Data Processing Agreement (DPA)

Last updated: 24/03/2026

Parties

This Data Processing Agreement ('DPA') is entered into between:

Gazelle Talent – Consultoria Empresarial, Lda, tax identification number 514226226, with registered office at Rua Eng.º Frederico Ulrich, 2650, 4470-605 Maia, Portugal (hereinafter the 'Processor'), and the client entity using the MyDigitalBot service (hereinafter the 'Controller').

Purpose and Scope

This DPA governs the processing of personal data carried out by the Processor on behalf of the Controller in the context of the use of the MyDigitalBot platform.

The Processor undertakes to process personal data only as necessary for the provision of the service and in accordance with the Controller's instructions.

Nature, Purpose and Duration of Processing

Nature: automated processing of personal data.

Purpose: communication, message processing, and conversational automation.

Duration: for the duration of the contractual relationship between the parties.

Types of Personal Data

The personal data processed may include:

identification data (name, email);
user identifiers (e.g. Microsoft Teams, WhatsApp);
message content and interactions;
metadata (IDs, timestamps, statuses);
technical data (logs, IP, errors).

Categories of Data Subjects

employees;
customers;
students;
end users of client organizations.

Processor Obligations

The Processor undertakes to:

process the data solely for the purpose of providing the service;
not use the data for its own purposes;
ensure the confidentiality of persons authorized to process the data;
implement appropriate technical and organizational measures to protect the data;
provide reasonable assistance to the Controller in complying with the GDPR;
notify the Controller without undue delay in the event of a relevant security incident.

Controller Obligations

The Controller undertakes to:

ensure that it has a legal basis for the processing of the data;
inform data subjects about the processing;
use the platform in compliance with applicable law;
not input or process data unlawfully.

Subprocessing (Subprocessors)

The Processor may engage third-party service providers (subprocessors) for the provision of the service.

These include, by way of example:

Microsoft (Teams, Azure);
Vercel (application hosting);
Supabase (database and storage);
OpenAI;
MessageBird and Meta (WhatsApp);
Cloudflare (infrastructure and security).

The Processor seeks to select subprocessors that provide adequate guarantees regarding data protection.

International Data Transfers

Personal data may be processed outside the European Economic Area (EEA), namely when international subprocessors are used.

The Processor seeks to ensure that such processing is carried out with adequate levels of data protection.

Security of Processing

The Processor implements appropriate technical and organizational measures to protect personal data, including:

protection of communications (e.g. HTTPS/TLS);
access control;
monitoring and event logging;
data segregation between organizations (multi-tenant).

Rights of Data Subjects

The Processor shall provide reasonable assistance to the Controller in responding to requests from data subjects, namely requests for access, rectification, or erasure.

Notification of Security Incidents

The Processor shall notify the Controller without undue delay after becoming aware of a relevant personal data breach.

Deletion or Return of Data

Upon request by the Controller or termination of the service, the data may be deleted or returned, unless otherwise required by law.

Audit and Information

The Controller may request reasonable information about the security measures implemented by the Processor.

Duration

This DPA shall remain in force for as long as the Processor processes personal data on behalf of the Controller.

Applicable Law

This agreement is governed by Portuguese law.

Contacts

Gazelle Talent – Consultoria Empresarial, Lda
Email: geral@digik.pt
Website: www.digik.pt