Data Processing Agreement

Last updated: 27 July 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Radu Coman, autónomo, NIE Z0079428Z, Calle Avellano 24, 38206 San Cristóbal de La Laguna, Santa Cruz de Tenerife, Spain ("Processor", "we") and the customer accepting the Terms ("Controller", "you"). It applies whenever we process personal data of your website visitors ("End Users") on your behalf through the AskMyWebsite AI service (the "Service"), and reflects the requirements of Art. 28 GDPR.

1. Roles and scope

You are the controller of End User personal data processed through the widget on your websites; we act as your processor. For your own account and billing data, we are an independent controller as described in the Privacy Policy, and that processing is outside the scope of this DPA.

2. Details of processing (Annex I)

Subject matter	Provision of an AI assistant embedded in the Controller's websites
Duration	The term of the Controller's subscription, plus the deletion period in Section 9
Nature and purpose	Receiving End User questions, generating AI answers based on the Controller's configuration, storing conversation history, enforcing quotas, producing aggregate usage statistics and insight reports for the Controller
Categories of data subjects	Visitors of the Controller's websites who interact with the widget
Categories of personal data	Free-text questions submitted by End Users (which may incidentally contain personal data), page URL path and page title, the visible content of the page being viewed at the moment a question is asked (which may incidentally include personal data displayed on that page, such as account details on logged-in pages; values typed into form fields are not captured), a short trail of the End User's most recent interactions on the website (up to 15 events: page paths visited and the visible labels of elements clicked or forms submitted; form field values are never captured), the outcome of an assistant guidance step (whether the highlighted element was used, the guidance was dismissed or expired, or the target element was missing) with the page path and the visible label of the highlighted element, and, per visit, whether the assistant was displayed and whether it was opened (counted using the per-tab session identifier, without any page address), AI-generated answers, timestamps, and a per-tab session identifier generated in the End User's browser that groups the questions of one visit into a single conversation. The Service does not collect End User names, contact details, IP addresses, cookies or cross-site tracking identifiers.
Special categories	None intended. The Controller must not configure or encourage the submission of special-category data.

3. Instructions

We process End User data only on your documented instructions, which consist of the Terms, this DPA and your configuration of the Service, unless required otherwise by EU or member state law (in which case we will inform you unless that law prohibits it). We will inform you if, in our opinion, an instruction infringes data protection law.

4. Confidentiality

We ensure that persons authorized to process the data are bound by confidentiality obligations.

5. Security (Annex II — technical and organizational measures)

Encryption of all data in transit; the widget API accepts requests only from the origins the Controller has registered.
Credentials are never stored in recoverable form: passwords, API keys and single-use tokens are kept only as cryptographic hashes, using algorithms appropriate to each purpose.
Hosting in an EU data center (Barcelona, Spain) on access-controlled infrastructure.
Role-based access: administrative functions are restricted to authenticated accounts, and administrative actions are logged.
Regular encrypted backups with automatic rotation.
Data minimization by design: no End User IP addresses, cookies or tracking identifiers are collected by the widget.

Further detail on these measures is available to customers on request under Section 10.

6. Sub-processors (Annex III)

You give general authorization to the following sub-processors:

Sub-processor	Purpose	Location / safeguard
Clouding.io	Hosting of application and database	Spain (Barcelona), EU
Google LLC	AI answer generation (Gemini models)	USA — EU-U.S. Data Privacy Framework / SCCs

Sub-processors are bound by data protection obligations no less protective than this DPA. AI sub-processors do not use submitted content to train their models under our commercial API terms. We will notify account holders (by email or in the dashboard) at least 30 days before adding or replacing a sub-processor; you may object on reasonable data protection grounds, and if we cannot accommodate the objection you may terminate the affected subscription with a pro-rata refund of prepaid unused fees.

7. International transfers

Data is hosted in the EU. Transfers to sub-processors in the United States rely on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses, as indicated above.

8. Assistance

Data subject rights: taking into account the nature of the processing, we will assist you with appropriate technical and organizational measures to respond to End User requests (access, erasure, etc.). Requests received directly by us will be forwarded to you without undue delay.
Breach notification: we will notify you without undue delay after becoming aware of a personal data breach affecting End User data, providing the information reasonably required for your Art. 33–34 obligations.
DPIAs: we will provide reasonable assistance with data protection impact assessments and prior consultations relating to the Service.

9. Deletion and return

End User data is deleted automatically 90 days after it is recorded, whether or not you ask us to. During the subscription you may also ask us in writing, at support@askmywebsiteai.com, to delete the conversation history of a site sooner, and we will do so without undue delay.

Upon termination of the subscription we will, at your choice, return End User data to you in a structured, commonly used format or delete it, within 90 days of your written request, unless EU or member state law requires longer storage. Returns are prepared manually on request; there is no self-service export in the dashboard. Residual copies in encrypted backups are removed by the normal rotation cycle.

10. Audits

We will make available the information reasonably necessary to demonstrate compliance with Art. 28 GDPR, including summaries of security measures and sub-processor terms. Where this is insufficient, you may conduct (at your cost, at most once per year, with 30 days' notice, without disrupting operations) an audit limited in scope to the processing under this DPA, or mandate a mutually agreed independent auditor.

11. Liability and precedence

Liability under this DPA is subject to the limitations of liability in the Terms, except where mandatory data protection law provides otherwise. In case of conflict between this DPA and the Terms regarding personal data processing, this DPA prevails.