Botkeep is currently a local frontend prototype. This document separates current behaviour from production commitments so it does not claim processing or safeguards that are not active yet.
1. Status and application
This Addendum applies automatically when an operational Botkeep service processes personal data on behalf of a customer as processor under Article 28 GDPR. It supplements the Terms and prevails on processor-specific data-protection matters. The local-only prototype performs no such server-side processing, so this Addendum does not yet appoint Botkeep as a processor for demo data.
The processor is M.O. Società a Responsabilità Limitata Semplificata. The customer is the controller or processor that determines the documented instructions for its bot data. If the customer is itself a processor, it confirms that its instructions are authorised by the relevant controller.
2. Processing details
| Element | Description |
|---|---|
| Subject and duration | Hosting, building, executing, storing, securing, backing up and deleting supported customer bots for the service term and documented deletion period |
| Nature and purpose | Compute, storage, file, console, deployment, logging and support operations required to provide the Service |
| Data subjects | The customer’s bot users, community members, authorised staff, collaborators and other persons whose data the customer lawfully processes |
| Personal-data types | Identifiers, usernames, message or interaction data, configuration, support data, logs and any other data the customer elects to process through a supported bot |
| Sensitive data | Not intended by default. The customer must not process special-category or criminal-offence data unless separately authorised, necessary, lawful and covered by appropriate safeguards |
3. Documented instructions
Botkeep processes customer personal data only on documented instructions contained in the Terms, configuration choices, support requests and this Addendum, including for transfers. Botkeep will inform the customer if an instruction appears to infringe data-protection law, unless prohibited from doing so. Botkeep is not required to execute an unlawful or technically unsupported instruction.
4. Processor duties
- Ensure authorised personnel are bound by confidentiality.
- Apply security measures appropriate to risk and review them as the service changes.
- Assist the customer, taking account of the nature of processing, with data-subject requests, security, breach duties, impact assessments and regulator consultation where applicable.
- Notify the customer of a personal-data breach affecting customer data without undue delay after becoming aware of it and provide available information needed for the customer’s assessment.
- Delete or return customer personal data after the service ends, at the customer’s choice, unless law requires retention, subject to documented backup-expiry mechanics.
- Provide information reasonably necessary to demonstrate compliance and allow proportionate audits under appropriate confidentiality and security arrangements.
5. Security measures
The production schedule must describe implemented controls before live processing starts. The intended baseline includes encrypted transport, access control and least privilege, tenant isolation, resource limits, secret separation and redaction, patch and vulnerability management, logging, backup controls, incident response and tested deletion. This list is a design commitment and must not be represented as deployed until verified.
6. Subprocessors
The customer gives general authorisation for subprocessors needed to provide production infrastructure, subject to equivalent data-protection obligations. Botkeep will publish the identity, function and processing location of each production subprocessor and give reasonable advance notice of additions or replacements so the customer can raise a reasoned data-protection objection.
No production subprocessor list is published yet because live Botkeep hosting is not active. The Service must not accept live customer workloads until this schedule names the actual infrastructure, authentication, support and other processors.
7. International transfers
A transfer outside the EEA will occur only under a valid Chapter V GDPR mechanism. Where Standard Contractual Clauses are used, the parties incorporate the applicable controller-to-processor or processor-to-processor module, together with a transfer assessment and supplementary measures where required.
8. Customer responsibilities
- Give lawful instructions and identify a valid legal basis for bot processing.
- Provide required notices and handle data-subject rights for the bot’s purposes.
- Configure the bot to minimise data and avoid unnecessary sensitive information.
- Use secure credentials, restrict authorised users and maintain appropriate independent exports.
- Assess whether Botkeep’s supported service and safeguards are suitable for the customer’s processing and complete any required impact assessment.
9. Contact and completion before production
DPA questions may be sent to info@movara.it or mosrls@pec.cgn.it. Before production, the parties must be able to identify the customer, effective date, actual subprocessors, processing regions, verified security schedule and enforceable deletion periods.