Data processing agreement

Who operates the platform?

Controller / service provider

UAB „PROTURBO“

Company registration number

302719435

Address

Žirmūnų g. 135-40, LT-09120 Vilnius, Lithuania

Privacy contact

info@askvady.com

This data processing agreement applies between the customer (controller) and UAB PROTURBO (processor) when the platform processes visitor conversations and business knowledge on the customer's behalf. Its subject is support on the customer's designated websites, response generation, conversation history and technical support during the service and for agreed return or deletion afterwards.

Data subjects are website visitors, customers, employees and contacts lawfully included in company knowledge. Data includes conversation text, supplied contact details, business information, technical session identifiers and audio recordings only if separately enabled. The service is not designed for special-category data or profiling children; such needs require prior separate assessment.

The processor acts only on documented controller instructions, including transfers, unless legally required otherwise, in which case it informs the controller unless prohibited. It ensures authorized personnel confidentiality, proportionate security, separated customer access, administrator two-factor authentication and access accountability. It informs the controller if an instruction appears to infringe data protection law.

Subprocessors are identified in the approved provider list. Before a subprocessor change the controller must be informed and given an opportunity for a reasoned objection; the notification process must be agreed before changes. Equivalent data protection obligations apply to subprocessors, and the platform provider remains responsible for their performance. International transfers require an applicable lawful mechanism and disclosed safeguards.

Considering the nature of processing, the processor assists the controller with individual rights, security, breach assessment, impact assessments and required consultation. It informs the controller without undue delay of a breach affecting customer data and supplies available information. The controller assesses notifications to supervisory authorities and affected individuals under applicable law.

At service termination, at the controller's choice, data is returned or deleted, including controlled copies, except data legally required to be retained. Approved policy must set financial, backup and external-provider exceptions and final deadlines; deletion reports identify outstanding exceptions. The processor supplies information necessary to demonstrate its duties and permits reasonable audits while protecting other customers' data. This agreement does not remove the controller's duties concerning lawful basis, transparency and data minimization.

Retention and exceptions

Conversation expiry or sign-out does not erase history. The 24-hour chat access token is not a retention period.

Proposed periods (until approved and enabled): conversations – 90 days; historical training – 365 days; closed support requests – 365 days; security logs – 90 days.

Automatic cleanup is currently disabled.

Financial record exceptions and final deadlines must be confirmed before launch.

Backup retention and erasure handling must be confirmed before launch.

Approved subprocessors

The production provider list and contracts have not yet been approved.