Data Processing Agreement

• Controller — the entity that determines the purposes and means of processing personal data (you, the customer).
• Processor — GSL, which processes personal data on behalf of the Controller.
• Sub-processor — a third party engaged by the Processor to process personal data on behalf of the Controller.
• Personal Data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on personal data, including collection, storage, use, disclosure, and deletion.

The Processor shall process personal data only for the following purposes:

• Providing the GSL platform, including AI-powered customer support features.
• Generating AI responses using the Controller's knowledge base and conversation data.
• Producing analytics and reporting on customer support performance.
• Processing billing and subscription management on behalf of the Controller.
• Maintaining system security, integrity, and availability.

The Processor implements and maintains the following technical and organizational security measures:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of data at rest.
• Role-based access controls with least-privilege principles.
• Regular security assessments and vulnerability scanning.
• Logging and monitoring of access to personal data systems.
• Secure software development lifecycle practices, including code review.
• Employee security awareness training and confidentiality agreements.

The Controller authorizes the Processor to engage the following sub-processors:

The Processor shall notify the Controller at least 30 days before adding or replacing a sub-processor. The Controller may object to a new sub-processor within 14 days of notification.

In the event of a personal data breach, the Processor shall notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach. The notification shall include:

• The nature of the breach, including categories of data affected.
• The approximate number of data subjects and records concerned.
• A description of the likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its effects.

Upon termination of the agreement, or upon the Controller's written request, the Processor shall:

• Return all personal data to the Controller in a machine-readable format within 30 days.
• Delete all copies of personal data within 60 days of termination, unless retention is required by applicable law.
• Provide written confirmation of deletion upon request.
• Instruct sub-processors to delete any personal data they hold on behalf of the Controller.

The Processor shall assist the Controller in fulfilling data subject requests (access, rectification, erasure, portability, restriction, and objection) by providing appropriate technical and organizational measures.

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA. The Controller may conduct audits, including inspections, with reasonable notice and during normal business hours.

For questions regarding this DPA or to exercise any rights under it, contact:

Email: dpa@getgsl.com