Data Processing Agreement

Salesbot.cz · version 2026-10.1 · effective from 16 October 2026; binding on the Controller from its acceptance in the application

This Data Processing Agreement (“DPA”) forms part of the Terms of Service. It is entered into by Sales Robots s.r.o., Company ID 09586563, Generála Šišky 2082/26, 143 00 Prague, Czech Republic, info@salesbot.cz (“Processor”), and the customer accepting it on its own behalf or for a company it is authorised to represent (“Controller”). It applies only to personal data processed by Sales Robots on the Controller’s instructions. Sales Robots acts as a separate controller for account, billing and service communication data, as described in its Privacy Policy.

The DPA is concluded by electronic acceptance during registration or later confirmation in the application. The acceptance record identifies the person acting, the represented company, time and exact document versions. Publication of a draft on the website or mere continued use of the service does not constitute acceptance of a new DPA. The DPA lasts while the Processor handles personal data for the Controller; confidentiality, deletion, liability and cooperation provisions continue for as long as needed afterwards. For personal data processing, this DPA prevails over the Terms of Service.

1. Scope and instructions

The Processor processes data only for the purposes, within the scope and for the period in Annex 1, and solely on documented instructions from the Controller. Instructions include the settings and actions of authorised users in the application, requests through MCP applications connected by them and written directions sent to info@salesbot.cz. Access granted to an external application by the Controller is its instruction; that application’s provider is governed by the Controller’s own arrangements.

The Processor will not add another purpose or third-country transfer without the Controller’s instruction unless EU or Member State law requires it. In that case it will inform the Controller beforehand unless the law prohibits notice on important public-interest grounds. If the Processor believes an instruction infringes GDPR or other data protection law, it will notify the Controller without undue delay and defer the relevant step pending clarification.

The Controller decides the legal basis, the data scope and the rules for contacting people. It is responsible for information duties, objections and the legality of commercial messages, including under Czech Act No. 480/2004 Coll. Public availability of data does not itself authorise outreach. The Controller will not provide special categories of data under Article 9 GDPR or criminal-offence data without a separately agreed arrangement.

The Controller will compensate the Processor for loss caused by an unlawful instruction or breach of the Controller’s duties, including a missing legal basis for processing or outreach, to the extent attributable to that breach and recoverable by law. This includes reasonable proceedings and legal representation costs, compensation paid to data subjects or third parties, and finally imposed fines where and to the extent reimbursement is not prohibited by mandatory law. The Processor will substantiate the cause and amount of the claim and take reasonable steps to mitigate the loss. The Controller is not responsible for the portion attributable to the Processor’s own breach. Data subject rights, supervisory authority powers and the Processor’s own GDPR liability remain unaffected; this clause does not transfer public-law liability for a fine to another person.

2. Confidentiality, security and AI

Only persons who need access to provide the service and are bound by confidentiality or a statutory duty of secrecy may access personal data. The Processor will implement and regularly review appropriate Article 32 GDPR measures, described in Annex 2. The Controller manages its users’ access, connected accounts and MCP keys.

The Processor will not use the Controller’s personal data to train or improve general AI models and will use for such data only subprocessor modes that contractually exclude that use. It may produce irreversibly anonymised summaries for its own statistics and service improvement, provided neither people nor the Controller can be reidentified. Until that threshold is met, the data remains subject to the Controller’s instructions. This clause does not allow identifiable data to be used for the Processor’s marketing or model training.

3. Subprocessors and international transfers

The Controller grants general written authorisation for the subprocessors in Annex 3 for the listed functions. The Processor will bind each of them by data protection duties no less protective than this DPA and remains responsible to the Controller for their performance. An intended addition or replacement will be announced by email or in the application at least 15 days beforehand. The Controller may raise a reasoned objection within that period. The parties will seek a reasonable solution; if none is possible, the Controller may terminate the affected service before the change without penalty.

Transfers outside the European Economic Area must comply with Chapter V GDPR. Depending on the recipient, they will rely on an adequacy decision (for the US, the EU–US Data Privacy Framework only for a currently certified recipient), or European Commission standard contractual clauses with any necessary supplementary measures. An EU server location does not exclude access from another country. The transfer mechanism for each subprocessor is set out in Annex 3.

4. Assistance, incidents and audits

Taking account of the processing and information available, the Processor will assist the Controller with access, rectification, erasure, restriction, portability and objection requests. It will promptly forward requests received directly to the Controller and will not give a substantive response without its instruction unless legally required. Upon request, it will reasonably assist with data protection impact assessments, prior consultation and obligations under Articles 32–36 GDPR.

The Processor will notify the Controller of a personal data breach affecting the Controller’s data without undue delay and no later than 48 hours after becoming aware of it. It will provide the available facts about the incident, affected data and persons, likely consequences and measures taken or proposed, and supplement missing facts in stages. Any supervisory-authority notification under Article 33 GDPR remains the Controller’s duty.

The Processor will provide information necessary to demonstrate compliance with Article 28 GDPR and allow a reasonable audit by the Controller or an independent auditor it appoints. Ordinary audits may be performed no more than once in any 12-month period on at least 30 days’ prior written notice, in a way that protects other customers’ data and system security; documentation and certifications may be reviewed before an on-site inspection. This does not restrict an extraordinary audit justified by a serious suspected breach, incident or supervisory request. Each party bears its ordinary costs unless otherwise agreed; statutory Controller rights remain unaffected.

5. End of processing, liability and amendments

When a paid subscription ends or the Controller expressly requests account deletion, the Processor will return or erase the personal data at the Controller’s choice and delete copies, unless a law requires further retention. The Controller may export available data before termination. If no return is requested, deletion applies; production data processed for the Controller will be erased no later than 14 days after the paid subscription ends or the deletion request is made. Expiry of an unpaid trial alone does not start this period; the retention period in Annex 1 and the privacy policy applies to such an account. Backups are removed in the next reasonable retention cycle, are isolated from normal use meanwhile and have restricted access; the Processor will disclose the specific cycle upon request. Records required by law, in particular accounting documents, are held only for the statutory period in Sales Robots’ separate controller role.

The Processor’s total liability to compensate the Controller for loss under this DPA is limited to the payments received from the Controller for Salesbot.cz during the 12 months preceding the event giving rise to the loss. This limit does not apply to intentional misconduct or gross negligence, data subject rights under Article 82 GDPR, or any other liability that mandatory law does not permit the parties to limit, including protection of natural rights and weaker-party rights under Section 2898 of the Czech Civil Code. Supervisory authority powers and statutory recourse rights, to the extent they cannot be contractually limited, remain unaffected. This clause applies notwithstanding the DPA’s precedence over the Terms of Service.

Amendments requiring fresh acceptance will be announced at least 15 days before they take effect. A new version binds the Controller only after documented acceptance in the application or another written form. Earlier versions remain available in the legal archive. Czech is the governing language and this English text is a translation. Czech law governs this DPA, subject to mandatory GDPR rules.

Annex 1 — Description of processing

• Subject and purpose: operation of Salesbot.cz to manage companies and business contacts, search on the Controller’s instruction, operate CRM, draft and send communications through Controller-connected accounts, synchronise messages, enrich company information from ARES and public company websites, secure the service and provide technical support.
• Operations: collection, transfer, storage, organisation, retrieval, display, amendment, evaluation, disclosure to authorised users and subprocessors, restriction and erasure.
• Data subjects: employees and representatives of the Controller’s business partners and prospects, people listed in public registers, message senders and recipients, and people the Controller adds to CRM.
• Data types: name, work role and company, location, LinkedIn profile link, source and collection date, company or Controller-provided email and phone, messages, notes, tasks, relationship status, account identifiers and objection records. Free-text messages may contain further data entered by the Controller or sender; special-category data is not intended.
• Duration: during the account’s life under service rules. An individual record is ordinarily deleted after 12 months without activity, except deals marked “Won”. An identifier on the “Do not contact” list is kept for the account’s life so the Controller does not contact the person again. The list applies within the customer account or company to which the Controller belongs, not across all Salesbot customers. Article 5 applies after termination.
• Legal basis: determined by the Controller. The Processor does not establish it, and no service output confirms that outreach is lawful.

Annex 2 — Technical and organisational security measures

Measures as at 16 October 2026. Database backups are taken daily and the last seven daily backups are retained. Subprocessor access and any additional copies and operational records are governed by Article 3 and Annex 3. The Processor maintains appropriate protection when its technical implementation changes.

2.1 Location and encryption

• The service database, authentication, files and backups are in the Supabase project in EU Stockholm (eu-north-1). Server functions use the Supabase platform; the execution location of each function depends on its configuration. The web application is hosted on Vercel. The main database location does not itself rule out access from third countries; Article 3 applies.
• Communication with the application, API and MCP server uses HTTPS/TLS. The database and backups are encrypted at the Supabase storage layer.
• Personal MCP API keys are stored as SHA-256 digests rather than readable keys. Supabase Auth manages passwords as hashes. LinkedIn and mailbox accounts are connected through Unipile hosted authentication; Salesbot keeps the linked-account identifier and does not store those services’ login passwords or cookies.
• Internal service secrets are held in the platform’s secure secret store, not in application source code.

2.2 Access control

• Row Level Security is enabled on all tables in the public database schema. Customer access is separated by account or company and role; server-function authorisation is checked separately.
• The service distinguishes ordinary users, company administrators and service administrators. Privileged access is limited to authorised people according to their work.
• Server functions verify a signed-in user, an internal scheduled-job secret or an incoming webhook signature or secret, as appropriate. Full-access database credentials are server-side only, never in the browser.
• AI assistants connect through OAuth 2.1 or a revocable personal API key. Actions are subject to hourly limits; human approval is on by default for one-off MCP actions. Campaigns and mailboxes can have their own approval settings.
• Registration is protected by reCAPTCHA. Blocked users cannot access service data.

2.3 Backups, records and erasure

• A physical database backup is taken once a day, and the last seven daily backups are retained in EU Stockholm. This seven-day cycle applies to project database backups; operational and security records and other supplier copies are governed by Annex 3.
• The application records LinkedIn actions, MCP assistant actions, automated replies and sent emails with their time and account. Supabase maintains database and server-function operational logs; access is limited to authorised people.
• CRM contact records retain data needed for sales work: name, professional headline, current company and role, location, profile link, collection source and date, communication and user notes. Profile photos, “About” text, education and past positions are not stored in the persistent contact profile; incoming data is filtered on write.
• Inactive contacts are automatically erased after 12 months under Annex 1. An objection triggers erasure of ordinary data and retention of the necessary identifier in the Controller’s account or company “Do not contact” list. Account closure triggers suspension and later erasure under Article 5.

2.4 Operational protection and incidents

• The service applies daily and hourly limits to LinkedIn actions, a gradual ramp-up for new accounts, configured working hours, pauses between searches and an emergency stop for account actions.
• Incidents are recorded with discovery time, scope, affected accounts, remedial action and Controller communication. People with access are instructed in confidentiality and secure data handling.

Annex 3 — Authorised suppliers

To provide the service to the Controller, the Processor will use the contractual arrangements below only for enabled functions and under an Article 28 GDPR agreement with the relevant subprocessor. For processing under this DPA, Vercel Pro is the contractually required plan; the Processor will ensure that plan is in place before customer processing through Vercel begins. Location, retention and transfer information reflects suppliers’ public terms as at 16 October 2026. Operational and security-log retention follows the listed service and its agreement; the Processor will provide a current overview on request.

Google entity: the listed entity corresponds to a Czech billing address under Google's public entity list, unless agreed otherwise. Role note: Stripe handles payments and subscriptions. In the reviewed checkout flow it receives payer details and a user identifier, not the Controller's CRM contacts, so it is not listed as their subprocessor. Analytics services concern data for which Sales Robots is a separate controller. Google Analytics is governed by cookie-consent settings and is not used for the Controller's contacts.