4Sign inClaim 50% Off
← All Legal Documents

Last updated:

Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between FrogBot, Inc. ("FrogBot") and the Customer identified in the Agreement ("Customer"), and governs FrogBot's processing of Personal Data contained within Customer's Submitted Data on the Dojo cloud platform.

1. Definitions and Roles of the Parties

  1. Roles: With respect to Personal Data stored or processed within Customer's hosted FrogBot applications on Dojo ("Customer Personal Data"), Customer acts as the Controller (or Business under the CCPA) and FrogBot, Inc. acts as the Processor (or Service Provider under the CCPA).
  2. Applicable Data Protection Law: Refers to all laws and regulations applicable to the processing of Personal Data under the Agreement, including the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the CPRA ("CCPA").

2. Processing Instructions and Scope

  1. Customer Instructions: FrogBot will process Customer Personal Data only in accordance with Customer's documented instructions—namely, to host, run, back up, and transmit data for Customer's deployed FrogBot applications as configured by Customer—unless required otherwise by applicable law.
  2. CCPA Service Provider Certification: FrogBot certifies that it will not: (a) "sell" or "share" (as defined in the CCPA) Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose other than performing the Services specified in the Agreement; or (c) combine Customer Personal Data with personal information received from other sources except as permitted by law to perform the Services.
  3. No Foundation Model Training: FrogBot does not use Customer Personal Data or Customer application source code to train foundation AI models.

3. Confidentiality and Security

  1. Confidentiality: FrogBot ensures that all personnel authorized to process Customer Personal Data are bound by written confidentiality obligations.
  2. Security Measures: FrogBot implements and maintains the technical and organizational security measures described in the Security Addendum (including AES-256 encryption at rest, TLS encryption in transit, tenant isolation, and access controls).
  3. Personal Data Breach Notification: FrogBot will notify Customer without undue delay (and in any event within 72 hours) after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data, providing information reasonably necessary to assist Customer in meeting its regulatory notification obligations.

4. Subprocessors

  1. General Authorization: Customer grants FrogBot general written authorization to engage third-party infrastructure subprocessors (such as cloud compute, managed Postgres/storage infrastructure, and optional AI model gateway providers enabled by Customer) to support delivery of the Service.
  2. Subprocessor Obligations: FrogBot enters into written agreements with each subprocessor imposing data protection and security obligations no less protective than those in this DPA, and remains liable for the performance of its subprocessors' obligations.

5. Data Subject Requests and Assistance

Taking into account the nature of the processing, FrogBot will provide reasonable assistance to Customer (via FrogBot's built-in Admin UI, REST/Local APIs, and support channels) to enable Customer to respond to requests from Data Subjects exercising their rights of access, rectification, erasure, or data portability.

6. International Transfers

Where processing involves a restricted transfer of Customer Personal Data from the EEA, UK, or Switzerland to the United States, the Standard Contractual Clauses (Module Two: Controller to Processor, and Module Three: Processor to Processor, as adopted by European Commission Decision (EU) 2021/914) and the UK International Data Transfer Addendum are hereby incorporated by reference.

7. Deletion and Export of Data

At any time during the Subscription Term, Customer may export all Customer Personal Data in standard SQL (pg_dump), JSON, or CSV formats. Following termination or expiration of the Subscription, FrogBot will delete or overwrite Customer Personal Data from active production systems within 30 days (and from encrypted backups according to standard backup rotation schedules), unless retention is required by applicable law.