BotGauge Data Processing Agreement

02Key terms

In this DPA:

• "Customer Personal Data" means any personal information inside the data you or your users send to BotGauge, or that BotGauge creates when it observes or tests your AI agents. This includes prompts, responses, conversations, tool activity, test results and reports.
• "Account Data" means the details we hold about the people who use your BotGauge account, such as their name, work email and sign-in details.
• "Usage Data" means general information about how BotGauge is used, such as which features are used and when errors happen. It doesn't include the content of your tests.
• "Privacy Laws" means all privacy and data protection laws that apply to the data, including the EU GDPR, UK GDPR, the Swiss Federal Act on Data Protection, the CCPA and other US state privacy laws, and India's Digital Personal Data Protection Act.
• "Sub-processor" means a company we use to help run BotGauge that may handle Customer Personal Data.
• "Security Incident" means a confirmed breach of our security that leads to Customer Personal Data being accidentally or unlawfully lost, changed, disclosed or accessed.
• "Standard Contractual Clauses" means the clauses approved by the European Commission in 2021 for transferring personal data outside Europe, together with the UK and Swiss versions described in section 7.

Terms such as "controller", "processor", "data subject" and "processing" have the meanings given in the GDPR. For the CCPA, "controller" includes "business" and "processor" includes "service provider".

03Who's responsible for what

Our roles. For Customer Personal Data, you're the controller and we're your processor. That means you decide why and how the data is used, and we handle it only on your behalf. If you're handling the data for your own client, you're the processor and we're your sub-processor.

Where we act for ourselves. For Account Data and Usage Data, we're an independent controller. We use that information to run our relationship with you, keep BotGauge secure, prevent misuse, meet our legal obligations and improve the service, as described in our Privacy Policy.

Your instructions. We handle Customer Personal Data only to provide BotGauge to you and only on your instructions. Your instructions are:

• The Agreement and this DPA.
• The way you set up and use BotGauge, including which agents you test, which tests you run and your data settings.
• Any other reasonable written instructions you give us that are consistent with the Agreement.

If we believe an instruction breaks Privacy Laws, we'll tell you. If the law requires us to handle data in another way, we'll tell you first, unless the law prevents it.

Your responsibilities. You're responsible for:

• Having a lawful basis to collect the data and use it for testing and monitoring.
• Giving any notices and getting any consents your users need.
• Making sure your instructions follow Privacy Laws.
• Not sending us special categories of data (such as health, biometric or financial account data), payment card details or government ID numbers, unless we've agreed to it in writing.

04Our commitments

When we handle Customer Personal Data, we will:

• Use it only for you. We use it only to provide, secure and support BotGauge for you, never for our own purposes or anyone else's.
• Never train on it. We don't use it to train or fine-tune AI models, and we don't use it to build tests or attacks for other customers, unless you opt in in writing.
• Never sell or share it. We don't sell it, and we don't share it for advertising.
• Keep it separate. We don't combine it with data from other customers or other sources, except as needed to provide BotGauge to you.
• Limit who can see it. Only our team members who need access to support you or keep BotGauge secure can access it. Everyone with access is bound by confidentiality obligations.

Content from red-team tests. When we test your agent, it may reveal personal information in its responses, such as a customer record it wasn't supposed to share. We treat any such information as Customer Personal Data and protect it under this DPA. We don't use it for any other purpose.

05Keeping data secure

We use technical and organisational measures to protect Customer Personal Data that are appropriate to the risks involved. These are described in Annex 2.

We review and improve these measures over time. We may update them as long as the overall level of protection doesn't go down.

06Sub-processors

Your approval. You agree that we may use the sub-processors listed in Annex 3 to help us run BotGauge. You also give us general permission to add or replace sub-processors, following the process below.

Our standards for sub-processors. Before we use a sub-processor, we check that it can protect the data properly. Each one signs a written agreement that protects data at least as well as this DPA. We remain responsible to you for what our sub-processors do.

Changes and your right to object. We keep an up-to-date list of our sub-processors at botgauge.com/legal/subprocessors, and you can sign up there to get email updates when it changes. We'll give you at least 30 days' notice before a new sub-processor starts handling Customer Personal Data.

If you have a reasonable data protection concern about a new sub-processor, tell us in writing within those 30 days. We'll work with you in good faith to resolve it. If we can't, you may stop using the affected part of BotGauge, and we'll refund any fees you've paid in advance for the period after you stop.

07Transfers outside your country

We store and process Customer Personal Data in the United States. By using BotGauge, you agree that your data may be transferred there.

When data is transferred from Europe, the UK or Switzerland to a country that those places haven't recognised as giving adequate protection, these safeguards apply automatically, without either of us needing to sign anything further:

• From the EU and EEA: the Standard Contractual Clauses, Module 2 (where you're the controller) and Module 3 (where you're a processor). Clause 7 (the optional docking clause) doesn't apply. Under Clause 9, the 30-day notice process in section 6 applies. The clauses are governed by Irish law, and disputes go to the courts of Ireland. Annexes 1, 2 and 3 of this DPA provide the information the clauses require.
• From the UK: the UK's International Data Transfer Addendum to the Standard Contractual Clauses.
• From Switzerland: the Standard Contractual Clauses, read so that references to the GDPR include the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner acts as the supervisory authority.

If these terms conflict with the Standard Contractual Clauses, the Standard Contractual Clauses win.

Requests from governments. If a government or law enforcement authority asks us for Customer Personal Data, we'll try to redirect it to you. If we're legally required to disclose the data, we'll tell you first where the law allows, so you can challenge the request. We'll never hand over Customer Personal Data voluntarily.

08Helping you meet your obligations

Requests from individuals. People whose data you hold may ask to see, correct, delete or move their data. You can handle most of these requests yourself in BotGauge, for example by deleting or exporting projects. If someone contacts us directly about data you control, we'll tell them to contact you, and we'll let you know about the request. Where you can't handle a request yourself, we'll help you respond.

Privacy assessments and regulators. If you need to carry out a data protection impact assessment, or need to talk to a data protection authority about how BotGauge handles data, we'll give you reasonable help and the information you need that only we have.

Help that goes beyond what's built into BotGauge may come at a reasonable cost, which we'll agree with you first.

09If something goes wrong

If we confirm a Security Incident affecting your Customer Personal Data, we'll tell you without undue delay, and within 72 hours of confirming it.

Our notice will explain what we know at that point: what happened, what types of data and roughly how many people are affected, the likely consequences, and the steps we're taking. If we don't have all the details yet, we'll share them as we learn more.

We'll take reasonable steps to contain the incident and limit the harm, and we'll help you meet any duty you have to notify regulators or the people affected.

Telling you about an incident doesn't mean we accept fault or liability for it. These obligations don't apply to incidents caused by you or your users, such as a shared password or a leaked API key.

10Showing we keep our promises

We keep records that show how we meet this DPA. If you ask in writing, we'll share information that shows our compliance, such as answers to reasonable security questionnaires and any independent security reports or certifications we hold, under confidentiality.

If that information isn't enough to meet a requirement of Privacy Laws, or a regulator asks for it, or after a Security Incident, you may audit how we protect your data. Audits:

• Are limited to one a year, unless a regulator requires more or there's been a Security Incident.
• Need at least 30 days' written notice and a plan we agree on together.
• Take place during business hours, remotely where possible, and without disrupting our operations or other customers' data.
• May be done by you or an independent auditor bound by confidentiality who isn't our competitor.
• Are at your cost.

This section also covers audits under the Standard Contractual Clauses.

11Returning and deleting data

While you use BotGauge. We keep your test content for your plan's retention period, shown in your project settings, after which it's deleted automatically. You can delete projects, workspaces or your organisation at any time. Deleted items can be restored for 14 days in case of mistakes, and are permanently deleted within 30 days.

When the Agreement ends. You'll have 30 days to export your data. After that, we'll delete Customer Personal Data within 30 days. Backup copies are overwritten within a further 7 days, and stay protected under this DPA until they are.

Exceptions. We may keep data longer only where the law requires us to. If so, we'll keep protecting it under this DPA and use it only for that legal purpose.

If you ask, we'll confirm in writing that your data has been deleted.

12US state privacy laws

Under the CCPA and similar US state laws, we act as your service provider. We will not:

• Sell or share Customer Personal Data.
• Keep, use or disclose it for any purpose other than providing BotGauge to you, or outside our direct business relationship with you.
• Combine it with personal information from other sources, except as those laws allow.

We'll follow these laws and give the same level of privacy protection they require. If we can no longer meet these obligations, we'll tell you, and you may take reasonable steps to stop any unauthorised use.

13General terms

Liability. Each party's liability under this DPA is subject to the limits on liability in the Agreement. Nothing in this DPA limits the rights people have directly under the Standard Contractual Clauses.

How long it lasts. This DPA applies for as long as we handle Customer Personal Data for you, including after the Agreement ends until the data is deleted.

Order of priority. If documents conflict, they apply in this order: the Standard Contractual Clauses, then this DPA, then the Agreement, then our Privacy Policy.

Governing law. This DPA is governed by the same law as the Agreement, except that the Standard Contractual Clauses are governed by the law set out in section 7.

Changes. We may update this DPA from time to time, for example when laws change. If a change is important, we'll tell you at least 30 days before it takes effect. We won't make changes that reduce the protection of Customer Personal Data, unless the law requires them.

Contact. Questions about this DPA? Email us at privacy@botgauge.com.

A1Annex 1: Details of the processing

This annex gives the information required by Annex I of the Standard Contractual Clauses.

The parties

• Data exporter: the Customer, as identified in its BotGauge account or the Agreement. Role: controller, or processor for its own clients.
• Data importer: BotGauge AI Inc., 1111B S Governors Ave # 98032, Dover, DE 19904, USA. Contact: privacy@botgauge.com. Role: processor, or sub-processor.

Both parties are treated as having signed this annex when the Customer accepts the Agreement.

Description of the processing

A2Annex 2: How we protect data

This annex gives the information required by Annex II of the Standard Contractual Clauses.

• Encryption. Data is encrypted when it travels over the internet, and stored data is protected with encryption at rest.
• Keeping customers separate. Each customer's data is kept logically separate, so one customer can't see another's data.
• Access control. Access to Customer Personal Data is limited to team members who need it to support customers or keep BotGauge secure, and is removed promptly when it's no longer needed.
• Activity records. We keep records of important account and access activity, so we can investigate issues.
• Protecting credentials. API keys are stored in a form that can't be read back, and any login details you give us for testing your agents are stored encrypted.
• Trusted infrastructure. BotGauge runs on established cloud providers with strong physical and network security.
• People. Everyone on our team who can access customer data is bound by confidentiality obligations and follows our security policies.
• Data minimisation. You control how much data you send to BotGauge, and you can delete your data at any time.
• Sub-processors. We check each sub-processor's security before using it and require it to protect data at least as well as we do.
• Incident response. We have a process for investigating and responding to Security Incidents, as described in section 9.

A3Annex 3: Sub-processors

These are the companies that may handle Customer Personal Data to help us run BotGauge. We'll update this list, and give notice of changes, as described in section 6.

The AI model services we use don't train their models on your data.