Widget Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Widget Terms of Service between THERCSGROUP PTE. LTD., trading as SmartAlex ("SmartAlex", "Processor"), and the customer that installs the Widget ("Customer", "Controller"). It governs SmartAlex's processing of personal data on the Customer's behalf in connection with the Widget.
1. Roles and scope
The Customer is the Controller and SmartAlex is the Processor of visitor personal data collected through the Widget. Where the CCPA/CPRA applies, SmartAlex acts as a service provider and not as a third party, and does not sell or share visitor personal data. SmartAlex processes personal data only to provide the Widget and only on the Customer's documented instructions.
2. Customer instructions and compliance
SmartAlex processes personal data only on the Customer's documented instructions unless required otherwise by law that applies to SmartAlex. The Customer is responsible for the lawfulness of the personal data it collects and of its instructions, including notice, consent (including consent to record and to advertising or analytics signals), and honouring opt-out signals. SmartAlex will inform the Customer if, in its opinion, an instruction infringes data protection law.
3. Model training and improvement wall
This section is a core commitment and controls over any general statement about product improvement. SmartAlex will not use visitor personal data processed through the Widget, including the content of voice or chat conversations, to train, fine-tune, or otherwise develop or improve any machine learning model, whether SmartAlex's own or a third party's. Conversation content is processed only to provide the Widget's real-time features to that visitor and the Customer, is logically partitioned per Customer, and is not pooled across Customers for any model-development purpose. Any improvement of the SmartAlex platform is carried out using aggregated or de-identified operational metrics that are not visitor personal data, or using data for which SmartAlex has a separate valid legal basis independent of this DPA. SmartAlex passes equivalent training restrictions to any sub-processor that processes conversation content.
4. Confidentiality and security
SmartAlex ensures that persons authorised to process personal data are bound by confidentiality and process personal data only as instructed. SmartAlex implements appropriate technical and organisational measures, including encryption in transit and at rest, access controls, per-tenant logical isolation, secrets management, audit logging, and vulnerability management, taking into account the state of the art and the risk to data subjects.
5. Sub-processors
The Customer authorises SmartAlex to engage the sub-processors listed in the SmartAlex Sub-processor List, including for hosting and storage and for the speech, language, and telephony processing that powers the Widget's conversations. SmartAlex imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, including the training restriction above, and gives the Customer notice of a new or replacement sub-processor with a reasonable period to object on reasonable grounds.
6. Data subject rights, breach, and DPIAs
Taking into account the nature of processing, SmartAlex assists the Customer to fulfil requests from data subjects to exercise their rights, and provides export and deletion tooling plus a visitor self-service data panel. SmartAlex notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, and provides reasonable assistance with data protection impact assessments and prior consultations.
7. International transfers and deletion
Where processing involves a restricted transfer, the parties rely on an appropriate transfer mechanism, including the Standard Contractual Clauses and the UK Addendum where applicable. On termination, SmartAlex deletes or returns the Customer's visitor personal data as instructed, and the Widget's deletion tooling fans out across the visitor context store, chat sessions and messages, visitor-linked call records, and the relevant advertising-platform deletions.
8. Liability and indemnity
Each party's liability under this DPA is subject to the limitations in the Widget Terms and the SmartAlex Terms of Service. As between the parties, the Customer is responsible, as Controller, for the lawfulness of collection, the provision of notice, the obtaining of consent, the honouring of opt-out signals, and the lawfulness of any advertising or targeting it performs. The Customer will defend, indemnify, and hold harmless SmartAlex and its affiliates from any claim by a data subject, regulator, or other third party, and any resulting loss, to the extent arising out of the Customer's breach of its Controller obligations, including any failure to provide required notice, obtain required consent, or honour an opt-out.
9. Recording and interception
The Customer acknowledges that voice conversations may be recorded and that the Customer, as the party that deploys the Widget and configures the conversation, is responsible for providing any recording notice and obtaining any consent required by law before recording begins. SmartAlex records and processes conversation content on the Customer's instruction and for the sole purpose of providing the Widget, and not for interception, monitoring, or its own independent purposes.
10. Precedence
In the event of a conflict between this DPA and the Widget Terms or the SmartAlex Terms of Service on a data protection matter, this DPA controls. On the specific matter of model training, section 3 controls over any other statement.