Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is a standing agreement that forms part of, and is incorporated by reference into, the Dokko Terms of Service / Master Services Agreement (the “Principal Agreement”) between Mono d.o.o., IT park Osijek 1, 31000 Osijek, Croatia, OIB 99545162665 ("Processor" or “Dokko”) and each customer that accepts the Principal Agreement (the “Customer” or “Controller”). It applies automatically and identically to every Customer; no separate signature or per-Customer negotiation is required.

The Customer is identified by the legal entity, address, and contact details it provides during account registration. This DPA takes effect for a Customer on the Effective Date — the date the Customer first accepts the Principal Agreement or first uses the Service, whichever is earlier. It is concluded in electronic form, which satisfies the “in writing” requirement of Article 28(9) GDPR.

Background

(A) The Processor provides Dokko, a multi-tenant retrieval-augmented conversational AI service (the “Service”), under the Principal Agreement.

(B) In providing the Service, the Processor processes Personal Data on behalf of the Controller.

(C) This DPA sets out the terms governing that processing in accordance with Article 28 of the GDPR. Where the Principal Agreement and this DPA conflict on data protection matters, this DPA prevails.

1. Definitions

1.1 “GDPR” means Regulation (EU) 2016/679. “Applicable Data Protection Law” means the GDPR and any national implementing or supplementary laws applicable to the processing, including the ePrivacy Directive 2002/58/EC as implemented.

1.2 “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing”, “Personal Data Breach”, “Supervisory Authority” and “Special Categories of Personal Data” have the meanings in the GDPR.

1.3 “Controller Personal Data” means Personal Data processed by the Processor on behalf of the Controller under the Principal Agreement, as described in Annex 1.

1.4 “Sub-processor” means any processor engaged by the Processor to process Controller Personal Data.

1.5 “Transcripts” means the record of conversations exchanged between end users and the Service, including end-user messages, Service responses, timestamps, and associated session identifiers.

1.6 “Designated Region” means the AWS region in which the Controller’s data is hosted and processed, identified per the Controller’s tenant_id in Annex 1 — for this Controller, AWS Europe (Frankfurt), eu-central-1 ("EU-Central").

1.7 “Non-Personal-Data Service” means a service provider or infrastructure that processes only data which is not Personal Data, as described in Clause 8.3.

1.8 “Customer” (the Controller) means the entity that has accepted the Principal Agreement, identified by its account-registration details.

1.9 “Sub-processor List” means the list of Sub-processors published by the Processor at Annex 3a of this Agreement.

2. Roles of the Parties

2.1 For Controller Personal Data, the Controller is the controller and Dokko is the processor.

2.2 The Controller is responsible for establishing a lawful basis for the processing, providing required transparency information to Data Subjects (including end users of the Controller’s Dokko widget), and ensuring the lawfulness of the instructions it issues.

2.3 The Processor shall process Controller Personal Data only as a processor on behalf of the Controller and not for its own purposes.

3. Scope and Details of Processing

3.1 The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.

3.2 The Processor shall process Controller Personal Data only to provide and support the Service and as otherwise necessary to perform the Principal Agreement.

3.3 Client-side storage. The Service stores limited data on end-user devices: session identifiers and authentication tokens that are session-scoped by default (strictly necessary to deliver the requested chat), and — only where the end user expressly opts in — a persistent identifier enabling restoration of that user’s own conversation history on return visits. The Controller is responsible for compliance with Article 5(3) of the ePrivacy Directive (consent/transparency) in respect of such device storage. The Processor shall provide the technical means for (a) session-scoped-by-default storage and (b) an opt-in mechanism for persistence, and shall document the storage items for the Controller’s disclosures.

4. Processing on Documented Instructions

4.1 The Processor shall process Controller Personal Data only on the documented instructions of the Controller, including with regard to international transfers, unless required otherwise by EU or Member State law (in which case the Processor shall inform the Controller before processing, unless prohibited by law).

4.2 The Principal Agreement, this DPA (including its Annexes), and the configuration settings selected by the Controller in the Service (including the Designated Region, retention criteria, and training-exclusion settings) constitute the Controller’s complete and documented instructions.

4.3 The Processor shall promptly inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law.

5. Confidentiality

5.1 The Processor shall ensure that persons authorised to process Controller Personal Data are bound by an appropriate obligation of confidentiality and process the data only as instructed.

5.2 The Processor shall limit access to Controller Personal Data to personnel who need it to provide the Service.

6. Security (Article 32)

6.1 Taking into account the state of the art, costs of implementation, and the nature, scope, context and purposes of processing, the Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex 2.

6.2 Measures shall include, as appropriate, encryption in transit and at rest, pseudonymisation where appropriate, ongoing confidentiality/integrity/availability and resilience of systems, restoration of availability after an incident, and a process for regularly testing and evaluating effectiveness.

7. Sub-processors

7.1 The Customer provides general authorisation for the Processor to engage the Sub-processors on the Sub-processor List (a current snapshot of which is at Annex 3a), which includes Amazon Web Services EMEA SARL (“AWS”) as the hosting and AI-inference infrastructure sub-processor.

7.2 The Processor shall impose on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA, including the security measures in Annex 2, the Designated-Region residency requirement (Clause 8), and the training-exclusion requirement (Clause 11).

7.3 The Processor shall update the Sub-processor List and notify subscribed Customers of any intended addition or replacement of a Sub-processor at least 30 days in advance. A Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Customer may, as its sole remedy, terminate the affected part of the Service.

7.4 The Processor remains fully liable to the Controller for the performance of each Sub-processor’s obligations.

8. Data Residency and Location of Processing

8.1 Controller Personal Data — including Transcripts, knowledge-base content, embeddings, session identifiers, and authentication tokens — shall be hosted and processed exclusively within the Designated Region (EU-Central, eu-central-1).

8.2 AI inference (Amazon Bedrock foundation-model invocation) shall be performed within the Designated Region, such that prompts, retrieved context, and completions are not processed outside the EEA.

8.3 Non-Personal-Data Services outside the EEA. The Processor may use service providers or infrastructure located outside the EEA solely to process data that is not Personal Data (e.g., irreversibly anonymised or aggregated operational metrics, or business/technical data containing no information relating to an identified or identifiable natural person). The Processor warrants that no Controller Personal Data — including message content, IP addresses, session identifiers, the anonymous user identifier (sub), or any pseudonymous identifier — is transferred to, stored in, or accessible from any Non-Personal-Data Service. Pseudonymised data remains Personal Data and is not eligible for this clause.

8.4 The Processor shall apply data minimisation and, where necessary, filtering or scrubbing so that any telemetry, logging, error-tracking, or analytics routed to Non-Personal-Data Services contains no Personal Data.

8.5 Any transfer of Controller Personal Data outside the EEA requires (a) the Controller’s documented instruction and (b) a valid Article 46 mechanism (Standard Contractual Clauses) plus supplementary measures. Remote access to Controller Personal Data from outside the EEA counts as a transfer.

8.6 The Processor shall maintain and, on request, provide records of the locations of processing.

9. Assistance with Data Subject Rights; Delete-My-Conversation

9.1 Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller’s obligation to respond to Data Subject rights requests under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection).

9.2 If the Processor receives a request directly from a Data Subject, it shall not respond substantively but shall, without undue delay, forward it to the Controller.

9.3 Delete-my-conversation. The Processor shall provide the Controller with the means to delete Transcripts, both:

(a) per conversation / per Data Subject — via a self-service control in the Service and/or a documented API endpoint, enabling deletion of an individual conversation or all Transcripts associated with a given session/anonymous identifier; and

(b) in bulk — for all Transcripts of the Controller.

9.4 Upon a deletion request under Clause 9.3, the Processor shall delete the affected Transcripts from active production systems without undue delay and within 7 days, and from backups within the backup rotation cycle not exceeding 35 days, after which the data shall not be restorable. The Processor shall confirm completion on request.

9.5 The Service enables the Controller to expose the delete-my-conversation capability to its own end users; the Controller is responsible for how it surfaces this to Data Subjects.

10. Retention and Deletion of Transcripts

10.1 Retention policy (single, tenant-level, criteria-based). The Controller configures a single retention rule for Transcripts that applies uniformly to all Data Subjects of that Controller; there is no per-Data-Subject retention configuration. Retention is determined by criteria rather than a fixed period: Transcripts are retained until the earliest of (a) a valid erasure request under Clause 9; (b) 24 months of end-user inactivity (measured from the last interaction on the session/identity); or (c) operational or technical constraints requiring deletion of older data. The Controller documents these criteria and its lawful basis (Article 6(1)(f) legitimate interests, following a documented balancing test) and discloses the criteria in its privacy notice per Article 13(2)(a).

10.2 Reactive deletion. Independently of the retention criteria, the Processor deletes a Data Subject’s Transcripts upon a valid erasure request under Clause 9. This is an on-demand action, not a configured per-user policy, and overrides the retention criteria (subject to the exceptions in Article 17(3)).

10.3 No blanket forced deletion. Nothing herein requires deletion of all Data Subjects’ Transcripts on a fixed schedule. Deletion (or irreversible anonymisation) occurs on: (a) satisfaction of a retention criterion in 10.1; (b) a valid erasure request; or (c) termination under 10.5.

10.4 Device-side persistence. Where the Controller offers end users the opt-in to retain their own conversation history on their device (Clause 3.3), such client-side persistence is based on the Data Subject’s consent and is governed by the Controller’s ePrivacy disclosures, not by the server-side retention criteria in this Clause.

10.5 On termination or expiry of the Principal Agreement, the Processor shall, at the Controller’s choice, delete or return all Controller Personal Data and delete existing copies within 30 days, unless EU or Member State law requires storage, and shall certify deletion on request.

11. No Use of Controller Personal Data for AI Model Training

11.1 The Processor shall not use Controller Personal Data — including Transcripts, prompts, retrieved context, completions, or knowledge-base content — to train, fine-tune, retrain, evaluate, or otherwise develop or improve any machine-learning or foundation model, whether the Processor’s own, a Sub-processor’s, or a third party’s, except strictly as instructed by the Controller in writing for the Controller’s own benefit (e.g., tenant-specific configuration that does not expose data to any other customer or third party).

11.2 The Processor shall ensure, by contract, that its AI-inference Sub-processor (AWS / Amazon Bedrock) does not use Controller Personal Data to train or improve any foundation model and does not share it with any third-party model provider, and that prompts and completions are not logged or used for such purposes. The Processor shall not enable any model-provider data-sharing, model-improvement, or human-review feature that would expose Controller Personal Data, unless separately instructed by the Controller.

11.3 The Processor shall not use Controller Personal Data to build profiles, benchmarks, or datasets made available to, or derived for the benefit of, other customers or third parties. Aggregated, irreversibly anonymised operational metrics that do not constitute Personal Data are excluded from this restriction.

12. Personal Data Breach

12.1 The Processor shall notify the Controller without undue delay and in any event within 48 hours after becoming aware of a Personal Data Breach affecting Controller Personal Data.

12.2 The notification shall include, to the extent known, the nature of the breach, categories and approximate numbers of Data Subjects and records affected, likely consequences, and measures taken or proposed, with further information provided as it becomes available. The Processor shall assist the Controller in meeting its obligations under Articles 33–34 GDPR.

13. Data Protection Impact Assessments

13.1 The Processor shall provide reasonable assistance to the Controller with data protection impact assessments and prior consultations with Supervisory Authorities under Articles 35–36 GDPR, taking into account the nature of processing and information available to the Processor.

14. Audit and Compliance

14.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and this DPA.

14.2 The Processor shall allow for and contribute to audits, including inspections, by the Controller or a mandated auditor, no more than once per 12 months (or following a Personal Data Breach or Supervisory Authority direction), on 30 days’ notice, during business hours, subject to confidentiality. The Processor may satisfy audit requests via current third-party certifications/reports (e.g., ISO 27001, and AWS’s certifications for the underlying infrastructure).

15. International Transfers

15.1 The Parties acknowledge that, under Clause 8, no transfer of Controller Personal Data outside the EEA is intended. Should any such transfer become necessary, it shall occur only under Clause 8.5, and the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller-to-Processor), are incorporated by reference, with Annexes populated by Annex 1–3 of this DPA.

16. General

16.1 Term. This DPA takes effect on the Effective Date and continues while the Processor processes Controller Personal Data.

16.2 Liability is subject to the limitations in the Principal Agreement, except as required by Applicable Data Protection Law.

16.3 Governing law and jurisdiction follow the Principal Agreement, unless Applicable Data Protection Law requires otherwise.

16.4 Severability. If any provision is held invalid, the remainder continues in effect.

17. Changes to this DPA

17.1 The Processor may update this DPA from time to time. Material changes that adversely affect the Customer’s rights as controller will be notified at least 30 days in advance (via email and/or in the Service), and the updated DPA will carry a new version date. Continued use of the Service after an update’s effective date constitutes acceptance. Changes required by law or to reflect a new Sub-processor follow Clauses 7 and 15.

17.2 The current version of this DPA is published at https://dokko.ai/data-processing-agreement; prior versions are available on request.

Acceptance

This DPA is accepted electronically when the Customer accepts the Principal Agreement (by clicking to accept, creating an account, or using the Service). No handwritten signature is required, and the DPA is identical for all Customers. Where a Customer requires a countersigned copy for its own records, the Processor may provide one on request; absent that, electronic acceptance governs.

Processor: Dokko / Mono d.o.o., IT park Osijek 1, 31000 Osijek, Croatia. Privacy / DPO contact: dpo@mono.software.

Annex 1 — Details of Processing

Annex 2 — Technical and Organisational Measures (Article 32)

• Encryption: TLS 1.2+ in transit; encryption at rest for Transcripts, knowledge-base content, embeddings, and backups (AWS KMS; customer-managed keys where offered).
• Access control: role-based access, least privilege, unique credentials, MFA required for platform administrators.
• Tenant isolation: logical separation keyed by tenant_id; authorization enforced on every request (anonymous token scoped to tenant_id).
• Network security: segmentation, firewalls/security groups, restriction of public endpoints.
• Residency controls: infrastructure and inference pinned to the Designated Region; controls preventing cross-region processing of Personal Data.
• Resilience & recovery: backups within the Designated Region, documented restore procedures, backup rotation not exceeding 35 days.
• Secure development: change management, code review, dependency and vulnerability management, secrets management.
• Logging & monitoring: security event logging, alerting.
• Deletion: criteria-based purge and on-demand deletion propagating to backups (Clauses 9–10).
• Personnel: confidentiality obligations, security training.
• Certifications: ISO 27001; reliance on AWS certifications for underlying infrastructure.

Annex 3a — Sub-processors processing Controller Personal Data (EEA only)

Annex 3b — Service providers processing NO Personal Data (may be outside EEA)

Providers in this Annex are permitted under Clause 8.3 and must never receive Controller Personal Data (including pseudonymous identifiers). Data minimisation / scrubbing per Clause 8.4 applies.