Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms & conditions between Katalyst ("Processor", "we") and the customer using Katalyst ("Customer", "you"). It applies whenever we process personal data on your behalf, mainly the conversations your website visitors have with your chatbots and the leads they share.

1. Definitions

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the Swiss Federal Act on Data Protection (FADP) and the EU/UK GDPR ("Data Protection Law"). "Sub-processor" means any third party we engage to process Customer personal data.

2. Roles and instructions

You are the controller of the personal data processed through your chatbots, and we are your processor. We process it only on your documented instructions, which are these Terms, this DPA and how you configure Katalyst. If we believe an instruction breaks Data Protection Law, we will tell you.

You are responsible for having a lawful basis for the processing, for informing your visitors (for example in your own privacy notice), and for the content you add as knowledge.

3. Confidentiality

Everyone at Katalyst who can access Customer personal data is bound by confidentiality. Our staff open a workspace only to provide support you ask for, through a recorded support session.

4. Sub-processors

You authorise us to use the sub-processors below. We impose data protection obligations on each of them that are no less protective than this DPA, and we remain responsible for them.

• OpenAI: generating replies and the search index for knowledge.
• Cloudflare (through our file storage service): private storage of uploaded knowledge files.
• Our hosting provider: application and database hosting.
• Resend: sending lead notifications and account e-mails.
• Stripe: payments (account holders' billing data only).

We will tell you at least 30 days before adding or replacing a sub-processor. You may object on reasonable data protection grounds; if we cannot resolve the objection, you may end the affected service.

5. Security

We keep appropriate technical and organisational measures in place, as described in Annex 2, and review them regularly.

6. International transfers

Where personal data is transferred to a country without an adequate level of protection, we rely on the EU Standard Contractual Clauses, together with the Swiss and UK amendments where they apply, or on another lawful transfer mechanism.

7. Helping you with your obligations

Taking into account the nature of the processing, we help you respond to requests from data subjects, for example by letting you find, export and delete conversations in your workspace. If a data subject contacts us directly about your chatbot, we pass the request on to you. We also give reasonable help with data protection impact assessments and consultations with authorities.

8. Personal data breaches

We will tell you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your personal data. We will share what we know, and keep you updated, so you can meet your own notification duties.

9. Audits

We will make available the information reasonably needed to show compliance with this DPA. Where that is not enough, you may request an audit once a year, with at least 30 days' notice, at your own cost, during business hours and under confidentiality.

10. Deleting or returning data

When your subscription ends, you can export your data until the end of the period. We then delete Customer personal data within 90 days, unless the law requires us to keep it.

11. Order of precedence

If this DPA conflicts with the Terms, this DPA wins on matters of data protection.

Annex 1: Details of the processing

• Nature and purpose: hosting chatbots, answering visitor messages with AI, storing conversations, capturing and delivering leads.
• Duration: for the term of the subscription, and until deletion as described in section 10.
• Data subjects: visitors of your website who use your chatbot; your users and team members.
• Categories of personal data: conversation messages; contact details visitors choose to share (such as name, e-mail and phone number); other details your chatbot asks for; random visitor IDs, IP addresses and technical logs.
• Sensitive data: none intended. Do not set up a chatbot to collect special categories of data (such as health data) unless you have a lawful basis and have told us in writing.
• Retention: conversations are kept for your plan's retention period and then deleted automatically.

Annex 2: Security measures

• Encryption of data in transit (HTTPS/TLS) and encrypted storage of secrets such as integration keys.
• Knowledge files stored privately, opened only through short-lived links.
• Strict separation of customer workspaces; access limited to members with a role.
• Staff access only through recorded, time-limited support sessions; actions written to an audit log.
• Rate limiting and abuse protection on public chat endpoints; allowed-domain checks for chat widgets.
• Error monitoring and a process for handling incidents.

Contact

Katalyst
(address of Katalyst)
our support team