Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between BeforeQuery ("Processor") and the Customer ("Controller") and governs the processing of personal data by BeforeQuery on behalf of the Customer in connection with the Service.

• "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on personal data
• "Data Subject" means the individual to whom personal data relates
• "Sub-processor" means any third party engaged by BeforeQuery to process personal data

BeforeQuery processes personal data solely for the purpose of providing the Service, which includes:

• Reading the data an AI employee needs from the tools the Customer connects
• Generating plans, drafts and answers with AI models
• Carrying out actions the Customer approves, or allows to run under its approval rules
• Keeping a record of requests, approvals and actions
• Account management and authentication
• Customer support

Personal data processed may include:

• Contact information (name, email)
• Account credentials
• Data from connected tools, which may include details of the Customer's employees, customers or prospects
• Requests, approval decisions and records of actions
• Usage data and analytics
• Communication records

BeforeQuery agrees to:

• Process personal data only on documented instructions from the Controller
• Ensure personnel are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the Controller with data subject requests
• Delete or return personal data upon termination
• Make available information necessary for compliance audits

BeforeQuery implements the following security measures:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Access controls and authentication
• Regular security assessments and penetration testing
• Incident response procedures
• Employee security training
• Physical security at data centers

BeforeQuery uses the following sub-processors:

We will notify customers of any changes to sub-processors with at least 30 days' notice.

Where personal data from the EEA, the UK or Switzerland is transferred outside those regions, BeforeQuery ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

BeforeQuery will assist the Controller in responding to data subject requests, including rights of access, rectification, erasure, portability, and objection to processing.

BeforeQuery will notify the Controller without undue delay (and in any event within 72 hours) upon becoming aware of a personal data breach that affects Controller data.

This DPA remains in effect for as long as the Customer uses the Service under the Terms of Service. Upon termination, BeforeQuery will delete or return all personal data within 30 days, unless retention is required by law.

For DPA inquiries or to request a signed copy:

Email: [email protected]
Data Protection Officer: [email protected]