Data Processing Agreement

1. Parties and scope

1.1This Data Processing Agreement (“DPA”) is between you, the business using Otis (the controller), and Boon IT SRL, a company registered in Romania under CUI 45987107, with its registered office in Cluj-Napoca, Romania, trading as Otisbase (the processor).

1.2It applies to personal data in your Business Records that Otisbase processes on your behalf (“Customer Personal Data”), such as the names, email addresses, billing addresses and tax identifiers of your clients and contacts, and the email addresses of people you invite.

1.3It forms part of the Terms of Service and is accepted with them. If the DPA and the Terms conflict on the processing of personal data, the DPA prevails. Terms defined in the Terms of Service and the GDPR have the same meaning here.

1.4Data Otisbase processes for its own purposes, such as your account email, sign-in and security data, is covered by the Privacy Policy, with Otisbase as controller.

2. Details of the processing

2.1Subject matter and nature: storing, checking, returning and exporting Business Records through the Otis MCP server, as requested by the assistant you connect.

2.2Purpose: providing the Service under the Terms.

2.3Duration: for as long as you use the Service, then until deletion under section 9.

2.4Categories of data subjects: your clients and their contacts, your suppliers where you record them, and the people you invite to your business.

2.5Types of personal data: names, email addresses, billing and postal addresses, country and region, tax identifiers and evidence, and the contents of invoices, payments and other records that name them. The Service is not designed for special categories of personal data, and you should not record them.

3. Instructions

3.1Otisbase processes Customer Personal Data only on your documented instructions. Your instructions are the Agreement and the requests your connected assistant makes to the Service on your behalf.

3.2Otisbase will tell you if, in its opinion, an instruction infringes data protection law, unless the law prohibits that.

3.3Otisbase does not sell Customer Personal Data, use it for its own purposes, or use it to train any AI model.

4. Confidentiality

4.1Otisbase ensures that anyone it authorises to process Customer Personal Data is bound by confidentiality, and that access is limited to providing support you ask for, keeping the Service secure, or complying with the law.

5. Security

5.1Otisbase implements appropriate technical and organisational measures under Article 32 GDPR, including those described in the Privacy Policy: encryption in transit, storage encrypted at rest, storage in the European Union, a separate storage unit for each business, roles checked on every request, sign-in by one-time email code with OAuth and PKCE, and security notices to account owners.

6. Sub-processors

6.1You give Otisbase general authorisation to engage sub-processors. The current sub-processors are:

• Cloudflare, Inc.: hosting and storage, with Business Records stored in Cloudflare’s European Union jurisdiction, and sending email;
• Google LLC (Google Workspace): mailboxes, only where Customer Personal Data is included in an email you or your assistant send to us.

6.2Otisbase will tell you by email at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve it, you may stop using the Service and have your data deleted under section 9.

6.3Otisbase imposes data protection obligations on each sub-processor no less protective than this DPA, and remains responsible to you for their performance.

7. Assistance

7.1The Service lets you read, correct and export Customer Personal Data through your assistant, which helps you respond to requests from data subjects. If Otisbase receives such a request directly, it will refer the person to you and help you respond.

7.2Otisbase will give you reasonable help, taking into account the nature of the processing, with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR.

8. Personal data breaches

8.1Otisbase will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, at the email address you verified, with the information you reasonably need to meet your own obligations.

9. Deletion and return

9.1You can export all your Business Records and their history at any time with the export tool.

9.2When you stop using the Service, or at any time, you can ask for deletion by writing to privacy@otisbase.com. Otisbase will delete Customer Personal Data within 30 days, unless the law requires it to keep some of it.

9.3If Otisbase discontinues the Service, it will give at least 90 days’ notice by email, during which export remains available.

10. Information and audits

10.1Otisbase will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits by you or an auditor you mandate.

10.2Audits require at least 30 days’ written notice, take place at most once a year unless required by a supervisory authority or after a breach, are at your cost, and are subject to confidentiality. Otisbase may first answer with documentation and written responses.

11. International transfers

11.1Business Records are stored and processed in the European Union. Where Customer Personal Data is transferred outside the EEA, including by a sub-processor, the transfer relies on the European Commission’s Standard Contractual Clauses or another lawful safeguard.

12. Liability and term

12.1Each party’s liability under this DPA is subject to the limitations in the Terms of Service, except where the law does not allow it.

12.2This DPA lasts as long as Otisbase processes Customer Personal Data for you. It is governed by the laws of Romania.

13. Contact

13.1Questions about this DPA go to privacy@otisbase.com.