DPA
DATA PROCESSING AGREEMENT PURSUANT TO ART. 28 GDPR
between
retaiyn OG
Johannesgasse 23/5
1010 Vienna, Austria
Company register number: FN 685502 t
VAT ID (UID): ATU83768905
Email: Berat@retaiyn.com
hereinafter “Processor” or “retaiyn”
and
hereinafter “Controller” or “Client”
together the “Parties”.
1. Subject Matter and Scope
This agreement governs the processing of personal data by retaiyn on behalf of the Client in the course of the agreed services.
The processing may include in particular the following activities: strategic consulting on customer experience and support, setup and configuration of customer support systems, setup and optimization of AI agents, configuration of email, WhatsApp, and support automations, setup and maintenance of workflows, data migration and synchronization, quality control and monitoring, preparation of reports and optimization proposals, operational support during setup and, where applicable, operational handling of individual customer inquiries, if expressly agreed.
This agreement applies only to the extent that retaiyn processes personal data on behalf of the Client.
2. Roles of the Parties
The Client remains the controller within the meaning of the General Data Protection Regulation. retaiyn processes personal data as a processor exclusively on behalf of and in accordance with the documented instructions of the Client.
The Client is in particular responsible for: defining the purposes of processing, selecting the legal bases, fulfilling information obligations toward data subjects, obtaining required consents, the lawfulness of its marketing and support processes, the accuracy of the instructions given, and the lawful use of the third-party providers used.
retaiyn does not provide individual legal advice and does not automatically review the data protection compliance of the Client’s business processes, content, or marketing activities.
3. Subject Matter, Duration, and Purpose of Processing
Processing takes place for the term of the respective main agreement and only for the purposes agreed in the offer, service order, or project plan. The specific processing is described in Annex 1.
Processing for retaiyn’s own purposes is not covered by this agreement.
4. The Client’s Right to Issue Instructions
retaiyn processes personal data only on documented instructions from the Client. Instructions may be given in particular in the service order, by email, via an agreed ticket system, via an agreed project channel, or in project instructions documented in writing.
retaiyn informs the Client if, in its own assessment, an instruction violates data protection law. retaiyn is entitled to refuse to carry out an obviously unlawful instruction.
If retaiyn is required to carry out processing due to legal obligations, retaiyn informs the Client before the processing, to the extent permitted by law.
5. Confidentiality
retaiyn obliges all persons who receive access to personal data in the course of providing the services to maintain confidentiality. This confidentiality obligation continues after the end of the contractual relationship and after the end of their work for retaiyn.
6. Technical and Organizational Measures
retaiyn implements appropriate technical and organizational measures to protect personal data, taking into account the state of the art, the scope of processing, and the risk.
The measures currently in place include in particular: personal user accounts, no shared user accounts, role-based access control, access on a need-to-know basis, use of a password manager, two-factor authentication for Google Workspace, two-factor authentication for other systems where enabled and technically available, encryption of work devices, revocation of access rights when employees leave, regular review of existing access rights, limiting processing to necessary systems, no use of real customer data in test and development environments, backups of important business data where relevant and available, secure transmission over encrypted connections, deletion of data once the agreed purpose no longer applies or upon corresponding Client instruction, and a confidentiality obligation for all persons working with customer data.
retaiyn undertakes not to knowingly fall below the agreed level of security.
7. Processing in AI Systems
As a rule, retaiyn does not enter personal customer data into Claude, ChatGPT, or Aside. These systems are used for internal work purposes. Personal customer data is processed in these systems only if this has been expressly agreed, reviewed under data protection law, and documented in the corresponding tool list.
8. Read.ai and Meeting Recordings
Read.ai may be used for certain online meetings for recording, transcription, and summarization.
It is used only if its use has been announced to the meeting participants concerned, its use is planned or agreed for the respective project, and there is no contrary instruction from the Client or an affected participant.
The Client may instruct that a meeting not be recorded or that existing recordings and transcripts be deleted. retaiyn implements such instructions in the systems it controls and, where necessary, arranges for deletion with the provider used.
Recordings, transcripts, and summaries are stored only for as long as they are required for the agreed project or documentation purpose or as instructed by the Client. Technical deletion periods and statutory retention obligations remain unaffected.
9. Support with Data Subject Rights
retaiyn supports the Client to a reasonable extent in handling requests from data subjects. This applies in particular to access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent.
Requests from data subjects received by the processor are forwarded to the Client without undue delay, unless retaiyn is legally required to handle them itself.
10. Support with Security Incidents
retaiyn informs the Client without undue delay as soon as retaiyn becomes aware of a personal data breach affecting the Client’s data.
The notification contains, where known: the nature of the incident, the categories of data affected, the possible number of data subjects affected, possible consequences, and measures already taken or planned.
retaiyn takes appropriate measures to secure and contain the incident and to prevent further damage.
11. Sub-processors and Third-Party Providers
The Client approves the use of the service providers listed in Annex 3, to the extent they process personal data in the course of providing the services.
retaiyn may engage additional sub-processors if the Client is informed in advance in text form, the service provider is contractually bound to an adequate level of data protection, the requirements of Art. 44 to 49 GDPR are met, and the Client is given the opportunity to object on data protection grounds.
Where the Client itself is the contracting party of a third-party provider, that provider’s privacy information, terms of use, and, where applicable, data processing agreement apply directly between the Client and that provider. The agreements between the Client and the respective third-party providers do not replace this agreement between retaiyn and the Client.
12. Platforms Engaged by the Client
The following platforms in particular may be used for client projects: Chatarmin, Klaviyo, ArminCX, Shopify, Gorgias, and other CRM, shop, or support systems selected by the Client.
As a rule, the Client enters into agreements with these platforms independently. retaiyn supports the Client with setup, configuration, and use to the agreed extent. To the extent that retaiyn accesses or processes personal data in doing so, retaiyn’s obligations under this agreement still apply.
The respective terms of use, privacy information, and data processing agreements of the platform providers apply in addition.
13. Transfers to Third Countries
Personal data is transferred to third countries only if the requirements of Art. 44 to 49 GDPR are met. The transfer mechanism used in each case is documented in Annex 3.
14. The Client’s Audit Rights
The Client may request reasonable evidence of compliance with data protection obligations. Inspections or audits must be announced with reasonable notice, take place during normal business hours, must not unreasonably disrupt retaiyn’s business operations, and must not disclose data of other clients or trade secrets.
15. Return and Deletion
After termination of the main agreement, retaiyn returns or deletes personal data at the Client’s choice, unless there is a statutory retention obligation. Data in backups is deleted as part of the usual technical deletion and overwrite cycles. Upon request, retaiyn confirms the deletion in text form.
16. retaiyn’s Own Processing
This DPA applies exclusively to processing on behalf of the Client. It does not cover processing that retaiyn carries out for its own purposes, in particular its own client and lead management, accounting, statutory retention, its own IT security, abuse prevention, its own marketing, and anonymized internal analyses.
Each of these processing activities is assessed according to its own role under data protection law.
17. Liability
The Client is responsible for the lawfulness of its instructions and its data processing operations. retaiyn is liable for its own breaches of duty in accordance with mandatory statutory provisions.
In addition: retaiyn is not liable to the Client for damages resulting from incorrect outputs of AI systems, to the extent these are based on personal data that was already stored or provided incorrectly independently of retaiyn.
Statutory liability toward data subjects under Art. 82 GDPR remains unaffected and cannot be effectively excluded between the Parties.
No complete exclusion of data protection liability is agreed. Permissible limitations of liability may be set out in the main agreement or in the Terms and Conditions, to the extent permitted by law.
18. Term and Final Provisions
This agreement begins with the main agreement and generally ends when it ends. If retaiyn must store personal data for longer due to legal obligations, this agreement remains in force for the duration of that storage.
Austrian law applies. For disputes with businesses, the court with subject-matter jurisdiction in Vienna is agreed, to the extent permitted.
Annex 1 to the DPA: Description of Processing
Subject matter of processing: customer experience consulting, setup, configuration, monitoring, and optimization of support, CRM, messaging, and AI systems.
Purposes of processing: handling and categorizing customer inquiries, creating reply suggestions, setting up and running approved workflows, synchronization between shop, CRM, and helpdesk, quality control, monitoring, reporting, handover to human agents, and optimization of existing automations.
Categories of personal data: name, email address, phone number, customer number, order and delivery data, support communication, contract and service data, technical metadata, content from customer inquiries and, where applicable, audio, video, and transcription data from meetings.
Special categories of personal data are processed only if expressly instructed and legally reviewed.
Categories of data subjects: the Client’s customers, prospects, newsletter and messaging recipients, persons submitting support requests, the Client’s employees and contact persons, and recipients of communication activities.
Annex 2 to the DPA: Technical and Organizational Measures
retaiyn uses in particular the following measures: individual user accounts, password manager, Google Workspace MFA, MFA for other systems where enabled and available, device encryption, access restriction by role and task, regular permission reviews, revocation of access upon departure, encrypted data transmission, processing of customer data only in necessary systems, no real customer data in test environments, backups of important data where relevant and available, deletion once the purpose no longer applies or upon Client instruction, confidentiality obligations, and internal reporting and handling of security incidents.
Annex 3 to the DPA: Service Providers and Platforms
Systems used by retaiyn: Google Workspace / Gmail (email, documents, and communication), Slack (project communication), Notion (project documentation), Google Meet (video conferencing), Read.ai (recording, transcription, and summarization), and Calendly (appointment booking).
Platforms engaged by the Client: Chatarmin (WhatsApp marketing and automations), Klaviyo (email marketing), and ArminCX (AI customer support and agents) generally run under a direct agreement between the provider and the Client. Shopify, Gorgias, or other systems (shop, helpdesk, or CRM) are used depending on the client project.
The specific list must be updated for each client project.