Data Processing Agreement

1. Parties and how this Agreement applies

This Data Processing Agreement (the "Agreement") is between Cerebro Labs Inc., the company developing and operating AgentNava ("AgentNava", "we", "us"), and the customer that uses the Service ("you"). A store that installs the AgentNava app from Shopify, and a Wix site owner who adds the AgentNava AI Assistant app from the Wix App Market, is a customer.

This Agreement forms part of our Terms of Service (the "Terms"). It applies automatically when you accept the Terms or install the app. No separate signature is needed. Words defined in the Terms have the same meaning here.

If this Agreement and the Terms disagree about personal data, this Agreement wins.

2. Definitions

• Data Protection Laws: the privacy and data protection laws that apply to the processing, such as the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act.
• Customer Personal Data: personal data that we process for you when we provide the Service. It includes personal data in your Customer Content and the data of a store's shoppers.
• Controller, processor, data subject and processing have the meanings given in the GDPR. Under California law, "processor" also means "service provider".
• Sub-processor: a company we engage to process Customer Personal Data for the Service.
• Security Incident: a breach of security that leads to the accidental or unlawful loss, change, disclosure of, or access to, Customer Personal Data.

3. Scope and roles

You are the controller of Customer Personal Data. We are your processor. If you are yourself a processor for someone else, we are your sub-processor, and you confirm that your controller allows it.

You are responsible for having a lawful basis for the processing and for giving data subjects the notices that the law requires.

4. Processing only on your instructions

We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this Agreement, and the way you set up and use the Service (for example your agents, their settings and the apps you connect).

If the law requires us to process the data in another way, we will tell you first, unless the law forbids it. If we think an instruction breaks Data Protection Laws, we will tell you.

We will not sell Customer Personal Data. We will not use it for advertising. We will not use it to train models. We will not keep, use or disclose it for any purpose other than providing the Service to you.

5. Confidentiality of our staff

Only staff who need access to provide the Service can access Customer Personal Data. Each of them is bound by a duty of confidentiality, in a contract or by law.

6. Security measures

We keep technical and organisational measures in place to protect Customer Personal Data. They include:

• Encryption in transit with TLS.
• Encryption at rest, including backups.
• Test and production systems and their data kept apart.
• Least-privilege access for staff, with an access log.
• Notice of a Security Incident within seventy-two (72) hours, as set out in Security incidents.

We may change these measures as the Service changes, but we will not lower the overall level of protection.

7. Sub-processors

You allow us to use the sub-processors listed in our Privacy Policy. We bind each one by a written contract with data protection terms that protect Customer Personal Data at least as well as this Agreement. We stay responsible to you for their work.

We will give you at least fourteen (14) days' notice before we add or replace a sub-processor. We give notice by updating that list and by email or a notice in the product.

You can object to a new sub-processor on reasonable data protection grounds within those fourteen (14) days. If you do, we will work with you in good faith to resolve it. If we cannot, you may stop using the part of the Service that the change affects, or end your use of the Service (a store can uninstall the app).

8. Help with data subject requests

If a data subject asks us directly to exercise a right about Customer Personal Data, we will pass the request to you. We will not answer it ourselves, unless the law requires it.

We will help you answer requests to see, correct, delete or move personal data. We complete each request that you send us, or that Shopify forwards for a store, within thirty (30) days.

9. Help with security and impact assessments

We will give you reasonable help, with the information we have, so you can meet your duties under Data Protection Laws. This covers the security of the processing, data protection impact assessments, and any prior consultation with a data protection authority.

10. Security incidents

If we learn of a Security Incident, we will tell you without undue delay, and in any case within seventy-two (72) hours of learning of it.

Our notice will say what we know at that time: what happened, the kinds and rough number of data subjects and records involved, the likely effects, and the steps we have taken or plan to take. We will send more details as we learn them. We will take reasonable steps to contain the incident and reduce its effects.

Telling you about a Security Incident is not an admission of fault.

11. Deletion or return at the end

When you stop using the Service, we delete Customer Personal Data within thirty (30) days. If you ask in writing before the end, we will first return a copy to you in a common format.

When a store uninstalls the AgentNava app, our access to the store stops at once. Shopify sends us a request to delete the store's data forty-eight (48) hours after the uninstall. We delete that store's data within thirty (30) days of that request.

When a Wix site removes the AgentNava AI Assistant app, our access to the site stops at once. We handle that site's data as the Wix sites section of our Privacy Policy describes.

Copies in our encrypted backups expire as the backups roll over, within a further thirty (30) days. We may keep data longer only where the law requires it. We keep any such data confidential and use it for no other purpose.

12. Audits

We will make available the information you reasonably need to show that we meet this Agreement.

You can audit our compliance on reasonable written notice. We will first answer your written questions. If those answers are not enough, or a data protection authority requires it, we will allow an audit by you or an independent auditor you choose. Audits happen at most once a year (unless a Security Incident or an authority requires another), during business hours, under a duty of confidentiality, and at your cost.

13. International transfers

We are based in the United States, and we and our sub-processors process data in the U.S. If Data Protection Laws require a transfer mechanism for Customer Personal Data (for example from the European Economic Area, the United Kingdom or Switzerland), the Standard Contractual Clauses apply. They are part of this Agreement by reference, with the changes that UK and Swiss law require. If the Standard Contractual Clauses and this Agreement disagree, the Standard Contractual Clauses win.

14. Liability

Each party's liability under this Agreement is subject to the limits and exclusions in the Limitation of liability section of the Terms.

15. Term and changes

This Agreement lasts as long as we process Customer Personal Data for you. It forms part of the Terms and ends with them, except for the parts that by their nature continue, such as deletion and confidentiality.

We may update this Agreement in the same way, and with the same notice, as the Terms. We will update the "Effective" date at the top.

16. Contact

Cerebro Labs Inc. develops and operates AgentNava. Our principal business location is Milpitas, California, United States.

For questions about this Agreement or about Customer Personal Data, email contact@agentnava.com or use the contact form on our Support page.