Parties
This Data Processing Agreement (the "DPA") is drawn up under Art. 28 GDPR and Art. 28 of Moldovan Law No. 195/2024, and forms part of the service agreement between:
- Client (the Controller), as named in the main service agreement;
- S.R.L. „MEGA PROMOTING" (the Processor), registered at MD-6800, s. Dănceni, r-ul Ialoveni, Republic of Moldova, IDNO 1019600021765.
Scope & purpose
The Processor will process Personal Data on behalf of the Controller solely to provide the agreed service. This includes, depending on the specific engagement:
- Hosting and operating chatbot instances on the aichat.md platform.
- Hosting and operating voice agents on the Kallina platform.
- Developing, deploying and maintaining custom applications.
- Providing SEO and growth services involving access to analytics.
Categories of data & subjects
- Data subjects — the Controller's end-users, customers, employees, or website visitors.
- Data categories — contact details, message content, voice recordings, transcripts, IP addresses, device/session identifiers, analytics events.
- Special categories — processed only if explicitly agreed in writing (e.g. health data for medical-clinic clients).
Obligations of the Processor
- Process data only on the Controller's documented instructions.
- Ensure personnel are bound by appropriate confidentiality undertakings.
- Implement appropriate technical and organisational measures (Art. 32 GDPR). See our GDPR statement for the measures currently in place.
- Notify the Controller within 24 hours of becoming aware of a personal-data breach. Full post-mortem within 10 working days.
- Assist the Controller in responding to data-subject requests, including access, rectification, erasure, and portability.
- Return or delete all Personal Data on termination, at the Controller's choice. Default: 30-day deletion window.
Sub-processors
The Controller grants general written authorisation for the Processor to engage sub-processors. We maintain a current list and will notify the Controller at least 14 days before adding or replacing a sub-processor. The Controller may object within that window.
The authoritative sub-processor list is the annex attached to your own signed agreement, because it differs per service and per deployment. We do not publish a generic list here: a public list that does not match the annex you signed is worse than no list. Ask for the annex for your service and we will send the current one, with each sub-processor's role and hosting location.
International transfers
Where the Controller is established in Moldova, Chapter V of Law No. 195/2024 applies; transfers to EEA states need no special authorisation (Art. 44(2)). Transfers to countries outside the EU / EEA are covered by:
- EU Standard Contractual Clauses (SCCs) 2021/914 where applicable;
- EU-US Data Privacy Framework for US-based sub-processors that participate.
The Processor will conduct a Transfer Impact Assessment on request.
Audit rights
The Controller may audit the Processor's compliance with this DPA once per calendar year, on 30 days' written notice, during normal business hours, at the Controller's expense. The Processor will provide reasonable assistance and make available SOC 2 / ISO 27001 attestations where held by sub-processors.
Liability & indemnity
Liability under this DPA is subject to the limitation-of-liability provisions in the main service agreement. Each party indemnifies the other for damages arising from its own non-compliance with the GDPR.
Term & termination
This DPA takes effect on the date both parties sign and remains in force as long as the Processor processes Personal Data on behalf of the Controller. On termination, the Processor will return or delete all Personal Data within 30 days, at the Controller's instruction.
Governing law
This DPA is governed by Moldovan law — including Law No. 195/2024 — where the main agreement is Moldovan, otherwise by the law of the Controller's habitual residence within the EU.