Data processing agreement (DPA)
Last updated: 26 October 2026. Agreement under Art. 28 GDPR between the customer as controller and A & D Media und Data GbR as processor. It forms part of every contract for the use of Halvista and applies once that contract is concluded. The German version (AVV) is legally binding.
1. Subject matter and duration
The processor operates the Halvista software (inbox, AI assistant, integrations) for the controller. Processing lasts as long as the main contract and ends with deletion under clause 10.
2. Nature, purpose, data and data subjects
| Purpose | Receiving, storing, displaying and answering customer enquiries; preparing and sending AI replies; matching with order and customer data from connected systems |
|---|---|
| Types of data | Names, contact details (email, phone number, messenger IDs), message content and attachments, order and shipping data, notes and categories, communication metadata |
| Data subjects | End customers and prospects of the controller, contact persons of business partners, the controller’s staff as users |
| Special categories (Art. 9) | not intended; the controller ensures they are not processed deliberately |
3. Instructions
The processor processes the data only on documented instructions from the controller unless required to do so by law. Instructions are the settings in the software and communications in text form. If the processor considers an instruction unlawful, it informs the controller without delay.
4. Confidentiality
Persons with access to the data are bound to confidentiality and receive access only as far as their tasks require.
5. Technical and organisational measures
The processor takes the measures required by Art. 32 GDPR, in particular:
- operation on servers in Germany in access-controlled data centres;
- TLS encryption of all connections; encrypted storage of credentials for channels and integrations;
- separation of different customers’ data (multi-tenancy) at application and database level;
- role-based access rights; passwords stored only as secure hashes;
- masking of personal data in logs;
- regular backups; deletion according to the configured retention periods;
- no training of AI models with the controller’s data.
The measures may be developed further as long as the level of protection does not decrease.
6. Sub-processors
The controller gives general authorisation for the sub-processors listed on the “Subprocessors” page. The processor informs the controller by email at least 30 days in advance of new or changed sub-processors. The controller may object for a material data protection reason; if no solution is found, it may terminate the contract with effect from the change.
The processor contractually binds sub-processors to an equivalent level of protection.
Channels and services the controller connects with its own accounts (for example WhatsApp, Instagram, Messenger, Telegram, its own mailboxes, shop systems) are not sub-processors of the processor; the contractual relationship between the controller and the respective provider applies to them.
7. Transfers to third countries
The processor transfers data outside the EU or EEA only if the requirements of Art. 44 et seq. GDPR are met; any such transfer is shown in the list of sub-processors.
8. Assistance to the controller
The processor assists the controller with data subject requests (access and deletion are available in the software; we provide an export on request), with data protection impact assessments and with its obligations under Art. 32 to 36 GDPR as far as it can contribute.
9. Notification of breaches
The processor notifies personal data breaches without undue delay, where possible within 48 hours of becoming aware of them, with the information required by Art. 33(3) GDPR as far as available.
10. Deletion and return
After the main contract ends, the controller can export its data for 30 days. The processor then deletes it, including copies, unless a statutory retention obligation applies. Backups are overwritten in the regular cycle.
During the term the software deletes conversations with their messages and files automatically when they have had no new message for longer than the period set by the controller. The default is 12 months; the controller changes it under "Data retention" (1 to 36 months). It can delete single customers with all conversations at any time from the customer card.
11. Evidence and audits
The processor provides the information needed to demonstrate compliance with its obligations. On-site audits are possible after notice with a reasonable lead time during normal business hours, without disrupting operations and while preserving confidentiality towards other customers.
12. Final provisions
In case of conflict, this agreement prevails over the terms and conditions in matters of data protection. German law applies. On request we provide the agreement as a signed PDF; Anastasiia Pylypenko (partner) signs for the processor.