Data processing addendum

How we process personal data on behalf of business customers.

1. Scope and parties

  • This addendum is between the business customer that accepted the Cotlet terms of service ("Customer") and Take Group sp. z o.o., ul. Wincentego Janasa 4, 40-855 Katowice, Poland, entered in the National Court Register (KRS) under number 0000871398 by the District Court Katowice-Wschód in Katowice, 8th Commercial Division of the National Court Register, NIP 6342984273, REGON 387616994, share capital PLN 5,000 ("Processor"). It forms part of the terms and applies automatically, without signature, whenever the Processor processes Customer Personal Data.
  • "Customer Personal Data" means personal data that the Processor processes on the Customer's behalf in providing the Service, mainly data in the Customer's Connected Apps and data about the Customer's users. "Data Protection Law" means the GDPR, the UK GDPR and the Data Protection Act 2018, the Swiss data protection act and US state privacy laws, as they apply.
  • The Customer is the controller, or a processor acting for its own controller; the Processor is its processor or subprocessor. For its own account, billing and security data, the Processor is a controller under its privacy policy.
  • Write to contact@cotlet.dev to receive a countersigned copy of this addendum.

2. Processing on instructions

  • The Processor processes Customer Personal Data only on the Customer's documented instructions: the terms, this addendum, the settings the Customer chooses and the calls its users, agents and scripts send. Annex 1 describes the processing.
  • The Processor tells the Customer if it believes an instruction breaks Data Protection Law, and processes otherwise only where the law requires it, informing the Customer first unless the law forbids that.
  • The Customer is responsible for the lawfulness of its instructions, for having a legal basis and for informing the people concerned. The Customer will not instruct processing of special categories of data or criminal records unless the law allows it.

3. Confidentiality and security

  • Everyone at the Processor with access to Customer Personal Data is bound by confidentiality and has access only as far as their work requires.
  • The Processor keeps the technical and organizational measures in Annex 2, appropriate to the risk under GDPR Article 32. It may improve them, but not lower the overall level of protection.

4. Subprocessors

  • The Customer gives general authorization to use subprocessors. The current list is on the subprocessors page.
  • The Processor announces a new subprocessor at least 14 days in advance. The Customer may object on reasonable data protection grounds; if the parties cannot resolve it, the Customer may end the affected part of the Service and receive a refund of prepaid fees for the time after it ends.
  • Each subprocessor is bound by written terms that protect data at least as well as this addendum. The Processor remains responsible to the Customer for its subprocessors.

5. Assistance

  • The Processor helps the Customer, by appropriate measures, to answer requests from data subjects, and forwards any such request it receives without answering it, unless the Customer authorizes it to.
  • The Processor gives reasonable help with data protection impact assessments, consultations with supervisory authorities and the Customer's security obligations, as far as they concern the Service.

6. Personal data breaches

  • The Processor notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting Customer Personal Data.
  • The notice describes, as far as known, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed, and names a contact. Information may follow in stages.

7. Deletion and return

  • Connected App sessions are deleted when the Customer disconnects an app or closes its account. Call content is not kept after a call completes.
  • When the Service ends, the Processor deletes the remaining Customer Personal Data within 30 days, and from backups within a further 35 days, unless the law requires it to keep some. Before the end, the Customer can export its data from the dashboard or by asking us.

8. Information and audits

  • The Processor makes available the information needed to show compliance with this addendum and GDPR Article 28.
  • The Customer may audit compliance once a year, or after a breach, with 30 days' notice, during business hours and under confidentiality, at its own cost, by itself or an independent auditor bound by confidentiality. The Processor may answer first with written answers or third-party reports, where they cover the request.

9. International transfers

  • The Processor processes Customer Personal Data in the European Union. It transfers it outside the EEA, the UK or Switzerland only with appropriate safeguards under Chapter V of the GDPR.
  • Where the Processor transfers data to a subprocessor in a country without an adequacy decision, it concludes the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 3, with that subprocessor, or relies on its certification under the EU-US Data Privacy Framework.
  • Where the Customer is outside the EEA and the Processor sends Customer Personal Data back to it, the Standard Contractual Clauses, Module 4, are incorporated by reference, with Polish law and courts. For the UK, the International Data Transfer Addendum applies to those clauses.

10. US service provider terms

  • For US state privacy laws, the Processor is a service provider. It will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, or combine it with personal data from other sources, except as those laws allow.
  • The Processor will comply with those laws, provide the same level of protection they require, and tell the Customer if it can no longer meet its obligations. The Customer may take reasonable steps to stop and remedy unauthorized use.

11. Liability and order of precedence

  • Liability under this addendum is subject to the limits in the terms, as far as Data Protection Law allows.
  • If this addendum conflicts with the terms, this addendum prevails for the processing of Customer Personal Data. If the Standard Contractual Clauses apply, they prevail over both.

12. Annex 1: Details of processing

  • Subject matter and duration: providing the Service under the terms, for as long as the Customer uses it, and until deletion under this addendum.
  • Nature and purpose: keeping encrypted sessions for Connected Apps; performing the reads and writes the Customer's users, agents and scripts instruct; returning results; keeping call records for billing and security; support.
  • Data subjects: the Customer's users; people whose data is in the Customer's Connected Apps, such as members, customers, clients, guests and correspondents.
  • Categories of data: names, contact details, account and profile data, content of posts, messages, bookings and other records in the Connected Apps, and technical data such as IP addresses. The Service is not intended for special categories of data.

13. Annex 2: Technical and organizational measures

  • Encryption: Connected App sessions encrypted at rest with AES-256; all traffic encrypted in transit with TLS.
  • Isolation: one isolated session per user and Connected App, never shared between customers; the AI model never receives sessions or logins.
  • Minimization: no Connected App passwords stored; call content not kept after a call; tokens removed from logs; logs kept for a short time.
  • Access control: staff access by least privilege, with individual accounts and multi-factor authentication, logged and reviewed.
  • Availability: encrypted backups, monitoring of integrations and infrastructure, documented recovery steps.
  • Hosting: servers in the European Union with a provider certified to ISO 27001; protection against network attacks by our CDN.
  • Organization: confidentiality obligations for staff, an incident response procedure, regular updates and review of these measures.