Data processing agreement

1. Who's who

You are the business or professional who has a Bossiko account and owns one or more companies in it. For the personal data you put into your office, you are the controller: you decide what it's used for and how.

We are Basalt Works, who provide Bossiko. For that data we are the processor: we process it on your behalf and only to provide you with the service.

2. What data it covers

The personal data about other people that comes into your office for your team of AI employees to work with: your customers' and suppliers' emails, the documents you upload, contacts, jobs… However it comes in: you or someone on your team uploads or types it, it arrives at the office's email address or through Gmail, or the team reads it on the websites it opens in your browser with the extension.

Also those of whoever writes to your company's public assistant, if you turn it on: what they write in the chat on your website or your link, the contact details they leave with their consent and the appointments they book. The assistant only knows what you teach it and always introduces itself as your company's artificial intelligence assistant.

It doesn't cover the data of your own account (your email, your name, your picture, your payments) or the activity log we keep for the security of the service: for those we are the controller, and the privacy policy explains them. Privacy

3. What we do with it, what for and for how long

We store it in your office, and the AI employees read, search, organise and summarise it and create documents with it when you give them a job. For that, what each job needs is sent to the AI models and the other providers in section 8. We also make backups and, when it's time, delete it.

We process it only to provide you with the service: so your team does what you ask, to keep your office, to let you know when you're needed, to keep the service secure and to help you when you ask us. We don't use it for anything else: we don't sell it, we don't use it for advertising and we don't train AI models with it.

The only exception is the one the privacy policy describes: during the free trial of Essential we may review, internally, your business's sector and your first jobs to improve the product. That review is our decision, so for it we answer as controller, not as processor. Only we do it, we don't pass it on to anyone, and you can object by writing to contact@bossiko.com.

We process it while you have your account and your companies on Bossiko; what happens at the end is explained in section 12. Our duties of confidentiality and security continue for as long as we keep any of the data.

4. What data and whose

Whatever you decide to put into your office, which depends on your business. Usually:

• identification and contact details: names, emails, phone numbers and addresses;
• professional and business data: company and job title, orders, quotes, invoices, amounts and the bank details that appear on them;
• the content of communications: the emails that reach the office and the messages you exchange with your team, including on Telegram if you connect it;
• the documents, images and files you upload or the team creates, and what it reads on the websites it opens in your browser.

And it's about people like these:

• your customers and prospective customers;
• your suppliers and partners, and their contact people;
• your staff and job applicants;
• anyone who writes to your business or appears in the emails and documents you give the team;
• whoever talks to your company's public assistant, on your website or your social media;
• the people on your team you invite to your office.

Bossiko isn't designed for special categories of data (health, ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation, genetic or biometric data) or for data about criminal convictions or offences. If you put them in, it's up to you to have a legal basis for it and to judge whether the service is suitable.

5. What's up to you

As controller, you decide what data goes into your office and what for. It's up to you to:

• have a legal basis for processing each piece of data you put in (for example, a contract with your customer, their consent or your legitimate interest) and inform people, as the GDPR requires;
• put in only what you need for the jobs you give;
• give us instructions that comply with the law and review what the team prepares before using it: whatever leaves the office, you send or approve;
• look after who gets into your account and whom you invite to your office;
• if you turn on the public assistant, teach it only what you can tell anyone and link your privacy policy in it: before the first message it says it's your company's AI and links your privacy policy and ours;
• respond to people exercising their rights and, if your processing calls for it, carry out an impact assessment (we help you with both: section 10).

6. What we commit to

To process the data only on your documented instructions: those in this agreement and the terms, and those you give us by using the office (the jobs you give, the settings you choose, what you connect). If an instruction seems to us to breach the GDPR or another data protection rule, we'll tell you. If a law required us to process it differently, we'll let you know first, unless that same law forbids it.

To keep it confidential: only the people at Basalt Works who need it to provide the service have access to the data, and they're bound to confidentiality, also after they stop working with us. Apart from the free trial of Essential review, we only look at the content of an office when it's needed to help you because you ask us, to fix a fault or a security problem, or because the law requires it; each time it's opened from our admin panel, it's recorded in the activity log.

Not to use the data for any purpose of our own, apart from that review, or give it to anyone other than the sub-processors in section 8, unless the law requires it.

And also: to apply the security measures in section 7, help you with people's rights and impact assessments (section 10), tell you about security breaches (section 11), return and delete the data at the end (section 12) and give you the information to check that we comply (section 13).

7. Security measures

Taking into account the kind of data and its risks (Article 32 GDPR), we apply these measures. They're the ones in place today: we'll keep improving them, never in a way that leaves the data less protected.

• In the European Union: your office, its files and its backups are on Hetzner servers in Nuremberg (Germany).
• Each company kept apart: each one has its own folder and its own database, and every request checks that whoever makes it belongs to that company. Before each version of the service is released, an automated test tries to read and change one company's data from another through all its routes, and if it succeeds, that version isn't released.
• Encryption: connections always go over HTTPS. The backups are encrypted, and so, with a key of each office's own, is the most sensitive thing it keeps: the passwords in “Accounts and passwords” and the Gmail permission. Email arriving at the office waits, encrypted, at Amazon until the office collects it (a few seconds; 7 days at most).
• Backups: every hour, encrypted. The server keeps two days of hourly backups and a daily one for a week; another copy, also encrypted, is kept on a machine of our own in Spain for up to about 6 months. Every week, an automatic check confirms they can be restored.
• Access to the servers: only with a key and through an encrypted private network; from the internet, only the website answers. The service runs in an unprivileged container, with a read-only file system and no access to private networks. The backup machine reads the backups from the server, and the server can't get into it or delete them.
• Sessions and passwords: you sign in with Google, and of each session we only keep a fingerprint (hash), not the session itself. The AI employees use your business's passwords without ever seeing them, and only the company's owner can see them.
• Activity log: who signs in and from which IP address; what changes (companies, permissions, channels, integrations); each time an AI employee reaches outside the office (what it searches for, the websites it opens, whom it prepares a reply to), and each time someone at Bossiko opens an office's content from the admin panel. It doesn't keep messages or documents, and it's deleted after a year.
• What comes from outside: the content of websites, emails and documents is treated as untrusted, because it may carry hidden instructions. In those conversations, saving something permanently or using a password asks for your permission, and connections to the internet are checked so they don't take data out of the office. And nothing important leaves the office without your approval: the employees don't send emails or messages to other people on your behalf. The exception is the public assistant, if you turn it on: it answers whoever writes to it on your website with what you've taught it, without access to anything else in your office, and sends the confirmation of the appointments it books.
• Maintenance and monitoring: automatic security updates on the server, a check for known flaws in the libraries before each version is released, and monitoring from outside, every two minutes, that alerts us if something fails.

8. Sub-processors

You give us general authorisation to use these providers to provide you with the service. They're the same ones the privacy policy lists, and each only receives what it needs for its part:

• Hetzner Online GmbH (Germany)
  Hosts the office on servers in Nuremberg: your account, your companies, your files and their encrypted backups.
• OpenAI (United States)
  The AI models the team works with: it receives what each job needs (your messages, the company profile, the documents the employee reads and the pages it opens in your browser if you use the extension), when you dictate, the audio, and what your customers write to the public assistant.
• Vercel Inc. (United States)
  Hosts this website and, with its AI Gateway, passes to each provider's model the images that are generated or edited, voice dictation and, as a fallback, the other jobs.
• Google (United States)
  Sign-in (your email, your name and your picture) and, if you connect Gmail, reading the emails you receive.
• Amazon Web Services (Amazon SES) (United States)
  Sends your office's emails (the notices, the weekly report and the confirmation of the appointments your customers book with the assistant: the address and what they say) and, if you forward your email to the office's address, receives it in Ireland and keeps it until your office picks it up, a few seconds (7 days at most).
• Telegram (outside the EU)
  Only if you connect it: the notices and the messages you exchange with your team there.
• Polar Software, Inc. (United States)
  Payments and invoices: your billing and payment details. As the seller, it's also responsible for what it processes to charge and invoice you.
• Cloudflare, Inc. (United States)
  Only in the public assistant of the companies that turn it on: it checks with Turnstile that whoever starts writing to it isn't a robot (it gets technical data from their browser and their IP address).
• Brave Software, Inc. (Brave Search) (United States)
  The employees' search engine: receives the search terms they write, sent from our server.
• DuckDuckGo (United States)
  Only when Brave Search is not configured: receives the search terms the employees write, sent from our server.

We undertake that each one is bound by contract to protect the data with safeguards equivalent to those in this agreement, and we answer to you for what they do. Polar processes payment data as the seller and on its own account, not the data in your office.

If we add or replace a provider, we'll let you know by email or in your office at least 15 days beforehand, and update this list and the one in the privacy policy. If you have a reasonable data protection reason to object, write to us at contact@bossiko.com within that time: we'll look for a solution with you and, if there isn't one, you can cancel without penalty before the change applies.

9. Transfers outside the European Union

Your office, its files and its backups are in the European Union. Some providers on the list are in the United States or elsewhere outside the EU, and receive only what they need for their part. Those outside the European Union process the data with the safeguards the GDPR requires: the EU-US Data Privacy Framework, if the company is certified, or the European Commission's standard contractual clauses.

10. Help with people's rights and impact assessments

If someone asks to see, correct or delete their data, to object, to restrict its use or to take it away, it's up to you to answer them, and we give you the means: from your office you can search for what there is about a person, delete files, jobs and memory notes (deleted files go through the bin and are gone for good after 30 days) and download all the data of each company. Whatever you can't do yourself, write to us at contact@bossiko.com and we'll do it with you.

If a person contacts us about data we process on your behalf, we'll pass their request on to you without delay and won't answer them on your behalf, unless you ask us to.

We'll also give you the information we have and you need to meet your security obligations (Article 32 GDPR), to carry out an impact assessment (Article 35) and, if needed, to consult the supervisory authority (Article 36).

11. Security breaches

If we suffer a security breach affecting the personal data in your office (it's lost, someone accesses it or it's disclosed when it shouldn't be), we'll notify you without undue delay after becoming aware of it, at your account's email address.

We'll tell you what we know at that point, and the rest as we find out: what happened, what data and how many people it affects, its likely consequences, what we've done to contain it and what we propose, and whom to talk to. That way you can, if needed, notify the supervisory authority (in Spain, the Agencia Española de Protección de Datos) within the 72 hours the GDPR requires and tell the people affected. We'll help you with it.

12. When it ends

You can download each company's data from your account whenever you like: a zip with the whole office, its files and your account. The passwords in “Accounts and passwords” aren't included, for security: copy them from the office beforehand.

When you delete a company, it leaves Bossiko at once; for 30 days we can still recover it if you ask us, and after that it's erased for good. If you delete your account, its companies go the same way and your account's data is erased at once. Whatever remains in the backups, encrypted, is deleted on its own within about 6 months.

The activity log keeps what it records about your office (section 7) for a year, for security, even if you've deleted it. Beyond that, we'll only keep any data if a law requires us to, and only for as long as that obligation lasts.

The public assistant's conversations are deleted on their own 12 months after their last message, and its appointments 12 months after their date.

If you cancel your plan without deleting anything, your data stays in your account, in case you come back, until you delete it or ask us to. If we stop offering Bossiko, we'll give you at least 30 days' notice so you can download it, and then we'll delete it.

13. Audits and information

If you ask, we'll give you the information needed to show that we comply with this agreement and Article 28 GDPR: how we process the data, the security measures and the sub-processors.

If that isn't enough, you, or an independent auditor you appoint, can carry out an audit, including an inspection, and we'll cooperate with it. We'll agree it with you with reasonable notice (at least 30 days, except after a security breach or at an authority's request), under a confidentiality commitment, without access to other customers' data or putting the security of the service at risk, and at your expense. We'll also cooperate with the supervisory authority if it asks us.

14. Liability

Each party is responsible for meeting its own obligations under the GDPR and this agreement. If we used the data for other purposes or in a way other than this agreement says, we'd be considered the controller of that processing (Article 28(10) GDPR). We answer to you for what our sub-processors do as if we had done it ourselves.

Between you and us, the limitation of liability in the terms (section 12) applies, as far as the law allows. Nothing in this agreement limits the rights of the people affected, who can claim against whoever is responsible under Article 82 GDPR.

15. Duration, changes and governing law

This agreement lasts as long as your relationship with Bossiko under the terms, and its obligations continue for as long as we keep data from your office. If anything in the terms or the privacy policy contradicts this agreement regarding the data we process on your behalf, this agreement prevails.

We can change it like the terms: if the change is significant, we'll give you at least 30 days' notice and you can cancel beforehand if you don't agree. The date at the top shows which version is in force.

It's governed by Spanish law and the GDPR, and disagreements are resolved as the terms say (section 14). For any question, write to us at contact@bossiko.com.