Data Processing Addendum
Last Updated: June 24, 2025
This Data Processing Addendum ('DPA') forms part of the Terms of Service or other written agreement between Chablyy ('Processor') and the customer ('Controller') (collectively, the 'Agreement') to reflect the parties' agreement with regard to the Processing of Personal Data. This DPA applies to the extent that Chablyy processes Personal Data on behalf of the Controller in the course of providing the Services.
Scope and Application
This DPA applies to the extent that Chablyy processes Personal Data on behalf of the Controller in the course of providing the Services. The parties acknowledge and agree that the Controller is the data controller and Chablyy is the data processor in relation to Personal Data that Chablyy processes on behalf of the Controller in the course of providing the Services.
Categories of Data Subjects
Data subjects include the Controller's customers, employees, and other individuals whose Personal Data is submitted to the Services by the Controller. The types of Personal Data processed may include: contact information (name, email address, phone number), account information, usage data, and any other Personal Data that the Controller chooses to submit to the Services.
Nature and Purpose of Processing
The Processor will process Personal Data as necessary to provide the Services pursuant to the Agreement, and as further instructed by the Controller in its use of the Services. The purpose of processing is to provide AI chatbot services, including but not limited to: message processing, lead capture, analytics, and customer support.
Security Measures
The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including: encryption of personal data, ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems, ability to restore availability and access to personal data in a timely manner, and regular testing and evaluation of effectiveness.
Sub-processors
The Controller grants the Processor general written authorization to engage sub-processors. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors, thereby giving the Controller the opportunity to object to such changes. The Processor shall impose the same data protection obligations on any sub-processor.
Data Subject Rights
The Processor shall assist the Controller in responding to requests from data subjects to exercise their rights under applicable data protection laws, including rights of access, rectification, erasure, and data portability. The Processor shall promptly notify the Controller if it receives a request from a data subject.
Contact Information
For any questions regarding this DPA or data processing activities, please contact us at: Chablyy, Balkot, Nepal, 44800, or by email at privacy@chablyy.com. Our Data Protection Officer can be reached at dpo@chablyy.com. You can also visit our website at chablyy.com for more information.