Last Updated: October 23, 2026
This Data Processing Agreement ("DPA") is an addendum to and forms part of the ReplyBuddy Terms of Service (or other applicable agreement, hereinafter the "Agreement") between Customer (as defined in the Agreement) and PRIME RADIANT LLC (the "Company"), a limited liability company registered in the Republic of Armenia (Reg. No. 286.110.1498160, TIN 02938343).
By using the ReplyBuddy services or by agreeing to the Agreement, Customer enters into this DPA on behalf of itself and, if required under applicable Data Protection Laws, in the name and on behalf of its Affiliates. This DPA reflects the parties' agreement with regard to the processing of Personal Data by Company on behalf of Customer in the course of providing the Services.
Interpretation: If not defined in this DPA, all capitalized terms have the meanings set forth in the Agreement. In case of any conflict between this DPA and the Agreement, the provisions of this DPA shall prevail to the extent of the conflict. The term "including" means "including without limitation."
1.1 "Affiliate" means any entity that directly or indirectly Controls, is Controlled by, or is under common Control with a party, where "Control" means ownership of at least fifty percent (50%) of the equity or voting interests of the entity.
1.2 "Customer Personal Data" means any Personal Data that the Customer (or Customer's end users) provides or submits to the Services, or that is collected by Company on Customer's behalf, for processing under the Agreement. Customer Personal Data may include, for example, social media messages, chat transcripts, content drafts, contact information of leads or customers (such as names and usernames), and other data relating to individuals with whom Customer interacts via the Services.
1.3 "Authorized Sub-Processor" means any third party (including any Company Affiliate) engaged by the Company to process Customer Personal Data in order to assist Company in fulfilling its obligations under the Agreement or this DPA. Authorized Sub-Processors current as of the effective date of this DPA are listed in Exhibit B or on a Company website as described in Section 4.2.
1.4 "Company Account Data" means Personal Data that relates to the Customer's relationship with Company, which may include names and contact information of Customer's personnel or representatives who are authorized to use or administer the Services, billing information, and other information necessary for account management and business operations. Company Account Data also includes any data Company must process for identity verification, fraud prevention, or compliance with legal obligations in managing its relationship with Customer.
1.5 "Company Usage Data" means data relating to Customer's use of the Services collected by Company for the purpose of maintaining, monitoring, and improving the Services. Company Usage Data may include log files and metadata such as timestamps and message counts, usage metrics, performance data, and other technical information (e.g., IP addresses or device information) that does not necessarily identify individuals on its own. Company Usage Data is used to optimize and maintain service performance and security, and to prevent abuse of the Services.
1.6 "Data Protection Laws" means all laws and regulations applicable to the processing of Personal Data under the Agreement, including, where applicable: Russian Federal Law No. 152-FZ "On Personal Data"; the EU General Data Protection Regulation 2016/679 ("EU GDPR"); the EU GDPR as incorporated into United Kingdom law ("UK GDPR"); the Swiss Federal Act on Data Protection; the California Consumer Privacy Act ("CCPA") and its amendments (including the California Privacy Rights Act); and any other applicable data protection or privacy laws. The terms "Personal Data," "Data Subject," "processing," "Controller," "Processor," "Personal Data Breach," and other related terms shall have the meanings given to them in the GDPR and/or Federal Law No. 152-FZ, depending on the context (in Federal Law No. 152-FZ terms, a "Controller" corresponds to an "operator" and a "Processor" to a person processing personal data on behalf of an operator), and the term "Service Provider" shall have the meaning given in the CCPA.
1.7 "Standard Contractual Clauses" or "SCCs" means collectively: (i) the standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR, approved by European Commission Decision 2021/914 of 4 June 2021 (the "EU SCCs"); and (ii) the UK International Data Transfer Addendum issued by the UK Information Commissioner's Office (the "UK Addendum"), which, together with the EU SCCs, forms the "UK SCCs." References to the SCCs are to the modules and clauses appropriate for the relationship between the parties as set forth in Section 6 of this DPA.
1.8 "Services" means the Software-as-a-Service platform and related services provided by Company to Customer under the Agreement. In particular, ReplyBuddy provides a SaaS platform enabling automated customer communications and AI agent workflows across messaging platforms (such as Telegram, Instagram, Avito, MAX, VK, and other supported channels), CRM deal management, and broadcasts (the "ReplyBuddy Platform").
As between the parties, with regard to the processing of Customer Personal Data, the parties acknowledge that Customer acts as a Data Controller (or as a Processor on behalf of another controller) and Company acts as a Data Processor on behalf of Customer. This means that Customer determines the purposes and means of the processing of Customer Personal Data, and Company processes such data only on Customer's documented instructions, as described in this DPA and the Agreement. If Customer is a Processor on behalf of a third-party Controller, then Company is a sub-Processor to Customer, and Customer warrants that it is authorized by the relevant Controller(s) to appoint Company as sub-Processor and to enter into this DPA.
Customer shall, in its use of the Services, ensure that its instructions for processing Personal Data (including the instructions set out in this DPA and the Agreement) comply with all Data Protection Laws. Customer is responsible for obtaining any necessary consents or legal bases for the processing of Personal Data, for the accuracy and quality of the Personal Data provided to Company, and for ensuring that Customer's use of the Services (including Company's processing) will not cause Company to violate any applicable law. Customer shall not provide or make available to Company any Personal Data that is not necessary for use of the Services or that Customer is not legally permitted to share. Customer will indemnify Company for any claims or losses arising from processing of Personal Data in accordance with Customer's instructions that infringe applicable laws or the rights of a third party.
(ii) to fulfill Customer's instructions and requests in connection with the Services; and
(iii) to comply with Company's legal obligations.
Company will not process Customer Personal Data for any purpose other than those set forth in the Agreement, this DPA, or as otherwise instructed by Customer in documented form. In particular, Company will not "sell" or "share" Customer Personal Data as defined under CCPA, nor will Company use Customer Personal Data for its own purposes (such as marketing or profiling) or for the training of artificial intelligence models except as strictly necessary and permitted to provide and improve the Services and only with Customer's authorization. Company acknowledges and agrees that it is prohibited from further using or disclosing Customer Personal Data for any purpose other than providing the Services in accordance with the Agreement and this DPA.
By entering into this DPA, Customer instructs Company to process Customer Personal Data only in accordance with the Agreement, this DPA, and any applicable Order or written instructions provided by Customer. If Company believes any Customer instruction infringes Data Protection Laws, it shall promptly inform Customer (unless prohibited by law). Customer's initial instructions to Company for the processing of Personal Data are set forth in this DPA, including Exhibit A. Thereafter, Customer may provide additional instructions in writing to Company, and the parties shall work together in good faith to confirm and implement such instructions as appropriate.
The subject-matter and duration of the processing, the nature and purpose of the processing, the types of Personal Data, and categories of Data Subjects involved in the processing under this DPA are further described in Exhibit A (Details of Processing). The parties agree that Exhibit A accurately reflects the scope of processing of Customer Personal Data by Company under the Agreement.
Upon termination or expiration of the Agreement, or upon Customer's written request, Company shall cease processing Customer Personal Data and, at Customer's choice, either delete or return to Customer all Customer Personal Data in Company's possession or control (including any copies), within a reasonable timeframe unless applicable law requires storage of the Personal Data. If return or deletion of certain data is technically or legally infeasible (for example, if backups are archived to a secure storage required for legal compliance), Company shall (i) inform Customer of the reasons and (ii) ensure the confidentiality of such data and cease any active processing, and will promptly delete such data when possible. Upon Customer's request, Company will provide a certification of deletion of Personal Data (for example, the certification required by Clause 8.5 of the EU SCCs).
Each party will comply with all Data Protection Laws applicable to it in its role under this DPA. Customer shall have sole responsibility for the lawfulness of the processing and for the accuracy and legality of the Customer Personal Data provided to Company. Company will inform Customer if it is of the opinion that an instruction from Customer violates applicable law (without obligation to perform legal review of Customer's activities). Where Russian Federal Law No. 152-FZ applies, the parties shall comply with it, including the rules on cross-border transfer of personal data (Article 12) and the legal, organizational, and technical protection measures required by Article 19.
Insofar as the CCPA (California Consumer Privacy Act) applies to any Customer Personal Data, the parties acknowledge and agree that Company is a Service Provider to Customer, and Customer is a Business (or a Service Provider to a third-party Business) with respect to such data. Company certifies it shall not sell Customer Personal Data or share it for cross-context behavioral advertising, and shall not retain, use, or disclose Customer Personal Data for any purpose other than for the specific purpose of performing the Services or as otherwise permitted by the CCPA. Company shall not combine Customer Personal Data with personal information it receives from other sources, except as allowed under the CCPA. Company understands and will comply with the restrictions and obligations imposed on Service Providers under the CCPA.
Company shall ensure that any person it authorizes to process Customer Personal Data (including Company's employees, agents, and subcontractors) is subject to a duty of confidentiality (whether by contract or by statutory obligation) with respect to such data. Company will limit access to Customer Personal Data strictly to those individuals who need access to perform the Services and who are bound by such confidentiality obligations.
Company will not disclose Customer Personal Data to any third party except to the extent that doing so is necessary for providing the Services (and permitted under Section 4 of this DPA regarding Sub-Processors), or as required by law or regulation. In the event a law or legal order requires Company to disclose Customer Personal Data, Company will (to the extent not prohibited from doing so) inform Customer before making such disclosure and comply with Section 8.2 of this DPA.
Notwithstanding the foregoing, Customer agrees that Company may disclose Customer Personal Data on a limited basis to Company's legal, financial, or professional advisors (e.g., attorneys, auditors) only to the extent such disclosure is necessary for Company to obtain advice or protections related to the Services or to enforce its rights, provided that such advisors are under professional obligations or written duties of confidentiality.
By this DPA, Customer provides general written authorization to Company to engage sub-processors as needed for the provision of the Services.
Company maintains a current list of its Authorized Sub-Processors (the "Sub-Processor List") in Exhibit B to this DPA. As of the DPA's effective date, Customer acknowledges that Company utilizes third-party infrastructure and providers as sub-processors to deliver the Services – including server hosting (Hostinger), user authentication (Supabase), file and backup storage (Cloudflare), monitoring (Grafana Labs), on-call diagnostics (Anysphere (Cursor)), transactional email (Resend), telephony (Voximplant), messaging platform APIs (Telegram, Instagram, Avito, MAX, VK, Zalo, and others connected by Customer), commercial AI and language model API providers (such as DeepSeek, OpenRouter, OpenAI, xAI, MiniMax, and Groq), and payment providers (Lemon Squeezy and CloudPayments).
Company keeps the Sub-Processor List in Exhibit B updated on its website and may engage or replace infrastructure and AI model providers to ensure service continuity, reliability, and security, provided that such providers are bound by appropriate confidentiality and data protection obligations. Company updates the Sub-Processor List when it engages or replaces a Sub-Processor. Such changes take effect upon publication of the updated Sub-Processor List, and Customer's continued use of the Services after publication constitutes acceptance of the change. Customer may object as described in Section 4.4.
If Customer has a reasonable, good-faith basis to believe that a Sub-Processor's processing of Customer Personal Data violates applicable Data Protection Laws, Customer may notify Company in writing at support@replybuddy.io. The parties will discuss Customer's concerns in good faith. If the matter cannot be resolved, Customer may discontinue use of the affected Service and cancel renewal of its Subscription for the subsequent billing period.
Customer's continued use of the Services after an updated Sub-Processor List is published constitutes acceptance of the new Sub-Processor, without prejudice to Customer's right to object under Section 4.4. Company may continue to use existing Sub-Processors already engaged as of the effective date of this DPA, which Customer hereby accepts.
Company shall be responsible for any acts, errors or omissions of its Sub-Processors that cause Company to breach any of its obligations under this DPA, as if the act, error or omission were Company's own.
To the extent required by applicable law (for example, Clause 9(c) of the EU SCCs), Company will, upon Customer's request, provide the Customer with the terms of service and, where available, the data processing terms under which it engages Authorized Sub-Processors, or links to them.
Where the SCCs apply, the Customer's acceptance of this DPA will be deemed to constitute Customer's prior written consent to the engagement of Company's Sub-Processors, and to Company's onward sub-processing of Personal Data to those Sub-Processors, as required by Clause 9 of the EU SCCs (general written authorization). The Sub-Processor List (including updates published pursuant to this Section 4) shall satisfy the requirements of Annex III of the EU SCCs for the onward sub-processor list.
Company shall implement and maintain appropriate technical and organizational measures to protect Personal Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, as required by Article 32 of the GDPR, Article 19 of Russian Federal Law No. 152-FZ (where applicable), and other applicable laws. In assessing the appropriate level of security, Company will take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risk to Data Subjects. The measures applied by Company are set forth in Exhibit C (Technical and Organizational Security Measures) and consist of: encryption of data in transit using TLS; access to production systems limited to authorized personnel; daily database backups to Cloudflare R2 (encrypted at rest by the storage provider), retained for 30 days; application logging and monitoring via Grafana; software updates; and, where applicable, the measures required by Article 19 of Russian Federal Law No. 152-FZ.
Company ensures that any person acting under its authority who has access to Customer Personal Data is subject to appropriate confidentiality obligations (see Section 3.1). Sub-Processors are engaged as described in Section 4.1.
In the event that Company becomes aware of a Personal Data Breach (as defined in the GDPR) that affects Customer Personal Data, Company will notify Customer without undue delay and in any event within 24 hours of becoming aware of the Personal Data Breach. Such notice may be delivered to Customer's designated contact by email or other direct communication and shall include, to the extent known at the time, all available information reasonably required to help Customer meet any obligations to notify regulatory authorities or affected Data Subjects, including: a description of the nature of the breach, the categories and approximate volume of data concerned, the identified and potential consequences, and the measures taken or proposed by Company to address the breach. Company will provide additional information as it becomes available, including information reasonably required to enable Customer to meet the 72-hour follow-up deadline under Part 3.1 of Article 21 of Russian Federal Law No. 152-FZ. Company shall promptly take reasonable steps to contain, investigate, and mitigate any Personal Data Breach. At Customer's request, Company will cooperate in good faith with Customer and assist in Customer's efforts to notify any competent Supervisory Authority and/or affected Data Subjects, as required by law. The obligations in this Section 5.3 shall not apply to incidents that are caused by Customer or anyone acting on Customer's behalf.
Company's notification of or response to a Personal Data Breach under this Section will not be construed as an acknowledgment by Company of any fault or liability with respect to the breach.
Customer is responsible for reviewing the information made available by Company relating to data security and making an independent determination as to whether the Services meet Customer's requirements and legal obligations. Customer is also responsible for properly configuring and using the Services and taking its own steps to maintain appropriate security and access control in use of the Services (for example, protecting account credentials, using secure networks to access the Services, and properly managing integrations or configurations under Customer's control).
Customer acknowledges that Company is based in the Republic of Armenia and that providing the Services may involve transfers of Customer Personal Data to the European Union (Lithuania), Armenia, the United States, China, Japan, and other jurisdictions outside the European Economic Area (EEA), United Kingdom, or Switzerland. Where the GDPR applies to Customer Personal Data, such transfers are made on the basis of the Standard Contractual Clauses set forth in this Section 6. Transfers of personal data from the Russian Federation are carried out in compliance with Article 12 of Russian Federal Law No. 152-FZ.
Module Two (Controller-to-Processor) (or Module Three (Processor-to-Processor), as applicable) of the EU SCCs shall apply. Module Two applies where Customer is a Controller of Customer Personal Data and Company is a Processor; Module Three applies where Customer is a Processor of Customer Personal Data on behalf of a third-party Controller and Company is a sub-Processor. For the avoidance of doubt, Module One (Controller-to-Controller) may apply only to Company Account Data and Company Usage Data under Section 9 below, and not to Customer Personal Data processed on Customer's behalf.
In Clause 7 (Docking Clause), the optional language will not apply.
In Clause 9 (Use of sub-processors), Option 2 (General Written Authorization) applies. Changes to Sub-Processors are communicated by publishing the updated Sub-Processor List as described in Section 4.3 of this DPA.
In Clause 11 (Redress), the optional language will not apply.
In Clause 17 (Governing law), Option 1 applies. The parties select the law of Ireland (provided Ireland is an EU member state that allows for third-party beneficiary rights) as governing the SCCs.
In Clause 18 (Choice of forum and jurisdiction), the parties choose the courts of Ireland as the forum for disputes arising from the SCCs.
Annex I.A (List of Parties), Annex I.B (Description of Transfer), and Annex II (Technical and Organizational Measures) of the EU SCCs are set forth in Exhibit B and Exhibit C to this DPA, respectively.
Annex I.C (Competent Supervisory Authority): The supervisory authority of the EU Member State in which the Customer (as Data Exporter) is established (or, if the Customer is not established in the EEA, the supervisory authority specified in GDPR Article 27 per Customer's location of representative) shall act as the competent Supervisory Authority.
By entering into this DPA, the parties are deemed to have mutually signed the EU SCCs, including the Annexes.
For transfers of Personal Data from the United Kingdom (UK) or that are otherwise subject to UK GDPR, to Company in a country not deemed adequate by UK authorities, the EU SCCs (Module Two or Three, as appropriate, as specified in Section 6.2) shall also apply in accordance with Section 6.2, but as modified and interpreted by the UK Addendum issued under Section 119A of the UK Data Protection Act 2018 ("UK Addendum"). In particular, the parties acknowledge that: (a) Table 1 of the UK Addendum is deemed completed with the parties' details and key contacts as set forth in Exhibit B; (b) Table 2 is deemed completed by referencing the EU SCCs as set out in Section 6.2 (the "Approved EU SCCs"); (c) Table 3 is deemed completed with the information from Exhibits B and C of this DPA (which contain the information required by Annex 1A, 1B, and II of the EU SCCs); and (d) for Table 4, the parties select "Neither Party" (i.e., the Addendum will terminate when the Approved EU SCCs terminate). The UK Addendum, thus completed, is deemed executed by the parties as of the effective date of this DPA, and incorporated herein. By entering into this DPA, the parties are deemed to have reviewed and accepted the UK Addendum as issued by the ICO, which is hereby attached as Exhibit D for reference.
For transfers of Personal Data from Switzerland (subject to the Swiss FADP), the parties agree that the EU SCCs (Module Two or Three, as appropriate) as incorporated by Section 6.2 above shall also apply with the following modifications: (a) references to "GDPR" shall be understood as references to the Swiss FADP with respect to data subject rights and overruled clauses; (b) references to "EU", "Member State" and "Supervisory Authority" shall be interpreted to include Switzerland and the Swiss Federal Data Protection and Information Commissioner (to the extent the transfers are governed by the FADP); and (c) the governing law and forum for disputes for Swiss transfers shall be the law and courts of Switzerland.
Company will make available information about its data transfer practices on request.
If the Customer's Data Protection Authority requests a copy of the SCCs or this DPA, the parties agree that Company may disclose those to the Authority to the extent required.
In the event of conflict between any portion of this DPA and the SCCs (as applicable under this Section 6), the SCCs shall prevail in respect of the transfer of Personal Data.
Taking into account the nature of the Services and the processing, Company shall assist Customer, by appropriate technical and organizational measures and insofar as possible, in fulfilling Customer's obligations to respond to requests from individuals to exercise their rights under Data Protection Laws (such as rights of access, rectification, erasure, restriction, objection, or data portability, and, where applicable, the rights provided by Federal Law No. 152-FZ). In the event that Company directly receives any request from an individual (a "Data Subject Request") regarding Personal Data that is Customer Personal Data, Company will (i) promptly notify Customer of the request, and (ii) refrain from responding to the request directly (unless required by applicable law, in which case Company will inform Customer of that requirement prior to responding, unless legally prohibited from doing so).
To the extent Customer does not have the ability to address a Data Subject Request on its own via the use of the Services, Company shall, upon Customer's request, provide reasonable additional assistance to facilitate Customer's response to the Data Subject Request. Company will provide such assistance in a timely manner, taking into account any response deadlines imposed by Data Protection Laws. Customer shall be responsible for any reasonable costs arising from Company's provision of such assistance, to the extent permitted by law (for example, if the effort required is substantial and beyond the normal functionality of the Services).
Upon Customer's request, Company shall reasonably assist Customer (at Customer's cost) with necessary data protection impact assessments ("DPIAs") and prior consultations with Supervisory Authorities that Customer is required to carry out under GDPR Articles 35 and 36, in each case solely in relation to processing of Customer Personal Data by Company and taking into account the nature of the processing and information available to Company. Company will provide relevant information from its privacy and security practices, and any other reasonably required information, to the extent Customer does not otherwise have access to that information (e.g., via documentation or this DPA).
Company shall cooperate with any reasonable requests or inquiries from a competent Data Protection Supervisory Authority (including, where applicable, the Russian Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) in relation to the processing of Customer Personal Data under the Agreement. If any Supervisory Authority or law enforcement agency makes a demand of Company for Customer Personal Data (e.g. through a subpoena or court order), Company shall, unless prohibited by law, inform Customer of the demand and cooperate in addressing it (for example, by providing the data to Customer to produce, or by legally challenging over-broad demands).
Company maintains records of its processing activities as required by applicable Data Protection Laws and will make such records available to competent authorities upon request.
Upon at least 30 days' prior written request by Customer (no more than once annually and subject to confidentiality obligations), Company will provide written responses and documentation describing its technical and organizational security measures to demonstrate compliance with this DPA.
Company will promptly notify Customer if Company becomes aware that Customer's instructions regarding processing of Personal Data conflict with any legal requirement to which Company is subject (unless such notification is prohibited by the law in question). In such event, Company shall be entitled to cease following the conflicting instruction (without liability) while such conflict is unresolved, or to make reasonable modifications to the processing under the instruction as needed to comply with applicable law, after consulting with Customer.
(See Section 5.3 above for breach notification obligations.) Company will document the facts relating to any Personal Data Breach, its effects, and remedial actions taken, and will provide such documentation to Customer upon request.
The parties agree that Company's assistance obligations under Sections 7 and 8 (and elsewhere in this DPA) shall be provided to the extent Customer does not otherwise have access to the relevant information or capability through the Services or other means, and to the extent such assistance is required for Customer's compliance with Data Protection Laws. Any additional services or assistance beyond the standard functionality of the Services may be subject to separate fees.
Notwithstanding any contrary provisions in this DPA, the parties acknowledge that with respect to Company Account Data and Company Usage Data (as defined in Section 1 above), Company will act as an independent Controller for such data, determining the purposes and means of processing, separate from the Customer's role. In other words, Company is not acting as a Processor when it processes Company Account Data and Company Usage Data, as these data categories are used by Company for legitimate business activities related to the provision of the Services and the operation of Company's business.
(ii) communicating with Customer about the Services (service announcements, support, billing notifications, etc.);
(iii) enforcing the Agreement and investigating prevention of fraud, abuse, or security incidents;
(iv) complying with legal obligations, such as record-keeping, auditing, tax, and compliance with law enforcement requests; and
Company may process Company Usage Data to analyze and improve the Services' functionality and performance, to develop new features, and to ensure the security and integrity of the Services. When processing as a Controller, Company shall ensure it has a valid legal basis for such processing and shall comply with applicable Data Protection Laws regarding notice to data subjects and, where required, obtaining any necessary consents.
Any Personal Data that Company processes as a Controller shall be processed in accordance with the ReplyBuddy Privacy Policy (available at https://replybuddy.io/privacy-policy) and not pursuant to this DPA. Company will maintain a publicly accessible privacy notice that fulfills the requirements of Data Protection Laws for its controller processing activities, and will respect data subject rights with regard to such processing.
For clarity, this Section 9 does not affect Company's obligations to Customer under the other provisions of this DPA with respect to Customer Personal Data processed as a Processor on Customer's behalf. Company's status as an independent Controller for certain limited data (Account Data and Usage Data) is separate from, and does not reduce, its duties as a Processor for Customer Personal Data.
Customer acknowledges that the Services utilize artificial intelligence and machine learning technologies via commercial APIs of third-party AI model providers (such as DeepSeek, OpenRouter, OpenAI, xAI, MiniMax, Groq, and others). These technologies are used to provide AI agent responses, conversation summaries, speech recognition of voice messages, and related features of the Services.
Customer acknowledges that AI-generated responses and content may contain errors or inaccuracies due to the inherent limitations of AI technology. Company strives to provide accurate AI outputs but cannot guarantee their completeness, accuracy, or suitability for any particular purpose. Customer is responsible for reviewing and verifying AI-generated content before use or publication.
Third-party AI providers are listed in the Sub-Processor List (Exhibit B). Company may update AI providers as technology evolves, in accordance with Section 4.3.
In the event of any conflict or inconsistency between this DPA and any other agreements between the parties (including the Agreement and the Privacy Policy), the provisions of the following documents (highest priority first) shall prevail: (1) the Standard Contractual Clauses (if applicable); (2) this DPA; (3) the Agreement; and (4) the Privacy Policy. Notwithstanding the foregoing, the Agreement's provisions regarding liability (including any exclusions or limitations of liability) shall apply to this DPA with the same force as if they were set forth herein (i.e., any liability arising under this DPA or the SCCs will be subject to the same limitations and exclusions as those in the Agreement). This DPA is available in English and Russian. In the event of any discrepancy between the versions, the version in the language in which the Customer accepted the document prevails.
Except to the extent that the Standard Contractual Clauses or other Data Protection Laws require otherwise, this DPA shall be governed by the laws of the Republic of Armenia, and disputes shall be subject to the courts of Yerevan, Republic of Armenia.
This DPA shall remain in effect for as long as Company processes Customer Personal Data, notwithstanding the termination or expiration of the Agreement, and shall terminate automatically once Company no longer processes Customer Personal Data. Sections 3, 5, 8, 9, 10, 11, and any other provisions that by their nature should survive, shall survive termination of this DPA.
This DPA may be modified by a written amendment signed by both parties or in the manner provided in the Agreement for changes to the Agreement; the Sub-Processor List is updated in accordance with Section 4. If any provision of this DPA is deemed invalid or ineffective under Data Protection Laws, the parties shall negotiate in good faith a valid, legal and enforceable substitute provision that most nearly achieves the original intent.
If any provision of this DPA is found by a competent authority to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this DPA otherwise remains in full force and effect and enforceable.
Except as supplemented by this DPA, the Agreement remains in full force and effect. This DPA and the Agreement (including all exhibits or attachments) constitute the entire agreement between the parties with respect to the subject matter herein and supersede all prior representations, understandings, or agreements, whether written or oral, regarding the same.
By executing or accepting the Agreement, or any document that incorporates this DPA, each party's authorized representative is deemed to have signed this DPA as of the effective date of the Agreement, and no further signature is required.
EXHIBIT A – Details of Processing of Customer Personal Data
A. Subject Matter
The subject matter of the processing is the provision of the ReplyBuddy Platform and related services to Customer, as described in the Agreement. This includes AI agents and automated customer communications in messaging platforms and social networks (such as Telegram, Instagram, Avito, MAX, VK, and other supported channels), CRM deal management, and broadcasts for Customer's business purposes, and related processing of Personal Data as necessary to provide those services.
B. Duration of Processing
Company will process Customer Personal Data for the duration of the Agreement, until deletion of all Customer Personal Data as described in Section 2.6 of the DPA. Some data may be retained for a limited period after termination, solely as necessary for legal, compliance, or backup purposes, after which it will be deleted or anonymized. By default, personal data is retained only as long as necessary to fulfill the purposes of processing and to comply with legal obligations, and Customer may request deletion of certain data at any time.
C. Nature and Purpose of Processing
Collecting and Receiving Data: Receiving messages, comments, and inquiries from Customer's end-users via Telegram, Instagram, Avito, MAX, VK, and other integrated platforms on behalf of Customer; importing contact information and social media profiles.
Storing and Organizing Data: Hosting conversation transcripts, chat logs, content drafts, and related data in databases for Customer's access and review; maintaining records of interactions and published content.
Analyzing and Responding: Utilizing natural language processing and AI models (via commercial APIs of the AI providers listed in Exhibit B) to analyze incoming messages, transcribe voice messages, and generate automated responses per Customer-defined scripts and AI instructions; this may include transmitting text content to AI services to process and understand the content.
Content Creation: Using AI models to generate, edit, and optimize messages and broadcast content based on Customer's instructions and preferences.
Communicating: Sending responses, notifications, or automated messages to end-users as instructed by Customer via messaging platforms and social networks (and by phone, if Customer uses telephony features), which necessitates using end-user contact information through platform APIs.
Support and Improvement: Monitoring the performance of AI conversations and content, and as authorized, using interaction data to improve response accuracy and Service quality over time. Company may also process data as needed to provide customer support to the Customer. Authorized Company personnel, as well as the Company's automated diagnostic tools, may access Customer's account, agent settings, and conversations processed by the Service only to the extent necessary for technical diagnostics and troubleshooting, responding to Customer's support requests, investigating security incidents and violations of the Agreement, and complying with legal requirements.
Deletion and Return: Erasing or returning Personal Data upon Customer's request or upon termination as described in the DPA.
All processing is carried out on Customer's behalf for the purpose of providing the Services and fulfilling Customer's legitimate business needs in managing communications with its end-users and creating/publishing content, as further instructed by Customer in its use of the Platform.
D. Types of Personal Data
Identification and Contact Data: end-users' names, usernames, social media handles, and potentially email addresses or other contact details if provided.
Communication Content: the content of messages sent by end-users via social media platforms, chat transcripts, comments, and media if shared in conversations.
Voice and Call Data: voice messages and, if Customer uses telephony features, phone numbers, call audio, and call recordings.
Social Media Profile Data: publicly available profile information from connected social media accounts.
Content Data: drafts, published posts, images, videos, and other content created or managed through the Services.
Business Information Provided by Customer: information about Customer's business, products, and services that Customer inputs into the Platform for AI-powered responses and content creation.
Technical Data: metadata such as message timestamps, platform identifiers, and general usage logs.
Company does not intentionally collect or require any special categories of personal data (e.g., sensitive data such as health, biometric, financial account numbers, etc.) for the provision of the Services, and Customer is instructed not to use the Service to solicit or collect such data.
E. Categories of Data Subjects
Customer's end-users, followers, prospects, or customers: individuals who interact with Customer via social media platforms and whose communications are processed through the ReplyBuddy Platform.
Customer's staff or agents (to a limited extent): individuals authorized by Customer to use the ReplyBuddy Platform or who may be referenced in content or conversations.
Third parties: to the extent any third party's personal information is shared by end-users during conversations or appears in content.
F. Special Categories of Data
Company does not intentionally process any special categories of Personal Data (as defined in GDPR Art. 9 and Article 10 of Federal Law No. 152-FZ), biometric personal data, or data relating to criminal convictions (GDPR Art. 10) as part of the Services. The Services are not designed to collect or handle sensitive personal data, and Customer agrees not to actively solicit such data via the platform.
G. Processing Frequency
Continuous or on-going basis – Customer Personal Data will be processed on an on-going, real-time basis during the term of the Agreement whenever end-users interact with the Services or as Customer uses the Platform, and for routine activities such as data storage and backup, until deletion in accordance with the DPA.
H. Location of Processing
Customer Personal Data is stored primarily on Company's application server and database hosted by Hostinger in Lithuania (European Union). Uploaded and received files and media, as well as database backups, are stored in Cloudflare R2 object storage. In the course of providing the Services, data is also processed by the Authorized Sub-Processors listed in Exhibit B, including Sub-Processors established in the United States (for example, Supabase, Cloudflare, OpenAI, OpenRouter, xAI, Anthropic, Groq, Grafana Labs, Anysphere (Cursor), and Resend), DeepSeek, which processes data in China, and Resend, whose email sending region is Japan. Messaging platforms connected by Customer process data in their own jurisdictions, and payments in Russian rubles are processed by CloudPayments in the Russian Federation. Company is established in Armenia, and its personnel may access data from Armenia. All such processing is subject to the transfer safeguards described in Section 6 of the DPA.
EXHIBIT B – EU/UK Standard Contractual Clauses: Parties and Transfer Description
This Exhibit forms part of the DPA and includes selected provisions required by Annex I of the EU SCCs and Table 1 & Annex 1A/1B of the UK Addendum.
Name: The Customer entity that is a party to the Agreement (as defined therein).
Address: Customer's business address as specified in the Agreement or customer account details.
Contact Person & Contact Details: The contact details of the Customer's representative for data protection matters shall be as set forth in the Customer's account or as otherwise provided in writing for notice purposes.
Role: Data Controller (or Processor on behalf of a Controller, as applicable)
Signature & Date: By entering into the Agreement and this DPA, the Customer is deemed to have signed these SCCs as of the effective date of the Agreement.
Name: PRIME RADIANT LLC (operating the "ReplyBuddy" service, Reg. No. 286.110.1498160, TIN 02938343).
Address: 26a Movses Khorenatsi St, Office 210, Yerevan 0010, Republic of Armenia
Contact Person & Contact Details: ReplyBuddy Data Protection Contact, email: support@replybuddy.io.
Activities relevant to the data transferred: The provision of the ReplyBuddy Services, as described in the Agreement and Exhibit A (AI agents and automated customer communications, CRM, broadcasts, and related data processing on behalf of the Customer).
Role: Data Processor (or sub-Processor, as applicable – see Section 2 of the DPA for role details).
Signature & Date: By entering into the Agreement and this DPA, PRIME RADIANT LLC is deemed to have signed these SCCs as of the effective date of the Agreement.
Categories of Data Subjects: As detailed in Exhibit A, Section E, the data subjects include Customer's end-users (followers, prospects, leads, or customers) who communicate via the Services, and any other individuals whose Personal Data is submitted through the Service.
Categories of Personal Data: As detailed in Exhibit A, Section D, the personal data transferred may include contact information (names, usernames, social media handles, etc.), message content and conversation transcripts, content drafts and published materials, and other communication data. No special category data is intentionally processed.
Sensitive Data: Not applicable. The parties do not intend to transfer special categories of data.
Frequency of Transfer: Personal Data is transferred on a continuous, ongoing basis for the duration of the Agreement, whenever end-users interact with the Service or as otherwise needed to provide the Services.
Nature of Processing: See Exhibit A, Section C. The processing includes automated collection, analysis (using AI algorithms for natural language understanding and content generation), transmission, and storage of communications and content on behalf of Customer.
Purpose of Processing: To enable Customer to automate and manage customer communications in messaging platforms and social networks and broadcasts, for customer engagement, lead management, and other purposes as specified by Customer.
Duration of Processing: For the term of the Agreement and until deletion of Personal Data by Company in accordance with the DPA.
Retention Period (or criteria): Personal Data is retained by Company only as long as necessary to fulfill the purposes of processing and to comply with legal obligations.
Transfers to Sub-Processors: Personal Data may be onward transferred to Authorized Sub-Processors as necessary for the purposes above, consistent with the Sub-Processor list provided.
For data transfers from the UK, the Information Commissioner's Office (ICO) will be the relevant authority. For data transfers from Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) will be the relevant authority.
Third-party services that Customer connects on its own (for example, calendars, CRM systems, or custom API endpoints) process data on Customer's instructions and are not Company's Sub-Processors.
The parties agree that this list shall be maintained and updated by Company in accordance with the DPA. Customer consents to the sub-processors listed herein as of the effective date, and any updates will be managed pursuant to Section 4 of the DPA.
EXHIBIT C – Technical and Organizational Security Measures
The following is a description of the technical and organizational security measures implemented by Company (PRIME RADIANT LLC / ReplyBuddy) as Data Importer, as required by Annex II of the EU SCCs and applicable Data Protection Laws.
Encryption in Transit: Network communication with the Services is encrypted in transit using TLS.
Access Control: Access to production systems that store or process Personal Data is limited to authorized personnel.
Backups: The database is backed up daily to Cloudflare R2 object storage, where backups are encrypted at rest by the storage provider. Backups are retained for 30 days.
Logging and Monitoring: Application logs, metrics, and traces are collected and monitored using Grafana.
Software Updates: Company installs software updates for the systems used to provide the Services.
Measures under Federal Law No. 152-FZ: Where Russian Federal Law No. 152-FZ applies, Company takes the measures required by Article 19 of that law.
Breach Documentation: Company documents Personal Data Breaches, their effects, and the remedial actions taken.
EXHIBIT D – UK GDPR Addendum (UK International Data Transfer Addendum)
This Exhibit D applies only to the extent that the UK GDPR governs the transfer of Personal Data under the Agreement. It sets forth the information required by the UK Addendum to the EU SCCs, issued by the UK Information Commissioner's Office (ICO).
Table 1: Parties – The identities and contact details of the "Exporter" (Customer) and "Importer" (Company) are as set forth in Exhibit B, Section 1 above.
Table 2: Selected SCCs, Modules, and Clauses – The UK Addendum applies in conjunction with the EU SCCs referenced in Section 6.2 of the DPA. Module Two or Module Three (as applicable) applies.
Table 3: Appendix Information – See Exhibits B and C of this DPA.
Table 4: Ending the UK Addendum – Neither Party may unilaterally terminate the UK Addendum pursuant to Section 19 of the UK Addendum.
The UK Addendum is hereby incorporated into this DPA and the Agreement.
Limited liability company registered in the Republic of Armenia
Registration No.: 286.110.1498160 · TIN (ՀՎՀՀ): 02938343
Registered office: 26a Movses Khorenatsi St, Office 210
Yerevan 0010, Republic of Armenia
Email: support@replybuddy.io
Website: https://replybuddy.io