OpsBots — data processing agreement

Self-drafted by CHK GmbH; not reviewed by a lawyer.

1. Parties, scope and duration

This agreement forms part of the OpsBots business contract. The client identified in the order is the controller and CHK GmbH, identified in the imprint, is its processor for customer content. If the client is itself a processor, it must have the controller's authority to appoint CHK as a sub-processor and pass on its instructions. This agreement applies for the service period and while CHK retains personal data on the client's behalf. It addresses Article 9 of the Swiss Data Protection Act and, where applicable, Article 28 GDPR; it is not a certification.

CHK's separate account, billing and security processing is described in the privacy notice. Such separate purposes do not authorise CHK to repurpose customer conversations.

2. Processing description and instructions

The purpose is to provide the selected knowledge-search, AI-answering and customer-service functions. Operations include receiving, storing, extracting, indexing, searching, generating answers and drafts, displaying records to authorised users, handing requests to staff, exporting and deleting. Processing is ongoing while the selected functions are enabled. Connected mailboxes involve relevant messages and metadata, not a licence to use all mailbox content for unrelated purposes. Once WhatsApp is offered, a connected WhatsApp number involves the messages, profile names, phone numbers, identifiers and delivery states listed in the privacy notice; Meta delivers them as the client's own processor under the client's agreement with Meta, not as CHK's sub-processor.

Data may include contact and business details, document text, correspondence, questions, answers, feedback, consent evidence, lead records, identifiers and technical metadata. Data subjects may be the client's staff, customers, prospects, suppliers and other people mentioned in the submitted material. Scope is set by the order, connected sources and documented configuration. Sensitive or professionally confidential data is excluded unless separately assessed and expressly agreed with suitable safeguards. For a mailbox, the client gives that express agreement by confirming the second form of statement S4 in OpsBots (a mailbox used for sensitive data or for matters under professional secrecy), on the conditions in section 7 of the e-mail data-protection impact assessment. CHK GmbH and its staff then act as the client's auxiliary persons and keep these matters confidential (Art. 62 FADP; Art. 321 Swiss Criminal Code).

The contract, authorised configuration and written support instructions are documented instructions. CHK processes data only on these instructions, including transfers, unless applicable law requires otherwise. CHK informs the client of such a requirement before processing unless legally prohibited. CHK alerts the client if an instruction appears unlawful and pauses the disputed processing until resolved. Customer content is not licensed for general model training or advertising.

The client supplies lawful data, necessary notices and permissions, sets access roles, and keeps instructions accurate. The client may issue further lawful instructions through support@opsbots.ch. Material changes to the service may require a separate agreement, but legal assistance duties cannot simply be refused for lack of a new order.

3. Confidentiality and safeguards

CHK limits access to authorised people who need it and are bound by confidentiality or a statutory duty. Access is currently limited to CHK's managing director; any other person or contractor CHK gives access to signs a written confidentiality undertaking first. The software provides these safeguards:

• Tenant-scoped database access uses forced row-level security and application roles without general bypass permission. Narrow privileged operations remain controlled; this is not physical separation of each customer's database.
• Workspace connection secrets and authenticator secrets use authenticated envelope encryption. Passwords and recovery tokens are hashed. This does not claim end-to-end encryption of documents or conversations.
• Account access requires two-step authentication; sessions expire and can be revoked. Roles restrict administrative actions.
• Sensitive operations are recorded in an audit trail that ordinary application access cannot rewrite or delete. Application logs allow only selected operational fields. This is not a claim that all infrastructure logs are anonymous.
• The widget separates visitor sessions, records submitted consent versions and applies access and usage controls. The client remains responsible for the purpose and wording of its notices.
• E-mail output is a draft for human review. Internal knowledge may inform those drafts, so the client must verify recipients and content before sending.

CHK maintains measures appropriate to risk and does not materially weaken the agreed protection. Before the first customer data is processed, CHK checks the production set-up for transport encryption, database and backup encryption, key custody, least-privilege access and a restore test, and keeps the evidence. No ISO, SOC or other certification is claimed.

4. Providers and changes

The client gives general authorisation for the processors named in the provider list, with the role, company, location and safeguard stated there. A service the list names as not yet available is not covered by this authorisation. CHK imposes equivalent data-protection duties by contract and remains responsible for its sub-processors' performance of those duties.

CHK gives at least 30 days' prior notice of a proposed addition or replacement that will process the client's data. The client may object on reasonable data-protection grounds within that period. The parties seek a workable alternative; if none is possible, the affected processing does not start and either party may terminate that part of the service, with unused prepaid fees for it returned within 30 days. CHK sends these notices by e-mail to the workspace owner and lists the change on the provider list; objections go to support@opsbots.ch.

A separately contracted mailbox or payment provider may be a processor for the client or a controller for its own purposes. Listing it does not change those roles or substitute for its contract.

5. Assistance and incidents

CHK forwards relevant data-subject requests promptly, does not answer them on the client's behalf without instructions unless legally required, and assists with access, correction, export, restriction and deletion using the information and means available. CHK assists with security duties, impact assessments and regulator consultation, considering the processing and information it holds.

CHK notifies the client without undue delay after learning of a personal-data breach affecting the client's data, with an initial notice no later than 48 hours after awareness. It does not wait for a complete investigation. Notices include known scope, affected data and people, likely consequences, steps taken and a contact; missing details follow as they become available. CHK cooperates in containment and evidence preservation. The client decides its own notifications to authorities and individuals; CHK retains its own legal duties. The incident contact is support@opsbots.ch.

6. Return, deletion and retention

On termination, at the client's choice, CHK returns the data in an agreed usable format and deletes remaining copies, or deletes it without return, unless applicable law requires retention. A legal hold is limited to the affected records, isolated from ordinary use and removed when its basis ends.

Closing a workspace stops its channels and sets the deletion date 30 days later, or keeps an earlier deletion date already set because the subscription had ended at Stripe; if the subscription ends at Stripe without the workspace being closed, the deletion date is 90 days after the end; a workspace that is never activated has a deletion date 14 days after it was created, and its owner is warned by e-mail at least three days before. Until then the client can export conversations and contacts as CSV files and ask CHK to return other customer data. Until automated deletion is available, CHK deletes the customer data manually within 30 days after the deletion date, records the deletion (without the deleted content) and confirms it on request. This paragraph does not permit indefinite retention.

Backups are kept for at most 30 days and then expire. After a restore, CHK re-applies every deletion made since the backup before the data is used again, so expired customer data does not re-enter active use. The hosting provider currently keeps database recovery copies for 3 days and manually created backups for 7 days. Providers' own copies follow the periods in the provider list; this includes the delivery records of OpsBots' own e-mails at Scaleway. CHK supplies a deletion confirmation on request. Default retention: conversations, leads and consent evidence 12 months after the last activity in the conversation; audit records 24 months. Until an automatic purge is available, CHK deletes expired records manually at least once a month and records each run.

7. Verification and audits

CHK makes the information needed to demonstrate these obligations available to the client. It allows and contributes to proportionate audits, including inspections by the client or an independent auditor bound to confidentiality. The parties coordinate timing and protect other clients' data. Urgent incident or regulatory checks are not delayed by a routine notice period. Evidence review may be the first step but does not replace a justified inspection. Any agreed charge must not defeat legally required verification. CHK answers assistance and audit requests sent to support@opsbots.ch within 10 working days, or sooner where a legal deadline requires it. Routine assistance and one document-based review a year are included in the fees. For on-site inspections or extensive assistance, CHK may charge reasonable costs, estimated in advance, unless the need arises from a breach by CHK or the law requires free assistance.

8. Transfers and precedence

The provider list names each processor's company, processing location and transfer safeguard. Customer data is stored mainly in Germany (Render, Frankfurt). The AI model provider, Anthropic (US), stores data in the United States and may run the model in other countries. Search and e-mail delivery run in France (Scaleway).

For transfers to a country without adequate data protection, CHK relies on its processors' data processing agreements: the Swiss-U.S. Data Privacy Framework where it applies, otherwise the EU standard contractual clauses with the adaptations for Switzerland. This agreement alone is not a set of international transfer clauses.

Mandatory transfer terms and statutory rights prevail over inconsistent service terms. The client can request evidence through the privacy contact. The GDPR obligations apply where that regulation applies; choosing Swiss contract law does not remove them. The business terms otherwise govern the contract.