information reasonably necessary to demonstrate compliance with this DPT, including Annex II, the identity of current Sub-processors, and answers to a reasonable vendor security questionnaire. The Customer will accept this in satisfaction of its audit rights where it reasonably enables verification of compliance.

18.2 GoBrise does not currently hold any SOC 2 report, ISO 27001 certificate or other independent attestation that it can provide, as stated in Section 10.3.

18.3 Audit. Where documentation under Section 18.1 is not sufficient to meet a requirement of Applicable Data Protection Law, or a supervisory authority requires it, the Customer may audit GoBrise's processing under this DPT, provided that:

(a) the Customer gives at least thirty (30) days' written notice;

(b) the audit is limited to GoBrise's processing of the Customer's Personal Data and compliance with this DPT;

(c) it occurs no more than once in any twelve (12) months, unless required by a supervisory authority or following a confirmed Security Incident affecting the Customer;

(d) it is conducted remotely, through documentation review and interviews, during normal business hours and without disrupting the Service or compromising other customers' data;

(e) the Customer and any auditor are bound by written confidentiality obligations, and GoBrise may reasonably refuse an auditor that is its competitor;

(f) the Customer bears its own costs and reimburses GoBrise's reasonable costs where the audit requires material time or resources; and

(g) findings are GoBrise's Confidential Information and may be used only to assess compliance with this DPT.

18.4 On-site access. GoBrise runs on managed cloud infrastructure and does not control data centre facilities, so it cannot grant physical access to them. On-site audits are not offered at this stage, except where required by a competent supervisory authority.

18.5 GoBrise will use reasonable efforts to share relevant information about a Sub-processor's data protection and security posture where available to it, but cannot grant audit rights over a Sub-processor.

19. Liability

19.1 Each party's liability under or in connection with this DPT is subject to the exclusions and limitations of liability in the Terms, and all amounts recovered under this DPT count toward the aggregate cap in the Terms.

19.2 Where the EU SCCs or the UK Addendum apply, nothing in Section 19.1 limits a Data Subject's rights under them, or either party's liability to a Data Subject or supervisory authority where such limitation is prohibited by law.

19.3 Neither party excludes or limits liability that cannot lawfully be excluded or limited.

20. AI processing and model training

20.1 Transmission to AI Providers. To generate AI Output, the content of a message, relevant excerpts from the Customer's own Knowledge Base Content, prior messages in the same conversation, and the Customer's configuration may be sent to AI Providers engaged as Sub-processors under Section 12, solely to produce a response to that request.

20.2 No general model training. GoBrise does not use Personal Data, Conversation Data, End User messages or Knowledge Base Content processed on the Customer's behalf to train, fine-tune, develop or improve general-purpose or foundation AI models. GoBrise uses AI Providers and access routes whose published API terms state that submitted content is not used to train their models. This is a binding restriction on GoBrise under this DPT.

20.3 AI Provider retention. AI Providers are used on their standard API terms, under which they may retain submitted content for a limited period for abuse monitoring, security and legal compliance before deleting it. GoBrise does not control that period. GoBrise will confirm current AI Providers and their applicable retention and training terms in writing on request under Section 12.3.

20.4 Customer-specific indexing. Indexes and embeddings derived from the Customer's Knowledge Base Content, including question-and-answer pairs the Customer chooses to save from resolved conversations, are used only to operate and improve the Customer's own AI agent within its own account. This is processing on the Customer's behalf under this DPT.

20.5 Tenant separation. Personal Data is never shared between customer accounts and is never used to benefit another customer. Every conversation, message and knowledge base entry belongs to exactly one account; retrieval is restricted to that account's own knowledge base; no shared or cross-customer content pool is used.

20.6 Aggregated and anonymised data. GoBrise may compile aggregated or anonymised statistics, such as volumes, latency, error rates and feature adoption, to operate and improve the Service. Such data does not identify the Customer, any Team Member, End User or other individual, does not permit re-identification, and is not Personal Data within the scope of this DPT.

20.7 AI Output may be incomplete, inaccurate or unsuitable, and GoBrise gives no warranty of accuracy, as set out in the Terms.

20.8 EU AI Act. Where the EU AI Act applies, the Customer, as deployer, is responsible for transparency to its End Users as set out in Section 6.1(d). The parties will cooperate in good faith on any further allocation of obligations as applicable requirements take effect.

20.9 The Service must not be configured or used to make automated decisions producing legal or similarly significant effects on a Data Subject, as set out in Section 7.4 and the Terms.

21. Order of precedence and relationship with other documents

21.1 In a conflict, this order applies:

(a) the EU SCCs and the UK Addendum, for the Restricted Transfers they govern;

(b) an executed Data Processing Agreement, Order Form or enterprise agreement, for its subject matter;

(c) this DPT;

(d) the Terms of Service;

(e) the Privacy Policy, which controls data retention and deletion periods under Section 15.4; and

(f) the Pricing Page.

21.2 The Terms of Service govern the commercial and operational relationship between the parties. This DPT governs the processing of Personal Data and supplements the Terms without replacing them.

21.3 The Privacy Policy describes GoBrise's processing as a Controller under Section 3.3 and is the controlling statement of retention and deletion periods. Where it describes practices relevant to GoBrise's role as Processor, this DPT governs the contractual obligation.

21.4 Any security information published on GoBrise's website is informational only and does not form part of this DPT. Annex II is the operative description of measures.

22. Changes to these Data Processing Terms

22.1 GoBrise may update this DPT to reflect changes to the Service, Sub-processor categories, Applicable Data Protection Law or an incorporated transfer mechanism, provided no update materially reduces the protection of Personal Data under this DPT.

22.2 GoBrise will give reasonable advance notice of material changes by email to the Customer's administrators or in the Service. Continued use after the effective date means acceptance. Changes required by law or to address a security or legal risk may take effect immediately.

22.3 Prior versions are available on request.

23. Term, termination and survival

23.1 This DPT takes effect on the earlier of the Customer's acceptance of the Terms and its first use of the Service, and continues until GoBrise stops processing Personal Data on the Customer's behalf.

23.2 This DPT ends when the Terms end, but continues to apply to any Personal Data GoBrise retains until it is deleted or returned under Section 15.

23.3 Sections 2, 9, 10.6, 14 (for incidents affecting retained data), 15, 16 (for retained data), 17, 19, 20.2, 20.5, 20.6, 21, 24 and this Section 23 survive termination.

23.4 This DPT is governed by the law stated in the Terms, except that the EU SCCs, the UK Addendum and provisions giving effect to them are governed by the law specified in those instruments. Nothing here limits the rights of a Data Subject or the jurisdiction of a competent supervisory authority.

24. Contact information

Entity: GoBrise LLC, a Wyoming limited liability company, United States

Contact page: gobrise.com/company/contact

EU / UK representative: not appointed (see Section 17.7).

Data Protection Officer: not appointed. GoBrise is not currently required to appoint one; data protection enquiries are handled by the GoBrise team at privacy@gobrise.com.

Annex I: Description of the processing

For the purposes of Article 28(3) GDPR and Annex I.B of the EU SCCs.

A. Parties

Data exporter / Controller: the Customer, as identified by its account registration details, operating a customer support function on its own website using the Service. Its role is Controller, or Processor where Section 3.2 applies.

Data importer / Processor: GoBrise LLC, a Wyoming limited liability company, with the contact details in Section 24, providing an AI-supported customer support platform. Its role is Processor.

B. Subject matter and nature of the processing

Provision of the GoBrise AI-supported customer support platform, comprising hosting, storage, transmission, display, indexing, embedding, retrieval, AI-assisted response generation, AI actions (lead capture, meeting booking, ticket creation), conversation routing and escalation, human handoff, website import at the Customer's request, support, security monitoring, abuse prevention and deletion of Personal Data, as described in Section 5.2.

C. Purpose of the processing

The purposes in Section 5.2, and no other.

D. Categories of Data Subjects

• End Users: visitors to the Customer's website who interact with the Widget, the AI agent or the Customer's agents, including the Customer's customers, prospects and other enquirers.
• Team Members: the Customer's agents, administrators and invited users.
• Individuals referenced in content: people whose Personal Data appears in Knowledge Base Content, imported website pages or conversation messages.

E. Categories of Personal Data

• Identification and contact data: names, email addresses, phone numbers where provided, company names and customer or order references.
• Conversation content: messages sent and received, transcripts, and any Personal Data an End User chooses to share, including lead details, meeting booking requests and support tickets captured in conversations.
• Conversation metadata: timestamps, session and widget identifiers, status, assignment and escalation records, AI confidence scores and referring page.
• Knowledge Base Content: Personal Data in text, pages, FAQs, saved replies, imported website pages and saved question-and-answer pairs, with derived indexes and embeddings.
• Team Member data: profile details, roles, invitation records, authentication identifiers and in-product activity.
• Technical data: IP addresses, approximate location derived from IP address, browser and operating system type, and diagnostic and error data.

F. Special Category Data

None is intended or permitted. The Customer must not submit Special Category Data or the other restricted data in Section 7.1 unless GoBrise has expressly agreed in writing. No safeguards specific to such data are applied, and Section 7.3 applies if it is submitted.

G. Frequency of transfer

Continuous, for the duration of the Customer's account.

H. Duration of processing

For the duration of the Customer's account, and thereafter only as provided in Section 15 and the retention periods in the Privacy Policy.

I. Sub-processors

The Sub-processor categories in Annex III, for the purposes described there and in Section 5.2.

J. Competent supervisory authority

Determined under Clause 13 of the EU SCCs. For UK transfers, the UK Information Commissioner's Office. For Swiss transfers, the Swiss Federal Data Protection and Information Commissioner.

Annex II: Technical and organisational measures

For the purposes of Article 32 GDPR and Annex II of the EU SCCs. This Annex describes the measures currently in place. It does not represent conformity with any certification, framework or standard; GoBrise holds no certification, as stated in Section 10.3.

1. Tenant isolation and access control

• Every conversation, message and knowledge base entry belongs to exactly one customer account.
• Row-level access rules scope every record to the company that owns it, and are enforced in the PostgreSQL database itself, not only in the application layer.
• Dashboard queries run with the signed-in user's own permissions, so a request not tied to a signed-in member of a company does not return that company's data.
• The public chat Widget reaches data only through narrowly scoped server functions and can only reach the single business associated with its widget key.
• Public Widget endpoints are rate limited per session.
• Retrieval for AI responses is restricted to the Customer's own knowledge base.
• Role-based permissions govern Team Member access within a workspace, and users cannot change their own role.

2. Encryption and credentials

• Personal Data is encrypted in transit using TLS.
• Personal Data is encrypted at rest as provided by the managed cloud infrastructure.
• User passwords are stored as one-way hashes by our authentication provider and are never stored in recoverable form.
• Third-party API keys used by the Service are stored server-side only and are never exposed to browsers.

3. Access by GoBrise personnel

• Access to production systems and Personal Data is limited to a small number of authorised individuals whose role requires it, for the purposes in Section 11.1.
• Personnel and contractors are bound by written confidentiality obligations under Section 9.

4. Minimisation

• Aggregated or anonymised data is used instead of Personal Data where sufficient, including for product analytics under Section 20.6.
• Anonymised, aggregated or redacted data is used instead of direct access to Conversation Data where sufficient.
• The Customer controls what Personal Data its Widget collects, and AI replies are off by default for every new workspace.

5. Availability and continuity

• The Service runs on managed cloud infrastructure with the availability characteristics of that infrastructure.
• No uptime commitment, service level agreement, recovery time objective or recovery point objective is offered on any plan.

6. Security testing and monitoring

• Security and access-policy scans of database configuration are run and reviewed before changes are published.
• Known vulnerabilities in third-party software dependencies are reviewed and patched.
• Error monitoring and logging are used to detect faults.
• Suspected vulnerabilities can be reported to security@gobrise.com and are triaged by the GoBrise team.
• Security Incidents are handled under Section 14.

7. Development

• Changes to the Service are made by authorised personnel using version-controlled source code.

8. Physical security

• GoBrise does not operate its own data centres. Physical security of hosting facilities is provided by the managed cloud infrastructure provider under its own controls.

9. Sub-processor governance

• Sub-processors are engaged under Section 12.4, described by category in Annex III, and confirmed by name in writing on request.

10. Deletion

• The Customer can delete Personal Data from the Service at any time; deletion is irreversible.
• Deletion follows the periods in the Privacy Policy, and completion is confirmed in writing on request under Section 15.8.

11. Measures not currently in place

For the avoidance of doubt: SOC 2, ISO 27001 or any other certification or third-party attestation; single sign-on and SAML; customer-facing audit logs; configurable automated retention; self-serve data export; regional data residency; HIPAA compliance or Business Associate Agreements; and advanced or customer-configurable security controls.

Annex III: Sub-processor categories

Sub-processors are described by function because providers may change as the Service evolves. Current identities are confirmed in writing on request under Section 12.3.

Location. Sub-processors under items 1 and 2 process Personal Data on infrastructure in the United States. Sub-processors may process Personal Data in other countries, subject to Section 16.

Changes. Additions and replacements are notified under Section 12.5 and may be objected to under Section 12.6.