1. Status and application
This Addendum applies automatically when an operational Botkeep service processes personal data on behalf of a customer as processor under Article 28 GDPR. It supplements the Terms and prevails on processor-specific data-protection matters. The coming-soon site does not provide hosted processing. Enabling operational hosting in the restricted preview requires an approved subprocessor list, processing locations and operational retention/deletion controls; this draft alone does not certify those controls.
The processor is TRAMA BENEVENTO SRL. The customer is the controller or processor that determines the documented instructions for its workload data. If the customer is itself a processor, it confirms that its instructions are authorised by the relevant controller.
2. Processing details
| Element | Description |
|---|---|
| Subject and duration | Hosting, building, executing, storing, securing, backing up and deleting supported customer workloads for the service term and documented deletion period |
| Nature and purpose | Compute, storage, file, console, deployment, logging and support operations required to provide the Service |
| Data subjects | Users of customer applications and bots, website visitors, persons whose data is stored in customer databases, authorised staff, collaborators and other persons whose data the customer lawfully processes |
| Personal-data types | Identifiers, usernames, message or interaction data, website request metadata, database records, monitoring targets, configuration, support data, logs and other data the customer elects to process through a supported workload |
| Sensitive data | Not intended by default. The customer must not process special-category or criminal-offence data unless separately authorised, necessary, lawful and covered by appropriate safeguards |
3. Documented instructions
Botkeep processes customer personal data only on documented instructions contained in the Terms, configuration choices, support requests and this Addendum, including for transfers. Botkeep will inform the customer if an instruction appears to infringe data-protection law, unless prohibited from doing so. Botkeep is not required to execute an unlawful or technically unsupported instruction.
4. Processor duties
- Ensure authorised personnel are bound by confidentiality.
- Apply security measures appropriate to risk and review them as the service changes.
- Assist the customer, taking account of the nature of processing, with data-subject requests, security, breach duties, impact assessments and regulator consultation where applicable.
- Notify the customer of a personal-data breach affecting customer data without undue delay after becoming aware of it and provide available information needed for the customer’s assessment.
- Delete or return customer personal data after the service ends, at the customer’s choice, unless law requires retention, subject to documented backup-expiry mechanics.
- Provide information reasonably necessary to demonstrate compliance and allow proportionate audits under appropriate confidentiality and security arrangements.
5. Security measures
The production schedule must describe implemented controls before live processing starts. The intended baseline includes encrypted transport, access control and least privilege, tenant isolation, resource limits, secret separation and redaction, patch and vulnerability management, logging, backup controls, incident response and tested deletion. This list is a design commitment and must not be represented as deployed until verified.
6. Subprocessors
The customer gives general authorisation for subprocessors needed to provide production infrastructure, subject to equivalent data-protection obligations. Botkeep will publish the identity, function and processing location of each production subprocessor and give reasonable advance notice of additions or replacements so the customer can raise a reasoned data-protection objection.
The production subprocessor schedule has not yet been published. The Service must not accept live customer workloads until this schedule names the actual infrastructure, authentication, support and other processors.
7. International transfers
A transfer outside the EEA will occur only under a valid Chapter V GDPR mechanism. Where Standard Contractual Clauses are used, the parties incorporate the applicable controller-to-processor or processor-to-processor module, together with a transfer assessment and supplementary measures where required.
8. Customer responsibilities
- Give lawful instructions and identify a valid legal basis for workload processing.
- Provide required notices and handle data-subject rights for the workload’s purposes.
- Configure the workload to minimise data and avoid unnecessary sensitive information.
- Use secure credentials, restrict authorised users and maintain appropriate independent exports.
- Assess whether Botkeep’s supported service and safeguards are suitable for the customer’s processing and complete any required impact assessment.
9. Contact and completion before production
DPA questions may be sent to [email protected] or [email protected]. Before production, the parties must be able to identify the customer, effective date, actual subprocessors, processing regions, verified security schedule and enforceable deletion periods.