Legal
Data processing agreement
Last updated: September 2026
This agreement applies where a business (the controller) uses Reply Fast to process personal data of its end customers, and Reply Fast acts as processor under Article 28 GDPR. It supplements the Terms of service.
Draft for legal review
This page contains placeholders marked “Needs legal review”. They must be completed and verified by qualified legal counsel before this page is relied upon.
1. Parties and roles
The controller is the organization that operates the assistant. The processor is Needs legal reviewlegal entity name and address. Each party complies with the GDPR obligations that apply to its role.
2. Subject matter, duration and nature of processing
Processing of end-customer messages and identifiers to generate and deliver assistant answers, for the duration of the service agreement. Categories of data subjects: the controller's customers and prospects. Categories of data: contact identifiers, message content and any personal data customers include in messages.
3. Processing on instructions
The processor processes personal data only on the controller's documented instructions, including the configuration made in the dashboard, unless required by EU or member-state law.
4. Confidentiality and security
Persons authorised to process personal data are bound by confidentiality. The processor implements the measures described in the Security overview, including pseudonymization before AI processing, encryption at rest and in transit, tenant isolation and audit logging.
5. Sub-processors
The controller gives general authorisation for the sub-processors listed on the Sub-processors page. The processor notifies changes in advance and the controller may object within 14 days. Needs legal reviewsigned data-processing agreements with the hosting, email and AI providers on the Sub-processors page must be executed and archived before production launch
6. Assistance with data-subject rights
The processor assists the controller in responding to access, rectification, erasure and export requests through the dashboard and, where needed, by email.
7. Personal data breaches
The processor notifies the controller without undue delay and no later than Needs legal reviewhours after becoming aware of a personal data breach affecting the controller's data.
8. Return and deletion
At the end of the service the processor deletes or returns all personal data at the controller's choice, and deletes existing copies unless EU or member-state law requires storage. Retention jobs purge pseudonymization vault entries automatically after their purge date.
9. Audits
The processor makes available the information necessary to demonstrate compliance and allows audits by the controller or an auditor mandated by the controller, on reasonable notice. Needs legal reviewaudit frequency and cost allocation
10. International transfers
Personal data is processed in the EU. Any transfer to a third country relies on an adequacy decision, the EU–US Data Privacy Framework or standard contractual clauses, as recorded on the Sub-processors page.
11. Contact
Requests under this agreement: Needs legal reviewprivacy contact email.