Data Processing Agreement — 2026.10.14v1 (Published)

Data Processing Agreement (DPA)

Effective Date: 01/09/2026

This Data Processing Agreement ("DPA") forms part of and supplements the Airdec Terms of Service and Subscription Agreement, and applies where Airdec processes Personal Data on behalf of a Customer subject to the General Data Protection Regulation (EU) 2016/679 ("GDPR") or equivalent data protection laws.

1. Parties

Controller: The Customer using the Services and determining the purposes and means of processing Personal Data.

Processor: AIRDEC LTD (дружество с ограничена отговорност — OOD, Bulgaria) EIK: 207392456 Registered Address: г.к. Стрелбище, ул. Енос 6, 1404 София, България / g.k. Strelbishte, Enos St 6, 1404 Sofia, Bulgaria Email: contact@airdec.com

2. Definitions

Terms used in this DPA have the meanings given under GDPR unless otherwise defined here. "Controller" means the entity determining the purposes and means of processing Personal Data. "Processor" means the entity processing Personal Data on behalf of the Controller. "Sub-processor" means any third party engaged by Airdec to process Personal Data. "Personal Data Breach" has the meaning given under GDPR Art. 4(12).

The subject matter, nature, purpose, and duration of processing, categories of Personal Data, and categories of Data Subjects are set out in Annex I. Technical and organisational security measures are set out in Annex II. Authorised Sub-processors are listed in Annex III.

3. Scope and Purpose

Airdec shall process Personal Data solely to provide the Services as described in the applicable agreements and as further specified in Annex I. Airdec shall not process Personal Data for purposes unrelated to providing the Services unless required by law.

4. Instructions

Airdec shall process Personal Data only on documented instructions from Customer (including those set out in this DPA and the applicable agreements), as necessary to provide the Services, or as required by applicable law. If Airdec believes an instruction violates applicable data protection law, Airdec shall notify Customer and may suspend execution of that instruction until clarified.

5. Confidentiality

Airdec shall ensure that personnel authorised to process Personal Data are subject to confidentiality obligations, receive appropriate privacy and security training, and access Personal Data only as necessary to perform their duties.

6. Security

Airdec shall implement appropriate technical and organisational measures to protect Personal Data, taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, as well as the risk to Data Subjects. These measures are described in Annex II. Airdec may update specific measures provided the overall level of protection is not materially reduced.

7. Sub-processors

Customer provides general written authorisation for Airdec to engage Sub-processors, subject to this Section. Current Sub-processors are listed in Annex III.

Airdec shall: (a) provide Customer with at least thirty (30) days' advance written notice before engaging any new Sub-processor or replacing an existing one; and (b) allow Customer to object on reasonable data-protection grounds within the notice period.

If Customer objects, Airdec will either (i) refrain from using the new Sub-processor in connection with Customer's Personal Data, or (ii) where this is not reasonably possible, allow Customer to terminate the affected subscription before the new Sub-processor begins processing, with a pro-rata refund of prepaid fees for the unused post-termination period.

Airdec shall impose data protection obligations on Sub-processors substantially equivalent to those in this DPA and remains responsible for each Sub-processor's performance. The authoritative, current Sub-processor list is published at https://console.airdec.com/legal/spl.

8. International Transfers

Where Personal Data is transferred outside the EEA, Airdec shall ensure an appropriate transfer mechanism is in place, including where applicable: European Commission adequacy decisions; EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two: Controller-to-Processor); or other lawful transfer mechanisms recognised under GDPR.

The transfer mechanism applicable to each Sub-processor is identified in Annex III. Where EU SCCs apply, they are incorporated into this DPA by reference and set out in Annex IV.

9. Assistance to Customer

Airdec shall provide reasonable assistance to Customer in responding to Data Subject rights requests (access, deletion, rectification, restriction, portability, objection) and in conducting data protection impact assessments and prior consultations under GDPR Art. 35–36. Customer remains responsible for responding to Data Subject requests.

10. Security Incidents

Airdec shall notify Customer within forty-eight (48) hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. Notification shall include: the nature of the incident; categories and approximate volume of affected data and Data Subjects; likely consequences; and measures taken or proposed to address the breach. Where all information is not available at once, it may be provided in phases without undue delay. Notification does not constitute an admission of fault or liability.

11. Audits

Upon reasonable written request, not more than once annually (or following a Personal Data Breach), Customer may request information necessary to demonstrate Airdec's compliance with this DPA. Audits must not unreasonably interfere with Airdec's operations, must protect the confidential information of Airdec and its other customers, and must be conducted during business hours with reasonable prior notice. Airdec may satisfy audit requests through security documentation, certifications, reports, or questionnaires.

12. Data Retention and Deletion

Upon termination, Customer may export available Personal Data for up to thirty (30) days where technically feasible. Airdec shall delete or return Personal Data in accordance with the following retention periods:

Data category Retention period
User accounts and associated personal data 12 months after termination, then deleted or anonymised
Legal acceptance records 10 years
Financial reference data 10 years (Bulgarian Accountancy Act)
Customer support records 3 years after termination
Application and security logs (user-linked) 90 days rolling
Lead data — all fields including PII (name, email, phone) and raw webhook payload 12 months from lead creation, then wiped — PII fields replaced with fixed placeholders, raw_payload replaced with {}; non-identifying record metadata (source, campaign, attribution, location, status, timestamps) retained indefinitely
Direct message content and conversation metadata (dm_messages, dm_conversations) 12 months from last message in the conversation (last_message_at), then deleted
AI widget conversations and messages 90 days, then deleted (operator-configurable per brand)
BI assistant chat history (ChatSession / ChatMessage) Retained for the duration of the account; user may delete individual sessions at any time
Usage analytics — aggregated / anonymised Indefinite (no longer Personal Data)

Airdec may retain Personal Data where retention is required for legal compliance, financial audit, or the establishment, exercise, or defence of legal claims. Personal Data is thereafter deleted or anonymised.

13. Liability

Liability arising under this DPA is subject to the limitations set forth in the Airdec Terms of Service unless prohibited by applicable law.

14. Governing Law

This DPA is governed by the laws of the Republic of Bulgaria.

15. Order of Precedence

In the event of conflict: this DPA governs Personal Data processing matters; the Subscription Agreement governs subscription matters; the Terms of Service governs all other matters. Where EU Standard Contractual Clauses apply, they prevail over this DPA with respect to the safeguards they provide.

Annex I — Description of Processing

Item Detail
Subject matter Provision of Airdec sales and marketing software Services to Customer
Nature of processing Collection, storage, organisation, structuring, retrieval, analysis, transmission, and deletion of Personal Data as required to provide the Services
Purpose of processing Account administration; marketing analytics; advertising performance reporting; lead collection, management, and anonymisation; direct message routing and delivery; AI-assisted chat widget for brand websites; internal BI assistant for brand dashboard users; CRM functionality; marketing-qualified lead tracking; customer support; security and operational monitoring including application and security logging; service improvement through anonymised analysis of usage data
Duration For the duration of the subscription, plus the retention periods set out in Section 12
Categories of Personal Data Names; email addresses; telephone numbers; business contact information; user account information; lead information including UTM/attribution data; direct message content and sender metadata; AI chat widget conversation content; BI assistant query text and conversation history; advertising and analytics data; device identifiers; IP addresses; legal acceptance records (IP address, user agent, timestamp)
Special category data Not intentionally processed. Customer must not submit special category data without a separate written agreement with Airdec.
Categories of Data Subjects (a) Processed as processor on behalf of Customer: leads (individuals who have engaged with Customer advertising or lead capture forms); Instagram/Facebook DM senders; AI widget visitors; brand staff using Telegram notification delivery (BotUser) (— BotUser to be removed from this list once in-house PWA replaces Telegram) (b) Processed as controller for Airdec's own operational purposes (governed by Airdec Privacy Policy): Customer employees and representatives with dashboard access; billing contacts
Data sources Lead personal data originates from ad platform webhooks (Meta Ads, Google Ads, LinkedIn, TikTok) operated by Customer. These platforms act as independent data controllers and deliver data to Airdec as data source providers, not as sub-processors of Airdec.

Annex II — Technical and Organisational Security Measures

Airdec implements, at minimum, the following measures:

Airdec may modify these measures provided the overall level of protection is not materially reduced.

Annex III — List of Sub-processors

# Sub-processor Purpose Data subjects Location Transfer mechanism
1 Google Cloud Platform Hosting, database, secret storage, Pub/Sub message queue All EU (europe-west1, Belgium) Within EEA — no transfer mechanism required
2 Anthropic (Claude) AI chat completions for client-facing website widget Brand's website visitors USA EU SCCs (2021/914, Module Two) — Anthropic Ireland, Limited is the EEA contracting entity; DPA automatically incorporated into Anthropic Commercial Terms of Service
3 Google Vertex AI Text embeddings for widget knowledge-base retrieval Brand's website visitors EU (europe-west1, Belgium) Within EEA — no transfer mechanism required
4 OpenAI (GPT) AI chat completions for internal BI assistant Brand's dashboard users (Airdec's own users) USA EU SCCs (2021/914, Module Two) — OpenAI Ireland Limited is the EEA contracting entity; DPA automatically incorporated into OpenAI Services Agreement
6 Resend Transactional email delivery Airdec's dashboard users USA EU SCCs (2021/914, Module Two) — DPA automatically binding on ToS acceptance; governed by Irish law
7 Google OAuth / Facebook OAuth Dashboard user social sign-in (identity assertion) Airdec's dashboard users USA / EU Google / Meta standard DPA
8 LinkedIn Insight Tag Marketing pixel on marketing website only Marketing site visitors USA EU SCCs (LinkedIn standard DPA)

Note — Data Sources (not sub-processors): Meta Ads, Google Ads, LinkedIn Lead Gen, and TikTok act as data sources — they collect lead data from their own users and deliver it to Airdec via inbound webhook. They process personal data as independent controllers, not on Airdec's behalf. No sub-processor DPA is required with them in Airdec's processor chain. The brand (Customer) maintains its own data source agreements with these platforms.

The authoritative, current list is published at https://console.airdec.com/legal/spl.

Annex IV — Standard Contractual Clauses

Where Personal Data is transferred to a Sub-processor outside the EEA not covered by an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller-to-Processor), are incorporated into this DPA by reference, with: