Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service and/or any other agreement governing the use of the Helveris Service (the “Agreement”) between FOP Kushnir Denis Olehovych, an individual entrepreneur registered under the laws of Ukraine, with registered address at 28A Vasylia Tiutiunnyka Street, Kyiv, 03150, Ukraine (“Helveris,” “Processor,” “we,” “us,” or “our”), and the customer entity or person using the Service (“Customer” or “Controller”). [oai_citation:1‡Helveris](https://helveris.com/dpa/)

This DPA applies where Helveris processes Personal Data on behalf of the Customer in connection with the Service. [oai_citation:2‡Helveris](https://helveris.com/dpa/)

1. Definitions

For the purposes of this DPA, Applicable Data Protection Law means any law or regulation applicable to the processing of Personal Data under the Agreement, including, where applicable, the GDPR, UK GDPR, the UK Data Protection Act 2018, and other applicable privacy or data protection laws. Controller means the entity that determines the purposes and means of the processing of Personal Data. Processor means the entity that processes Personal Data on behalf of the Controller. Personal Data means any information relating to an identified or identifiable natural person processed by Helveris on behalf of the Customer under the Agreement. Processing means any operation performed on Personal Data. Subprocessor means any third party engaged by Helveris to process Personal Data on behalf of the Customer. [oai_citation:3‡Helveris](https://helveris.com/dpa/)

2. Scope and Roles of the Parties

This DPA applies only to the extent that Helveris processes Personal Data on behalf of the Customer in providing the Service. As between the parties, the Customer acts as Controller of the Personal Data processed through the Service for its own business purposes, and Helveris acts as Processor, processing such Personal Data only on documented instructions from the Customer, unless otherwise required by applicable law. [oai_citation:4‡Helveris](https://helveris.com/dpa/)

The Customer is solely responsible for determining the legal basis for processing Personal Data, providing appropriate notices to data subjects, obtaining any required consents, and ensuring that its use of the Service complies with Applicable Data Protection Law. [oai_citation:5‡Helveris](https://helveris.com/dpa/)

3. Subject Matter, Duration, Nature, and Purpose of Processing

Subject matter of processing: Helveris provides an AI-powered sales and support assistant for websites that may process Personal Data submitted through website assistance flows, forms, integrations, exports, notifications, and related service functionality. This includes website guidance, answering visitor questions, lead capture, and routing requests into customer workflows. This wording is an updated product description based on the current DPA’s “AI-powered website chat and lead capture service.” [oai_citation:6‡Helveris](https://helveris.com/dpa/)

Duration of processing: Helveris will process Personal Data for the duration of the Agreement and for any additional period required to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, or complete deletion or return procedures under this DPA. [oai_citation:7‡Helveris](https://helveris.com/dpa/)

Nature of processing: Processing may include collection, recording, structuring, storage, organization, retrieval, consultation, transmission, export, synchronization, hosting, analysis, support access, deletion, and other operations necessary to provide the Service. [oai_citation:8‡Helveris](https://helveris.com/dpa/)

Purpose of processing: The purpose of processing is to enable Helveris to provide the Service to the Customer, including website assistance interactions, lead capture, qualification, notification workflows, storage of request history, export or synchronization to customer-selected tools, support, maintenance, and security. This is a terminology update from the current page, which refers to “AI chat interactions.” [oai_citation:9‡Helveris](https://helveris.com/dpa/)

4. Categories of Data and Data Subjects

Categories of Personal Data may include name, email address, phone number, website interaction history, request content submitted through the Service, other personal, contact, or business information voluntarily submitted by website visitors, account and contact details of Customer representatives, and technical and usage data associated with the Service where such data relates to an identifiable person. This is adapted from the current categories listed on the page. [oai_citation:10‡Helveris](https://helveris.com/dpa/)

Categories of Data Subjects may include website visitors interacting with the Customer’s Helveris-powered assistant, leads and prospective customers of the Customer, Customer representatives, employees, contractors, or other authorized users, and other persons whose Personal Data is submitted by the Customer through the Service. This is based on the current DPA wording and updated to match the new product positioning. [oai_citation:11‡Helveris](https://helveris.com/dpa/)

5. Customer Instructions

Helveris shall process Personal Data only on documented instructions from the Customer, as reflected in the Agreement, the Customer’s use and configuration of the Service, the Customer’s support requests and written instructions, and other documented communications between the parties. [oai_citation:12‡Helveris](https://helveris.com/dpa/)

Helveris may process Personal Data as necessary to provide the Service as configured by the Customer, maintain, secure, and support the Service, prevent fraud, abuse, and security threats, and comply with applicable law. If Helveris believes that a Customer instruction violates Applicable Data Protection Law, Helveris may notify the Customer and suspend the affected processing until the issue is resolved. [oai_citation:13‡Helveris](https://helveris.com/dpa/)

6. Confidentiality

Helveris shall ensure that persons authorized to process Personal Data are subject to appropriate confidentiality obligations or are under an appropriate statutory obligation of confidentiality. [oai_citation:14‡Helveris](https://helveris.com/dpa/)

7. Security Measures

Helveris shall implement reasonable and appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. Such measures may include, as appropriate, access controls and authentication measures, role-based access limitations, transport and storage safeguards, infrastructure and application monitoring, backup and recovery measures, security patching and vulnerability management, and logging and incident response procedures. [oai_citation:15‡Helveris](https://helveris.com/dpa/)

The Customer acknowledges that no internet-based service can guarantee absolute security. [oai_citation:16‡Helveris](https://helveris.com/dpa/)

8. Subprocessors

The Customer authorizes Helveris to engage Subprocessors to process Personal Data on the Customer’s behalf, provided that Helveris imposes data protection obligations on such Subprocessors that are no less protective than those set out in this DPA, to the extent applicable to the nature of the services provided. [oai_citation:17‡Helveris](https://helveris.com/dpa/)

Subprocessors may include providers of hosting, cloud infrastructure, notifications, analytics, email, CRM connectivity, support tooling, payment services, and other service providers necessary to operate the Service. Where reasonably requested by the Customer, Helveris shall provide available information about current Subprocessors. Helveris remains responsible for the performance of its Subprocessors’ obligations to the extent required by Applicable Data Protection Law. [oai_citation:18‡Helveris](https://helveris.com/dpa/)

9. International Transfers

The Customer acknowledges that Helveris may process Personal Data in countries other than the country in which the data was originally collected, including through Subprocessors or infrastructure providers. Where Applicable Data Protection Law requires specific safeguards for international transfers, the parties agree to cooperate in good faith to implement appropriate transfer mechanisms, which may include adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms. To the extent required and applicable, the parties agree that the relevant approved transfer mechanism is deemed incorporated into this DPA by reference. [oai_citation:19‡Helveris](https://helveris.com/dpa/)

10. Assistance to the Customer

Taking into account the nature of the processing and the information available to Helveris, Helveris shall provide reasonable assistance to the Customer, insofar as commercially reasonable and legally required, in relation to responding to requests from data subjects, data protection impact assessments, consultation with supervisory authorities, demonstrating compliance with Applicable Data Protection Law, and investigating security incidents affecting Personal Data. Helveris may charge reasonable costs for assistance that goes beyond standard support obligations. [oai_citation:20‡Helveris](https://helveris.com/dpa/)

11. Data Subject Requests

If Helveris receives a request from a data subject relating to Personal Data processed on behalf of the Customer, Helveris may, where appropriate, direct the requester to the Customer and/or notify the Customer of the request. Helveris shall not respond to such requests except on the Customer’s documented instructions, where required by applicable law, or where necessary to confirm that the request has been forwarded. [oai_citation:21‡Helveris](https://helveris.com/dpa/)

12. Personal Data Breach

Helveris shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Customer. Such notice shall include, to the extent available at the time, a description of the nature of the breach, the categories of affected data where known, the likely consequences where known, and the measures taken or proposed to address the breach. Helveris’s notification of a Personal Data Breach shall not be construed as an admission of fault or liability. [oai_citation:22‡Helveris](https://helveris.com/dpa/)

13. Deletion or Return of Personal Data

Upon termination or expiration of the Agreement, Helveris shall, upon Customer request and subject to applicable law and technical feasibility, delete Customer Personal Data or return Customer Personal Data and delete existing copies. Helveris may retain Personal Data to the extent required by applicable law, for legitimate backup, security, fraud prevention, dispute resolution, or recordkeeping purposes, provided that such retained data remains protected in accordance with this DPA. [oai_citation:23‡Helveris](https://helveris.com/dpa/)

14. Audit and Information Rights

Helveris shall make available to the Customer information reasonably necessary to demonstrate compliance with this DPA. Where required by Applicable Data Protection Law, and no more than once per year unless a Personal Data Breach or regulatory request justifies additional review, the Customer may request reasonable audit information or documentation. Any audit must be limited to information relevant to the Service, avoid unreasonable disruption to Helveris’s operations, be subject to appropriate confidentiality obligations, and not require disclosure of other customers’ information, trade secrets, internal security details beyond what is reasonably necessary, or information that would create security risk. Helveris may satisfy audit requests through security summaries, certifications, questionnaires, or similar documentation where appropriate. [oai_citation:24‡Helveris](https://helveris.com/dpa/)

15. Liability

The liability of each party under this DPA shall be subject to the exclusions and limitations of liability set out in the Agreement, unless Applicable Data Protection Law requires otherwise. [oai_citation:25‡Helveris](https://helveris.com/dpa/)

16. Order of Precedence

If there is a conflict between this DPA and the Agreement solely with respect to data protection matters, this DPA shall prevail to the extent of that conflict. [oai_citation:26‡Helveris](https://helveris.com/dpa/)

17. Governing Law

This DPA shall be governed by the governing law set out in the Agreement, unless Applicable Data Protection Law requires otherwise for a specific transfer mechanism or mandatory legal provision. [oai_citation:27‡Helveris](https://helveris.com/dpa/)

18. Contact

Questions regarding this DPA may be sent to FOP Kushnir Denis Olehovych, 28A Vasylia Tiutiunnyka Street, Kyiv, 03150, Ukraine, or by email at support@helveris.com. [oai_citation:28‡Helveris](https://helveris.com/dpa/)

Annex 1 — Description of Processing

A. Subject Matter
Provision of an AI-powered website assistant and related lead capture, qualification, storage, notification, export, and integration services. This wording updates the current page’s “website chat widget” language while preserving the same operational scope. [oai_citation:29‡Helveris](https://helveris.com/dpa/)

B. Duration
For the duration of the Agreement and any period necessary for deletion, return, backup rotation, compliance, dispute resolution, or lawful retention. [oai_citation:30‡Helveris](https://helveris.com/dpa/)

C. Nature and Purpose of Processing
Collect and process visitor-submitted lead data; store interaction history and contact records; notify the Customer about new leads or requests; export and synchronize data to customer-selected systems; support assistant configuration based on Customer-provided content; maintain, secure, troubleshoot, and improve the Service. This is adapted from the current annex wording. [oai_citation:31‡Helveris](https://helveris.com/dpa/)

D. Categories of Data Subjects
Website visitors; leads and prospective customers; Customer account users and representatives; other individuals whose data is submitted through the Service. [oai_citation:32‡Helveris](https://helveris.com/dpa/)

E. Categories of Personal Data
Name; email address; phone number; interaction history; free-text requests and submitted details; account and business contact information; technical identifiers and usage logs where linked to an identifiable person. This is adapted from the current annex categories. [oai_citation:33‡Helveris](https://helveris.com/dpa/)

F. Sensitive Data
The Customer shall not intentionally submit special categories of personal data or sensitive data to the Service unless expressly agreed in writing and supported by an appropriate lawful basis and additional safeguards. [oai_citation:34‡Helveris](https://helveris.com/dpa/)

G. Processing Operations
Collection, recording, organization, storage, retrieval, consultation, hosting, use, transmission, export, synchronization, deletion, and security-related processing. [oai_citation:35‡Helveris](https://helveris.com/dpa/)

Annex 2 — Security Measures Summary

• controlled access to systems and accounts;
• authentication and credential protection measures;
• logging and monitoring;
• encrypted transmission where appropriate;
• infrastructure and application security controls;
• backup and recovery procedures;
• incident detection and response measures; and
• confidentiality obligations for authorized personnel. [oai_citation:36‡Helveris](https://helveris.com/dpa/)