DATA PROCESSING ANNEX (DPA)

---

1. Introduction

1.1. This Annex forms an integral part of the General Terms and Conditions and sets out the mandatory elements pursuant to Article 28(3) of the GDPR between the Service Provider and the User.

1.2. The Annex shall enter into force upon acceptance of the GTC, electronically and without the need for a separate signature [Article 28(9) of the GDPR], and shall remain in force for the entire duration of the contract.

1.3. Unless otherwise specified, the terms used in the Annex shall have the meanings set out in the GTC and in the LivePly Privacy Notice.

1.4. This Annex applies exclusively to the processing of End Users’ personal data on behalf of the User. The Service Provider’s own data processing activities (the User’s data, invoicing, newsletters, and log data processing as set out in clause 2.3) are governed by the Privacy Notice.

---

2. Roles of the parties

2.1. The Data Controller is the User, who determines the purposes and means of processing through the Chatbot’s settings, its knowledge base and customer communications conducted via its own interface. Data Processor is the Service Provider, who processes the data exclusively in accordance with the User’s documented instructions and to the extent necessary for the provision of the Service.

2.2. The Service Provider also acts exclusively as a Data Processor with regard to the generation of AI responses: the purposes and essential means of processing in this context are also determined by the User (settings, system prompts/personas, knowledge base, other configurations), and the AI generates responses solely from the context thus specified. There is no joint controller relationship (Article 26 of the GDPR) between the Parties with regard to the processing of End Users’ data.

2.3. The Service Provider’s activities as an independent data controller. The Service Provider processes a limited scope of End-User data not on behalf of the User, but under its own responsibility as a data controller. This primarily includes operational and device call logs, security and access logs, the log of End-User information displays, and any data that may be required to investigate potential misuse. The processing of this data is based on the legitimate interest in ensuring the secure, stable and proper operation of the Service [Article 6(1)(f) of the GDPR].

The precise content of the data falling within this scope, the legal basis for data processing and the retention period are set out in sections 5.3a–5.3b of the Privacy Notice. The Service Provider does not create a separate customer register from this data independent of the User, does not use the data for marketing purposes, and does not use or transfer it for the training of artificial intelligence models operated either by itself or by third parties. It uses this data exclusively for purposes necessary for the operation and security of the Service.

In this regard, the Service Provider fulfils its obligation to provide information to End Users in accordance with Articles 13–14 of the GDPR directly, by means of a separate notice published on its website.

---

3. Subject matter, duration, nature and purpose of the processing

3.1. Subject matter: the processing of personal data provided by End Users via the chatbot operated on the User’s platform, or generated during its use.

3.2. Duration: the entire term of the contract, subject to the exception set out in clause 8.

3.3. Nature and purpose: automated (AI-based) and/or live-operator customer communication, the generation of AI responses, the storage of conversations and attached files, and the processing of the knowledge base (including processing for embedding purposes).

3.4. Data subjects: natural persons communicating with the chatbot (End Users).

3.5. Data categories: messages and replies; conversation metadata (date and time, session ID); the content and metadata of attached files (images: jpg, png, webp, gif; documents: PDF, Word/docx, Excel/xlsx) (file name, type, size, time of attachment); other personal data voluntarily provided by the End User. The content of the file is determined solely by the End User; the Service Provider does not filter it in advance; it may also contain third-party data or special categories of data as defined in Article 9 of the GDPR (Clause 6.3).

3.6. Recognition of contact details. The Chatbot may automatically recognise and extract contact details provided during the conversation (name, telephone number, email address) and assign them to the conversation in a structured format; name recognition may also be carried out using an AI model provider, by drawing conclusions from the content of the conversation. This operation remains within the scope of the data set specified in Section 3.5 and does not constitute an independent purpose beyond the instructions set out in Section 4.1. The lead data set generated in this way is to be managed separately from the conversation, with its own retention period and its own deletion procedure (4.5a.).

3.7. Handling of attached files. a) Images – together with the text message – are forwarded to the AI model provider specified in Annex 1 for the purpose of generating a response, provided that the model in question is capable of image processing. b) The content of a document is not forwarded to the model provider; the Service does not perform OCR, content or embedding processing on it. The document is stored for this purpose only and may be viewed by the User’s authorised staff. c) The retention period for the file is the same as that for the conversation (Clause 4.5a). d) The User may disable the attachment of images and documents separately via the admin interface; disabling this is a documented instruction as per Clause 4.1. By default, both are enabled.

These operations remain within the scope of the purpose set out in clause 3.3 and do not constitute a separate data processing purpose.

---

4. Obligations of the Data Processor (Service Provider)

4.1. Processing on instructions. The Service Provider shall process the data exclusively in accordance with the User’s documented instructions; the Chatbot settings (knowledge base, fallback, MCP integration, attachment settings) shall be deemed to constitute documented instructions. If the Service Provider is required by law to process data differently, it shall provide prior notice of this, unless otherwise provided for by law.

4.2. Confidentiality. Employees and contractors authorised to process data have undertaken a duty of confidentiality or are subject to a statutory duty of confidentiality.

4.3. Data security. The Service Provider applies the technical and organisational measures set out in Article 32 of the GDPR, in particular: tenant-level, segregated database schemas; data transmission via an encrypted channel; storage of passwords as non-reversible cryptographic hashes (Argon2); encrypted storage (AES-256-GCM) of access keys and tokens; and granting of access in accordance with the principle of least privilege. A full description can be found in Section 10 of the Privacy Notice.

4.4. Sub-processors. The User grants general authorisation for the use of the sub-processors listed in Annex 1. The Service Provider shall give prior notice of any expansion of this list at least 30 calendar days before the planned implementation by amending the Annex; if the User does not accept the expansion, they may exercise their right of termination in accordance with the General Terms and Conditions during this period. The Service Provider imposes the same data protection obligations on sub-processors as those applicable to itself. If the User objects to the extension and terminates the contract as a result, the Service Provider shall refund the prepaid fee for the unused period on a pro rata basis (Clauses 18.3 and 9.3 of the GTC).

4.5. Data subject rights. The Service Provider shall, within reasonable limits and via the functions of the admin interface (deleting conversations, removing knowledge base content), assist the User in complying with data subject requests.

4.5a. Retention period. The User sets the retention period for conversations and attached files via the admin interface on a per-chatbot basis (1–3,650 days); this setting constitutes a documented instruction as per clause 4.1. In the absence of such a setting, the default is 180 days, after which data is automatically deleted. The User sets the retention period for lead data separately, also on a per-chatbot basis; the default is 12 months, the configurable upper limit is 24 months, after which automatic deletion takes place. Lead data survives the deletion of the conversation and is deleted via a separate deletion process. In Healthcare mode, the retention period may not exceed 30 days; this limit is technically enforced by the Service Provider, and it is not possible to save a higher setting. The User, as the Data Controller, is responsible for ensuring that the chosen duration is fit for purpose and justifiable; the warning displayed by the Service Provider on the interface does not affect or share this responsibility. The log of information displayed to the End User (display log) — for the purposes of demonstrating accountability [Article 5(2) of the GDPR] — shall be retained, irrespective of the deletion of the conversation, for a period specified by the Service Provider for this purpose, but for at least the same duration as the retention period of the conversation in question, and for a minimum of 365 days. The obligation to cooperate and provide evidence, as well as the rights of the data subject, may only extend to data actually existing in the live system at the time of the request. The Service Provider shall create a backup of the system, which shall be retained for 30 days; deletion of the data in the backups shall take effect upon the expiry of this period, when the backup expires. The Service Provider ensures that, in the event of a restore, previously deleted data will not be processed again. Deleted data cannot be retrieved from the live system and cannot be returned; therefore, the Service Provider bears no liability in this regard.

4.6. Cooperation. The Service Provider – taking into account the information at its disposal – shall assist the User in fulfilling its obligations under Articles 32–36 of the GDPR, and shall notify End Users of any data protection incident within 48 hours of becoming aware of it.

4.7. Deletion or return upon termination of the contract. Following termination, the Service Provider shall – at the User’s discretion – either delete the data or transfer it in an exportable format. Any remaining data will be deleted on the date specified by the User or, failing that, within 30 days, unless there is a statutory retention obligation. In the event of cancellation during the trial period and prior to payment of the fee, the Service Provider shall delete the data immediately, in accordance with clause 14.6 of the GTC.

4.8. Certification. The Service Provider shall make available the information necessary to certify the fulfilment of its obligations and shall enable verification of this in a documentation-based form. This practice does not restrict the User’s statutory rights; in the event of a request from a regulatory authority, the Service Provider shall cooperate to the extent necessary.

---

5. International data transfers

Where the use of sub-processors involves transfers outside the EU, the Service Provider shall apply the safeguards set out in Chapter V of the GDPR (adequacy decision, SCCs), in accordance with sections 4.2 and 9 of the Privacy Notice. This also applies to the transmission of images as referred to in Section 3.7(a): this takes place within the data flow already applied to text messages, to the same service provider and subject to the same safeguards.

The User model endpoint does not fall within this scope: transmission to it is based on the User’s own decision as a data controller (Section 6.4).

---

6. Obligations of the User (Data Controller)

6.1. The User warrants that it has a lawful basis for data processing and that its instructions comply with the GDPR.

6.2. The User is responsible for providing End Users with appropriate information – including regarding file attachments and processing as set out in clause 3.7 – by means of their own privacy notice or by referring to LivePly’s Privacy Notice.

6.3. The User is responsible for configuring the Chatbot appropriately in accordance with sections 5.6 (Children’s data) and 5.7 (Special categories of data) of the Privacy Notice, including assessing whether it is justified to restrict or disable file attachments (3.7(d)).

6.4. User model endpoint. If the User sets up their own model provider access (API key) or their own model endpoint, the transfer of data to it is the User’s own decision as Data Controller and does not form part of the Service Provider’s sub-processor chain. The User is responsible for the legal basis for the transfer, the safeguards under Chapter V of the GDPR, the contract to be concluded with the Service Provider under Article 28 of the GDPR, and the accuracy of the labelling regarding the model’s image processing capabilities (which determines the transfer of images as set out in 3.7(a)). The Service Provider does not monitor the data processing practices of the end point and has no influence over them.

---

7. Liability

7.1. Liability arising from a breach of this Annex shall be governed by Clause 12 of the GTC, including the financial limits set out in Clause 12.1, the exclusions set out in Clause 12.3, the exceptions set out in Clause 12.4 and the rules on the enforcement of claims set out in Clause 12.12.

7.2. The compensation provisions set out in Clause 12.11 of the GTC shall also apply in this context: if the End User or any other third party asserts a claim relating to data processing – including a claim made directly against the Service Provider – on grounds arising from the User’s instructions, the User’s chatbot settings, knowledge base, uploaded content, statements relating to the Generated Notice, the use of the User model endpoint, or the User’s failure to exercise due supervision, the User shall be obliged to indemnify the Service Provider.

7.3. Clause 7.2 does not affect the allocation of liability towards the data subject under Article 82 of the GDPR, and – in accordance with Clause 12.11. (4) of the GTC – does not extend to that part of the claim which falls within the Service Provider’s own sphere of liability (Clauses 12.4 and 12.5(5) of the GTC).

7.4. In the case of a user model endpoint, clause 6.4 and clause 12.10(2) of the GTC shall apply.

---

8. Validity and Governing Law

8.1. This Annex shall enter into force and cease to have effect simultaneously with the GTC, with the exception of the provisions following termination as set out in clause 4.7.

8.2. The Annex is governed by the legislation specified in Clause 18 of the GTC and the GDPR.

---

Annex 1 – List of Sub-processors

The table lists the sub-processors who actually process End Users’ personal data. A complete list covering all data processing carried out by the Service Provider can be found in Section 9 of the Privacy Notice; the subcontractors listed there but not included here (Stripe, Szamlazz.hu, Mailjet, accounting service provider) are linked to the Service Provider’s own data processing activities as a data controller; they do not process End-User data. The User Model Endpoint (Section 6.4) is not included, as the Service Provider does not rely on it as a sub-processor.

The Service Provider may engage additional AI model providers in the future; the procedure set out in clause 4.4 shall apply in such cases.

The Annex shall be updated in accordance with the procedure set out in clause 4.4 whenever there is a change in the list of sub-processors.