This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Customer", the controller) and Ideal Dev SH.P.K., operating Toong ("Toong", the processor), for the provision of the Toong service (the "Service"). It reflects the parties' obligations under Article 28 of the General Data Protection Regulation (GDPR) and equivalent data-protection laws.
1. Roles and scope
The Customer is the controller of the personal data it (and its own customers) submit to the Service. Toong processes that personal data solely as a processor, on the Customer's behalf, to provide the Service. This DPA applies for as long as Toong processes personal data for the Customer.
2. Processing on instructions
Toong processes personal data only on the Customer's documented instructions (including as set out in the agreement and this DPA), unless required by law. Toong will inform the Customer if, in its opinion, an instruction infringes applicable data-protection law. Toong does not sell personal data and does not use customer content for advertising.
3. Confidentiality
Toong ensures that persons authorised to process the personal data are bound by an appropriate obligation of confidentiality.
4. Security
Toong implements appropriate technical and organisational measures to protect personal data, as described in Annex II, having regard to the state of the art, the costs of implementation, and the nature, scope and purposes of processing.
5. Sub-processors
The Customer provides a general authorisation for Toong to engage the sub-processors listed at clientora.tech/subprocessors. Toong imposes data-protection obligations on each sub-processor no less protective than those in this DPA, and remains responsible for their performance. Toong will give the Customer advance notice of any intended addition or replacement of a sub-processor, and the Customer may object on reasonable data-protection grounds.
6. Assistance with data-subject rights
Taking into account the nature of the processing, Toong assists the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability and objection). Customers can also request deletion at any time via clientora.tech/data-deletion.
7. Personal data breach
Toong notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data, and provides the information reasonably necessary for the Customer to meet its own notification obligations.
8. Return and deletion
On termination of the Service, and at the Customer's choice, Toong deletes or returns the personal data it processes on the Customer's behalf, and deletes existing copies unless retention is required by law.
9. Audits and information
Toong makes available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable confidentiality and scheduling arrangements.
10. International transfers
Where personal data is transferred outside the EEA to a sub-processor, such transfers are made under an appropriate safeguard, such as the European Commission's Standard Contractual Clauses, which are incorporated by reference where applicable.
Annex I: Details of processing
- Subject matter & duration: processing of personal data to provide the Service, for the duration of the agreement.
- Nature & purpose:receiving and automatically replying to the Customer's end-customer messages across connected channels, and related features (knowledge, scheduling, contacts, analytics).
- Categories of data subjects:the Customer's end customers and the Customer's authorised users.
- Types of personal data: message content, channel-scoped identifiers, names and contact details a customer provides, and any content the end customer sends (text, images, voice).
Annex II: Security measures
- Encryption in transit (TLS) and encryption of secrets and credentials at rest.
- Strict logical isolation of each customer's data (multi-tenant separation).
- Role-based access control and least-privilege access to production systems.
- Hosting on a reputable cloud provider with network hardening and daily backups.
- Prompt-injection guarding and content moderation on the assistant pipeline.
- Logging and monitoring, and a documented process for security incidents.
Annex III: Sub-processors
The current list of sub-processors is published at clientora.tech/subprocessors.
Executing this DPA
This DPA applies to your use of the Service. If your organisation requires a countersigned copy, contact [email protected] and we will arrange signature.