Data Processing Agreement (DPA)

This data processing agreement (the "Agreement") is entered into between:

• the Customer, as defined in the ScanChat AI Terms of Service (the "Terms"), acting as controller (the "Controller");
• WeBoost, a sole proprietorship registered under number 321475519, publisher of the ScanChat AI service, acting as processor (the "Processor").

The Agreement sets out the conditions under which the Processor processes, on behalf of the Controller, the personal data of the visitors to the Customer's website collected by the chatbots (conversations and leads).

It does not apply to data relating to the Customer's account and billing, for which WeBoost acts as controller, as described in the Privacy Policy.

The Agreement forms an integral part of the Terms. It is accepted when the account is created or the order is placed, without any signature being required. A signed PDF version can be provided on request sent to info@scan-chat.ai.

In case of conflict between the Agreement and the Terms regarding personal data protection, the Agreement prevails.

The terms "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given to them by Regulation (EU) 2016/679 (the "GDPR").

"Applicable Law" means the GDPR and any other personal data protection legislation applicable to the processing. Other capitalised terms have the meaning given to them in the Terms.

The subject matter, nature and purpose of the processing, the categories of data and data subjects and the duration of the processing are described in Annex 1.

The processing takes place for as long as the Service is used, and then until the data is deleted under the conditions set out in section 14.

The Processor processes personal data only on the documented instructions of the Controller. Such instructions consist of: the Terms, this Agreement, the configuration made by the Customer in the Customer Area (chatbot settings, lead fields, consent, alert recipients, integrations) and any additional written instruction sent to info@scan-chat.ai.

The Processor immediately informs the Controller if, in its opinion, an instruction infringes Applicable Law.

If the Processor is required to carry out processing under the law to which it is subject, it informs the Controller before the processing, unless that law prohibits it.

The Processor does not use this data for its own purposes, does not sell it and does not use it to train artificial intelligence models.

The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Access to the data is limited to persons who need it to provide, maintain and secure the Service.

The Processor implements the appropriate technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR.

These measures may evolve with technical progress, provided that the overall level of security is not reduced.

The Controller gives the Processor a general authorisation to engage the sub-processors listed in Annex 3.

The Processor informs the Controller by email at least 30 days before adding or replacing a sub-processor. The Controller may object during that period on reasonable grounds relating to data protection. Failing a satisfactory solution, the Controller may cancel its subscription, at no cost or penalty, before the change takes effect; the Processor then refunds the share of the price paid in advance corresponding to the unused period.

The Processor imposes on each sub-processor, by contract, data protection obligations substantially equivalent to those of this Agreement, and remains liable to the Controller for the performance of their obligations.

Services that the Customer chooses and connects itself are not sub-processors of the Processor: in particular the artificial intelligence provider whose key the Customer uses (for example OpenAI, Google or Anthropic), as well as Zapier, Make, a CRM, a webhook or WordPress. These services act under contracts entered into directly by the Customer, which is responsible for them.

The Processor is established in Israel, a country covered by an adequacy decision of the European Commission (Decision 2011/61/EU, maintained following its review of 15 January 2024).

Where personal data is transferred to a sub-processor located outside the European Economic Area, the transfer relies on an adequacy decision, on the recipient's certification under the EU-U.S. Data Privacy Framework or on the standard contractual clauses adopted by the European Commission. The mechanism applicable to each sub-processor is indicated in Annex 3.

The Processor assists the Controller, through appropriate technical and organisational measures, in responding to requests to exercise data subject rights (access, rectification, erasure, restriction, portability, objection).

In particular, the Customer Area allows the Customer to view conversations and leads, delete them and export leads in CSV format. For any request it cannot handle itself, the Customer can write to info@scan-chat.ai.

If the Processor receives a request directly from a data subject, it forwards it to the Controller without undue delay and does not respond to it without the Controller's instruction.

The Processor notifies the Controller of any personal data breach without undue delay and no later than 48 hours after becoming aware of it.

The notification contains, to the extent available, the following information: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed to address it. Information that is not immediately available is provided later, in phases.

It is the Controller's responsibility to notify the supervisory authority and the data subjects, where required. The Processor assists it for that purpose.

Taking into account the nature of the processing and the information available to it, the Processor provides the Controller with the reasonable assistance needed to carry out a data protection impact assessment and, where applicable, the prior consultation of the supervisory authority.

The Controller undertakes to:

• have a legal basis for the processing entrusted to the Processor;
• inform the visitors to its website of the processing of their data, in particular in its privacy policy;
• obtain their consent where Applicable Law requires it; the consent option offered by the Service, enabled by default and described in section 15 of the Terms, is subject to the Controller's choice and configuration;
• not configure the chatbots to collect special categories of data, data relating to criminal offences or data concerning children, unless it has its own legal basis and appropriate safeguards, as the Service is neither designed nor certified for hosting health data;
• give instructions that comply with Applicable Law.

Throughout the subscription, the Customer can export its leads in CSV format from the Customer Area. On request sent to info@scan-chat.ai during the subscription or the 90-day period following its end, the Processor also provides the Customer with a copy of its conversations in a structured, commonly used format (CSV or JSON).

When the subscription ends, the data is kept for 90 days, so that the Customer can subscribe again or export its leads. An email warns the Customer 7 days before deletion. After that period, the data is permanently and automatically deleted. Backups are overwritten within 14 days.

The Customer can delete its chatbots, conversations and leads at any time from the Customer Area, or request early deletion of its data at info@scan-chat.ai.

These provisions apply subject to any retention obligations imposed on the Processor by law.

The Processor makes available to the Controller the information necessary to demonstrate compliance with its obligations, including this Agreement, the description of the security measures, the list of sub-processors and answers to reasonable questionnaires. The Controller relies on this documentation first.

If this documentation is not sufficient to demonstrate compliance with the Agreement, or if a supervisory authority requires it, the Controller may have an audit carried out, including on site, by itself or by an independent auditor bound by confidentiality and not a competitor of the Processor, under the following conditions:

• written notice of at least 30 days;
• no more than once per 12-month period, except in case of a data breach or a request from a supervisory authority;
• during business hours, without disrupting the operation of the Service or compromising the security or confidentiality of other customers' data;
• at the Controller's expense.

Each party's liability under this Agreement is subject to the exclusions and limitations of liability set out in the Terms, to the extent permitted by Applicable Law.

The Agreement applies for as long as the Processor processes personal data on behalf of the Controller.

The Agreement is written in French; in case of discrepancy with a translation, the French version prevails.

By way of derogation from section 29 of the Terms, the Agreement is governed by the law of the European Union Member State in which the Controller is established or, if the Controller is not established in the European Union, by French law. The provisions of the Terms relating to jurisdiction apply, without prejudice to the rights of data subjects and the powers of supervisory authorities.

• Subject matter: provision of the ScanChat AI service, which allows the Customer to answer the visitors to its website automatically using chatbots and to collect leads.
• Nature of the operations: collection through the widget installed on the Customer's website, recording, storage, structuring, consultation, transmission to artificial intelligence models to generate answers, extraction of lead information, generation of a summary of the conversation linked to each lead and automatic rating of that lead (hot, warm or cold), generation of analyses of visitors' questions, display of proactive messages according to the page viewed, sending to the Customer of email alerts, follow-up reminders and a monthly activity report, transmission to the tools connected by the Customer, export and deletion.
• Purposes: answering visitors' questions on behalf of the Customer; collecting leads and passing them on to the Customer; allowing the Customer to view conversations and statistics and to improve the answers.
• Data subjects: visitors to the Customer's website who interact with a chatbot, prospects whose contact details are collected and, where applicable, persons mentioned by visitors in their messages.
• Conversation data: content of visitors' messages and of the chatbot's answers, random session identifier generated in the visitor's browser, dates and times of the exchanges, any rating of the conversation (thumbs up or down).
• Lead data: information corresponding to the fields configured by the Customer (for example name, email address, phone number, company, need), consent status and its date where applicable, as well as the status and notes added by the Customer, and the automatically generated conversation summary and lead rating. This rating is a tool to assist the Customer: it has no legal effect on the visitor and is not a decision based solely on automated processing within the meaning of Article 22 GDPR.
• IP address: it is not recorded with conversations or leads; it is processed transiently for rate limiting and security purposes and may appear in the server's technical logs, which are kept for no more than 30 days.
• Special categories of data: none are expected; the Customer undertakes not to configure their collection (section 13).
• Duration: throughout the subscription, subject to deletions made by the Customer, then 90 days after the end of the subscription; backups overwritten within 14 days.
• Location: see Annex 3.

• Encryption in transit: HTTPS/TLS on all exchanges.
• Network security: the customer area and the API are protected by Cloudflare's proxy.
• Data isolation: Row Level Security enabled on the database tables; direct writes from the browser are locked, all changes going through the application server.
• Customers' API keys: the artificial intelligence keys provided by customers are encrypted at rest (Fernet).
• Passwords: handled by Supabase's authentication service and stored in hashed form; they are never known to the Processor in clear text.
• Administration console: mandatory two-factor authentication and audit log of actions.
• Rate limiting, in particular on authentication and chatbots.
• Protection against requests to internal addresses (SSRF) for webhooks.
• Server: firewall (ufw) and protection against repeated intrusion attempts (fail2ban).
• Backups: daily backups kept for 14 days, stored separately from the database provider, with an alert on failure and an automatic restore test every month.
• Minimisation: no IP address recorded with conversations and leads; no card data received or stored.
• Retention: automatic deletion of data 90 days after the end of the subscription.
• Access: access to production systems limited to the owner of the business.

• Hostinger: hosting of the application server (VPS), including the chatbots' knowledge index and the backups. Location: France (EU).
• Supabase (Supabase Inc.): database and authentication. Data location: France (Paris region, EU). Safeguard: hosting in the European Union; any access from third countries for support and maintenance is covered by standard contractual clauses.
• Cloudflare: network security and proxy (DNS, TLS) for the customer area and the API. Location: global network. Safeguard: Data Privacy Framework and standard contractual clauses.
• Google (Gemini API): generation of answers and computation of vector representations (embeddings) for "AI included" plans, as well as computation of embeddings where the AI provider chosen by the Customer does not offer them; for all Customers, including those using their own key: detection of visitors' language, analysis of visitors' questions (Statistics page) and summaries and rating (hot, warm or cold) of leads. Google is used under the terms of the paid Gemini API services, under which the data sent is not used to train its models. Location: United States and global infrastructure. Safeguard: Data Privacy Framework and standard contractual clauses.
• Brevo: sending of transactional emails, including new lead alerts. Location: France (EU).
• Firecrawl: reading the public pages of the Customer's website to build the chatbots' knowledge. Location: United States. Safeguard: standard contractual clauses.
• Cloudinary: storage of chatbot logos and images (images only). Location: United States. Safeguard: Data Privacy Framework and standard contractual clauses.

Where the Customer uses its own AI key (OpenAI, Google or Anthropic), the provider concerned is chosen and contracted by the Customer and acts under the contract entered into directly with it. The tools the Customer connects (Zapier, Make, CRM, webhooks) are its own processors or recipients.