Data Processing Addendum

Scope and definitions

“Personal data”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning they have in the data protection law that applies, which includes Peru’s Law No. 29733 and, where it applies, the GDPR. “Customer Personal Data” is the personal data in the content that Customer and its end users send to the service and that Thaliq processes on Customer’s behalf: conversations, end-user identifiers and attributes, knowledge-base content and feedback.

This DPA does not apply to personal data for which Thaliq is the controller, such as the data of website visitors and of the members of customer organizations. The Privacy Policy describes that data.

Roles

Customer is the controller of Customer Personal Data, or its processor when it acts for another controller. Thaliq is the processor, or the subprocessor. Each party complies with the data protection law that applies to it.

Instructions

Thaliq processes Customer Personal Data only on Customer’s documented instructions: the Terms of Service, this DPA, and Customer’s configuration and use of the service, including its API calls. Thaliq may also process it where the law requires, and will tell Customer first unless the law forbids it.

Customer’s instructions must be lawful. Customer is responsible for having a lawful basis for the processing, for giving its end users the notices the law requires, including that they are talking to an AI agent, and for the accuracy of the data. If Thaliq thinks an instruction infringes the law, it will tell Customer.

Details of the processing

• Subject matter: providing the service described in the Terms of Service.
• Duration: as long as Customer’s organization exists, plus the deletion period set out in this DPA.
• Nature and purpose: hosting and storing data, running agents with a language model, searching knowledge bases, delivering messages through channels, observability, security, support and billing.
• Types of personal data: end-user identifiers (such as names, emails, phone numbers or identifiers that Customer defines), attributes that Customer defines, message content, feedback, and the names and emails of Customer’s members.
• Data subjects: Customer’s end users and members, and the people mentioned in the content.
• Special categories of personal data: only if Customer chooses to send them, and only where the law and the Acceptable Use Policy allow it.

Confidentiality

Thaliq makes sure that the people it authorizes to process Customer Personal Data are bound by confidentiality, and it limits access to those who need it. Thaliq staff do not read Customer’s conversations, except to give support that Customer asked for, to keep the service secure or when the law requires it.

Security measures

Thaliq keeps technical and organizational measures that fit the risk. They include:

• Encryption in transit with TLS, and encryption at rest of the database, the queue and the secrets store.
• Isolation between organizations in the database through row-level security, and no access to the database from the public internet.
• Customer’s secrets, such as the credentials of its tools, encrypted individually with per-organization keys that a master key protects.
• Passwords, API keys and session tokens stored only as hashes.
• Role-based access in the console, and an audit log of changes that is kept for 12 months.
• Restricted and audited access for Thaliq’s operators, who cannot read conversations through the operator tools.
• Automated backups, and container images that are built from pinned dependencies, scanned for vulnerabilities and signed.

These measures can change as the service evolves, as long as the level of protection does not fall. [TO CONFIRM: final list, with counsel]

Subprocessors

Customer authorizes Thaliq to use subprocessors. Thaliq has a written agreement with each one that requires protection equivalent to this DPA, and it remains responsible for their performance.

Current subprocessors

• Amazon Web Services: hosting, database, queue, email delivery and the language model through Amazon Bedrock. Region us-east-1, United States; model requests can be processed in other AWS Regions.
• Cloudflare: DNS, network edge, secure tunnel to Thaliq’s servers, and hosting for the widget. Global network.
• Voyage AI: embeddings of knowledge-base content and search questions, only if Customer uses knowledge bases. [TO CONFIRM: location and terms]

Services that Customer connects itself, such as WhatsApp, Slack, MCP servers, tools and webhooks, are Customer’s choice. They are not Thaliq’s subprocessors, and Customer is responsible for the data it sends to them.

Thaliq will tell Customer at least 30 days before it adds or replaces a subprocessor, by email to the organization’s owner or by a notice in the console. Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, Customer may terminate the affected service.

Help with data subject requests

Thaliq will tell Customer without undue delay if a data subject asks Thaliq about Customer Personal Data, and will not answer except to refer the person to Customer. The console and the API let Customer export data and erase an end user. Thaliq will give reasonable help with data subject requests, data protection impact assessments and consultations with authorities, taking into account the nature of the processing.

Personal data breaches

Thaliq will notify Customer without undue delay after becoming aware of a personal data breach that affects Customer Personal Data, and within [TO CONFIRM: 72 hours]. The notice will describe what happened, the data affected, the likely consequences and the measures taken, as far as is known, and Thaliq will keep Customer informed and cooperate.

International transfers

Customer Personal Data is hosted in AWS us-east-1, in the United States, and model requests can be processed in other AWS Regions. Customer authorizes these transfers. Where the law requires a transfer mechanism, the parties will use Standard Contractual Clauses or another mechanism that the law recognizes. [TO CONFIRM: module and annexes]

Return and deletion

The owner of Customer’s organization can export its data from the console and request its deletion. After a deletion request the organization is kept for a 30-day grace period, during which Customer can cancel; then Thaliq deletes Customer Personal Data. Automated backups are overwritten on their normal cycle, of up to 14 days. Thaliq may keep what the law requires it to keep, such as billing records.

Information and audits

Thaliq will make available the information needed to show that it complies with this DPA. Customer may audit Thaliq once a year, with 30 days’ notice, during business hours, at its own cost and under confidentiality, without access to the data of other customers. Thaliq may satisfy an audit with reports from independent third parties, such as AWS’s compliance reports, and with its own security documentation. [TO CONFIRM]

Term, liability and precedence

This DPA lasts as long as Thaliq processes Customer Personal Data. Each party’s liability under it is subject to the limits of the Terms of Service. If this DPA and the Terms of Service conflict on the processing of personal data, this DPA prevails. It is governed by the same law and the same courts as the Terms of Service.

Contact

Questions about this DPA or about data protection: [email protected]. [TO CONFIRM: data protection contact]