Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service for ZENIA Assistant / buildbot.ro and applies where ZENIA Assistant processes Customer Personal Data on behalf of a Customer under the GDPR.

ZENIA Assistant is a software product operated under the ZENIA Assistant / buildbot.ro brand by Popescu Adrian Florin, an individual operator based in Romania. ZENIA Assistant is not a registered company or separate legal entity.

For the purposes of this DPA, “Customer” means the person or organisation that creates or uses a ZENIA account, configures a workspace, deploys the chatbot widget, uploads files, submits URLs for crawling, or otherwise provides content for processing through the Service.

This DPA is intended to apply to both free evaluation use and paid plans once paid checkout is enabled. Paid plans are being prepared for launch through Paddle. Until Paddle checkout is enabled, paid access may be unavailable or limited to approved early-access users.

For Customer Personal Data submitted to the Service by the Customer, including content, files, URLs, chatbot conversations, and end-user messages processed through the deployed widget, the Customer acts as Data Controller and Popescu Adrian Florin, operating ZENIA Assistant / buildbot.ro, acts as Data Processor processing such data on documented instructions from and on behalf of the Customer.

For personal data processed for independent operational purposes, such as account administration, platform security, abuse prevention, direct support, billing setup, legal compliance, and communications with registered users, Popescu Adrian Florin may act as an independent Data Controller. These controller activities are described in the Privacy Policy.

Where Paddle is used for paid checkout, subscriptions, taxes, invoices, receipts, chargebacks, refunds, or buyer support, Paddle may process buyer and payment data under its own role as payment provider and/or merchant of record. Paddle is not used to process chatbot conversation content or Customer knowledge-base content unless a future integration expressly states otherwise.

This DPA covers the processing of Customer Personal Data required to provide the ZENIA Assistant platform and related services described in the Terms of Service. Processing begins when the Customer creates an account, configures a workspace, deploys a chatbot, uploads content, submits URLs for crawling, or otherwise uses a feature that processes Customer Personal Data.

Processing continues for as long as the Customer account, workspace, knowledge source, chatbot deployment, or related subscription remains active, and for any additional period required for deletion, backup rotation, legal retention, dispute handling, or security logging as described in the Privacy Policy and Terms of Service.

The nature and purpose of processing is to provide, operate, maintain, secure, and improve the ZENIA Assistant platform. This includes delivering chatbot interactions on behalf of the Customer's website or application; indexing, storing, querying, and retrieving Customer knowledge bases; crawling website content submitted by the Customer; processing uploaded files and custom text entries; generating embeddings and AI responses using indexed sources; providing dashboard, API, workspace, analytics, and support functionality; enforcing plan limits; detecting abuse or security incidents; and maintaining operational logs needed for reliability and troubleshooting.

Processing is limited to what is necessary for providing the Service, following the Customer's configuration and documented instructions, unless applicable law requires otherwise.

Depending on the Customer's deployment and configuration, the following categories of Customer Personal Data may be processed:

• Identification data, such as names, usernames, email addresses, account identifiers, or signatures included in Customer-submitted content.
• Contact data, such as email addresses, telephone numbers, postal addresses, or business contact details included in uploaded or crawled content.
• Communication data, such as messages submitted by end-users through the chatbot widget and AI responses generated from indexed sources.
• Technical data, such as IP addresses, device information, browser type, session identifiers, request metadata, access logs, and security logs.
• Content data, such as text, files, website pages, PDFs, DOCX files, TXT/MD/XML files, and custom entries submitted by the Customer that may contain personal data.
• Usage data, such as feature interactions, message counts, crawl status, source references, timestamps, and workspace activity.

The Customer is responsible for ensuring that personal data submitted to the Service is lawful, limited to what is necessary, and covered by an appropriate legal basis.

The following categories of data subjects may be affected by processing under this DPA:

• The Customer's employees, administrators, contractors, and authorised users.
• End-users or visitors who interact with a chatbot widget deployed by the Customer.
• Individuals whose personal data appears in Customer-submitted files, crawled website pages, custom text entries, or other knowledge sources.
• Individuals who contact the Customer and whose messages are processed through the Service.
• Individuals whose technical data is processed when using or interacting with the Customer's deployed chatbot or ZENIA workspace.

ZENIA Assistant processes Customer Personal Data only on documented instructions from the Customer, including this DPA, the Terms of Service, the Customer's dashboard configuration, API calls, integrations, widget deployment, uploaded files, submitted URLs, custom text entries, deletion requests, and written support instructions.

If Popescu Adrian Florin, operating ZENIA Assistant / buildbot.ro, is required to process Customer Personal Data under applicable EU, Romanian, or Member State law, the Customer will be informed before processing unless that law prohibits such notice on important public-interest grounds.

If an instruction appears to infringe applicable data-protection law, the Customer may be notified and the relevant processing may be paused or refused until the instruction is clarified.

Customer Personal Data is treated as confidential. Persons authorised to process Customer Personal Data must be subject to appropriate confidentiality obligations, whether contractual, statutory, or arising from their role.

Customer Personal Data will not be intentionally disclosed to third parties except where necessary to provide the Service through authorised Sub-processors, where instructed by the Customer, where required for security or legal compliance, or where required by applicable law or a binding order from a competent authority.

ZENIA Assistant maintains technical and organisational measures intended to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

Current measures include HTTPS for encrypted connections, password hashing, secure HTTP-only session cookies, role-based access controls, administrative access restrictions, input validation and abuse-prevention controls, operational logging, backup and recovery practices, and incident review procedures where appropriate.

No system can be guaranteed completely secure. Measures may evolve as the platform changes. A current summary of security practices is available in the Security Policy or upon written request to contact@buildbot.ro.

The Customer grants the operator of buildbot.ro general written authorisation to engage Sub-processors where necessary to provide the Service. Sub-processors may include hosting and infrastructure providers, database or storage providers where operated as third-party services, AI inference and embedding providers, email delivery providers, monitoring or support providers, and Paddle for payment, subscription, tax, invoice, refund, cancellation, renewal, and chargeback handling if Paddle checkout is enabled.

Nodemailer is an internal software library and is not itself a Sub-processor. A database technology or internal library should not be treated as a Sub-processor unless a third-party provider processes personal data for ZENIA in the production environment.

Named production Sub-processors, once confirmed, should be listed on the Sub-processors page together with their purpose, data categories, processing region where known, status, and relevant privacy or data-processing information. Additions or replacements of Sub-processors will be notified where required by applicable law or contract.

ZENIA Assistant will provide reasonable assistance to the Customer in fulfilling obligations to respond to data-subject requests under applicable data-protection law, including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where applicable.

Assistance may include dashboard functions for export, deletion, source removal, account deletion, workspace management, and written support for verified requests that cannot be completed directly through the dashboard.

Requests should be sent to contact@buildbot.ro and should include enough information to identify the relevant Customer account, workspace, domain, data subject, and requested action. Reasonable identity and authority verification may be required before action is taken.

ZENIA Assistant will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data processed on behalf of the Customer. Where feasible, notification will be provided within 72 hours of becoming aware of the breach.

The notification will include, to the extent available, the nature of the breach, the approximate categories and number of affected data subjects and records, likely consequences, measures taken or proposed to address the breach, and contact information for follow-up.

Notifications will be sent to the primary account email, workspace owner email, or another contact channel reasonably available for the Customer.

Upon termination, account deletion, workspace deletion, or written instruction from the Customer, ZENIA Assistant will delete or return Customer Personal Data processed on behalf of the Customer, unless retention is required by applicable law or necessary for legitimate security, dispute, backup, or compliance purposes.

Where technically available, the Customer may export accessible Customer data before deletion. Deletion of active workspace data is intended to complete within 30 days after termination or verified deletion request. Backup copies may remain until overwritten or purged according to normal backup rotation schedules.

Billing records, transaction references, security logs, and legal records may be retained for the periods described in the Privacy Policy and Terms of Service.

ZENIA Assistant will make available information reasonably necessary to demonstrate compliance with this DPA, taking into account the nature of the Service, the available documentation, the size of the product, and the need to protect other customers, systems, trade secrets, and security controls.

Where legally required, audits or inspections may be conducted with reasonable prior notice, during normal business hours, in a manner that does not disrupt the Service or compromise security. The scope, timing, confidentiality requirements, and cost allocation for any audit must be agreed in advance unless mandatory law requires otherwise.

Customer Personal Data is intended to be processed primarily within the European Economic Area or through providers that offer appropriate data-protection safeguards.

Where a Sub-processor processes Customer Personal Data outside the EEA, appropriate transfer mechanisms may be used, such as European Commission Standard Contractual Clauses, adequacy decisions, transfer impact assessments, or other legally recognised safeguards where applicable.

The Customer's use of the Service constitutes an instruction to transfer Customer Personal Data where necessary for providing the Service, subject to the safeguards described above and in the Privacy Policy/Sub-processors page.

This DPA is subject to the liability exclusions and limitations in the Terms of Service to the maximum extent permitted by applicable law. Nothing in this DPA limits liability where such limitation is not permitted under the GDPR or other mandatory data-protection law.

If there is a conflict between this DPA and the Terms of Service regarding the processing of Customer Personal Data, this DPA controls only for that processing matter. For all other matters, the Terms of Service continue to apply.

For all enquiries, requests, and notifications under this DPA, please contact:

• Product operator: Popescu Adrian Florin
• Product brand: ZENIA Assistant / buildbot.ro
• Email: contact@buildbot.ro
• Website: https://buildbot.ro

For DPA-related correspondence, please include “DPA Request” in the email subject when writing to contact@buildbot.ro.