Data Processing Agreement
AVA talks with visitors to the customer’s website and records personal data in the process. For that data, the customer is the controller and Volgo is the processor within the meaning of Article 28 GDPR. This agreement applies automatically to every subscription.
1. Parties
Processor: Hanssens Cornerstone Capital, trading as Volgo, Vlissingen, the Netherlands, Dutch Chamber of Commerce (KvK) no. 98133438. Controller: the business with a Volgo subscription (the customer).
2. What data, and for what purpose
- Data subjects: visitors to the customer’s website who chat with AVA, and the customer’s team members.
- Data: the content of the chat, name, phone number and email address if the visitor provides them, the time, and an irreversible code of the IP address to prevent abuse.
- Purpose: answering visitors’ questions, recording requests, ranking leads and showing them in the customer’s dashboard, and notifying the customer.
Volgo processes the data only on the customer’s instructions and does not use it for its own purposes or to train AI models.
3. Security
- All connections are encrypted (HTTPS). Passwords are only stored encrypted (hashed).
- Only logged-in members of the customer’s team can see that customer’s conversations and leads.
- Volgo itself only accesses the data when needed for support or maintenance.
4. Sub-processors
The customer consents to the use of these sub-processors. We’ll announce any change in advance; the customer may then object.
- Cloudflare: hosting and database for the website and the dashboard.
- Anthropic: the AI model (Claude) AVA uses to write replies. Chat text is only passed on to generate a reply.
- Resend: sending email notifications.
- Stripe: processing subscription payments (only the customer’s own data).
Where data is processed outside the EEA, this is done on the basis of the EU-US Data Privacy Framework or Standard Contractual Clauses.
5. Retention
Conversations and leads are kept for as long as the subscription runs, unless the customer deletes them earlier. After the subscription ends, we delete them within 30 days, or first hand them over to the customer on request.
6. Data breaches and requests
- In the event of a data breach, we inform the customer without undue delay and within 48 hours of discovering it, so the customer can meet its reporting obligation.
- If a visitor asks for access or deletion, we help the customer do so within the legal deadline.
7. Audits and confidentiality
Everyone at Volgo with access to the data is bound by confidentiality. On request, the customer may receive the information needed to demonstrate that these agreements are being met.