Chai — Data Processing Addendum (DPA)
⚠️ TEMPLATE — NOT LEGAL ADVICE. AI-generated starting draft. DPAs carry specific statutory requirements (GDPR Art. 28; CCPA/CPRA "service provider" contract terms; other US state laws). Have a qualified attorney review and complete it — especially Annex II (your *actual* security measures) and Annex III (your *actual* subprocessors) — and replace every [BRACKETED] placeholder.
This Data Processing Addendum ("DPA") forms part of, and is subject to, the Terms of Service (the "Agreement") between [COMPANY LEGAL NAME] ("Chai" or "Processor") and the customer ("Customer" or "Controller"). It applies where Chai processes Personal Data on Customer's behalf in providing the Services. If there is a conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA controls.
1. Definitions
"Applicable Data Protection Laws" means all privacy and data-protection laws applicable to the processing of Personal Data under the Agreement, including, as applicable, the California Consumer Privacy Act as amended (CCPA/CPRA), other US state privacy laws, and the EU/UK General Data Protection Regulation ("GDPR").
"Personal Data," "Processing," "Controller," "Processor," "Data Subject," and "Personal Data Breach" have the meanings given in Applicable Data Protection Laws. "Customer Data" has the meaning in the Agreement. "Subprocessor" means a third party engaged by Chai to process Personal Data.
2. Roles and scope of processing
2.1 As between the parties, Customer is the Controller (or a processor acting on behalf of its own controllers) of the Personal Data contained in Customer Data, and Chai is the Processor (or subprocessor).
2.2 Instructions. Chai will process Personal Data only (a) to provide and support the Services, (b) in accordance with Customer's documented lawful instructions (the Agreement and Customer's use and configuration of the Services constitute such instructions), and (c) as required by law — in which case, where permitted, Chai will inform Customer first. Chai will notify Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws.
2.3 No sale; limited use (CCPA/CPRA). Chai will not sell or share Personal Data, will not retain, use, or disclose it for any purpose other than performing the Services (or as otherwise permitted by CCPA/CPRA), and will not combine it with data from other sources except as permitted. Chai certifies it understands and will comply with these restrictions.
2.4 The subject matter, duration, nature, and purpose of processing, the types of Personal Data, and the categories of Data Subjects are described in Annex I.
3. Chai's obligations
Chai will: (a) ensure persons authorized to process Personal Data are bound by confidentiality; (b) implement and maintain the technical and organizational security measures described in Annex II, appropriate to the risk; (c) taking into account the nature of processing and information available to it, assist Customer, by appropriate measures, in fulfilling Customer's obligations to respond to Data Subject requests and to ensure security, breach notification, and (where applicable) data-protection impact assessments; and (d) make available to Customer information reasonably necessary to demonstrate compliance with this DPA.
4. Personal Data Breach
Chai will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data, provide information reasonably available to it, and take reasonable steps to mitigate and cooperate with Customer. Chai's notification is not an acknowledgment of fault or liability.
5. Subprocessors
5.1 Customer provides a general authorization for Chai to engage the Subprocessors listed in Annex III to process Personal Data.
5.2 Chai will impose data-protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains responsible for its Subprocessors' performance.
5.3 Chai will give Customer [at least 30 days'] notice of any intended addition or replacement of a Subprocessor. Customer may object on reasonable data-protection grounds within [15 days]; the parties will work in good faith to resolve the objection, and if they cannot, Customer may terminate the affected Services [per the Agreement].
6. Data Subject rights
Chai will, insofar as reasonably possible, assist Customer with appropriate technical and organizational measures to respond to Data Subject requests. If Chai receives a request directly from a Data Subject, it will not respond except to confirm the request relates to Customer, and will promptly forward it to Customer.
7. International transfers
[If Chai processes Personal Data subject to the EU/UK GDPR: the parties incorporate the applicable Standard Contractual Clauses (and the UK Addendum) by reference, completed as set out in an exhibit. Otherwise, delete this section.]
8. Audits
Chai will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits by Customer or its mandated auditor. To minimize disruption and protect other customers' confidentiality, audits will occur on [at least 30 days'] prior written notice, no more than once per 12 months (except as required by a supervisory authority or following a Breach), during business hours, subject to confidentiality, and may be satisfied by Chai's then-current third-party reports, certifications, or a written questionnaire response.
9. Return and deletion
On termination or expiry of the Services, Chai will, at Customer's choice, delete or return Customer Data and delete existing copies within [30 days], except to the extent retention is required by law (in which case Chai will protect it and process it only as required for that purpose).
10. Liability
Each party's liability arising out of or related to this DPA, whether in contract, tort, or any other theory, is subject to the exclusions and limitations of liability set out in the Agreement. This DPA does not increase either party's liability beyond what the Agreement permits.
11. General
This DPA is governed by the same law as the Agreement (unless Applicable Data Protection Laws require otherwise). Except as amended here, the Agreement remains in full force. There are no third-party beneficiaries.
Annex I — Details of Processing
- Controller / data exporter: Customer (the business using the Services).
- Processor / data importer: [COMPANY LEGAL NAME] (Chai).
- Subject matter: provision of the Chai Services (Chai-CRM and/or Chai-HR).
- Duration: the term of the Agreement, plus the deletion period in Section 9.
- Nature and purpose: hosting, storage, and processing of Customer Data to provide CRM and/or HR software functionality (e.g., managing quotes, production, follow-ups, clients/prospects, employees, documents, deadlines, and related records) and related support.
- Types of Personal Data (as entered by Customer): names, contact details (email, phone, address), employment and HR records, payroll/chargeback data, documents, and insurance-related records (e.g., policy, quote, or production information). [Customer determines the actual data it enters; update to match.]
- Special categories of data: [Chai does not request special-category data; Customer should not input it unless the parties agree in writing and additional safeguards are in place.]
- Categories of Data Subjects: Customer's employees, staff, clients, customers, prospects, and business contacts.
Annex II — Technical and Organizational Security Measures
*(Describe Chai's actual measures — verify and complete before use.)*
- Encryption in transit: all traffic served over HTTPS/TLS.
- Tenant isolation: each customer's data is namespaced and isolated server-side; access is scoped to the authenticated session's own workspace.
- Authentication & access control: hashed passwords; signed, expiring session tokens with revocation; role-based permissions (admin / manager / rep); owner-gated sensitive actions.
- Least privilege & secrets: application secrets stored in the platform's secret store; access to production limited to authorized personnel.
- Infrastructure: hosted on Cloudflare's platform (which provides infrastructure-level security and encryption at rest for the managed database). [Confirm specifics with your provider.]
- Logging & monitoring: request and error logging. [Describe retention and monitoring.]
- Backups & recovery: [Describe your backup/restore approach and cadence.]
- Vendor management: subprocessors are contractually bound to protect data.
- [Add: employee confidentiality obligations, onboarding/offboarding, incident response plan, vulnerability management, and any certifications.]
Annex III — Approved Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, infrastructure, CDN, database | United States |
| Stripe, Inc. | Payment processing / billing | United States |
| Resend (or [your email provider]) | Transactional / account email | United States |
| [Add any others — e.g., analytics, support tooling] |
*Current as of [DATE]. See Section 5 for how changes are notified.*