Data Processing Agreement

Last updated: March 25, 2026

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• Data Controller: You ("Customer") — the website owner embedding the Demitr chat widget.
• Data Processor: dcode technologies S.à r.l., RCS B281.932, 14 rue du Commerce, L-3455 Dudelange, Luxembourg ("Processor").

2. Scope

The Processor processes personal data on behalf of the Controller when visitors use the Demitr AI chat widget embedded on the Controller's website. This DPA supplements the Terms of Service.

3. Data processed

• Chat messages — processed in memory for AI response generation. Not persisted beyond the 30-minute session.
• Contact information (Pro+ plans with lead capture enabled) — email addresses and phone numbers voluntarily shared by visitors. Stored on EU servers.
• Anonymous analytics (Starter+ plans) — conversation counts, language, session duration. Contains no personal data.

4. Sub-processors

• Mistral AI (Paris, France) — AI model inference. Messages with PII tokenized.
• Hetzner Online GmbH (Germany) — Server infrastructure.

Both sub-processors are located in the EU. No international transfers.

5. Security measures

• PII anonymization before AI processing (email/phone tokenization)
• TLS encryption in transit
• Rate limiting and abuse protection
• Session auto-expiry (30 minutes)
• Access controls on lead data (customer-isolated)

6. Data subject rights

The Processor will assist the Controller in responding to data subject requests (access, erasure, portability) under GDPR Art. 28(3)(e). Contact: [email protected]

7. Data retention

• Chat sessions: 30 minutes in memory. No persistence.
• Lead data: Retained until deleted by the Controller via the dashboard or API.
• Analytics: Retained for the duration of the subscription.

8. Termination

Upon termination of the service, the Processor will delete all customer data within 30 days, unless retention is required by law.

9. Contact

Data Protection Officer: [email protected]
dcode technologies S.à r.l., 14 rue du Commerce, L-3455 Dudelange, Luxembourg