Data processing agreement

1. Parties and scope

The parties are the client that has concluded a DealerBrain service agreement (“Client”, controller) and LogiNet Enterprise Software Technologies Kft., Budaörsi út 48–50, 1st floor, door 2, 1118 Budapest, Hungary, company registration number 01-09-430828 (“LogiNet”, processor).

This DPA applies to all personal data that LogiNet processes on the Client’s behalf in providing the DealerBrain service (“Client Personal Data”). It does not apply to data LogiNet processes as controller, for example to manage the client relationship or to run dealerbrain.io. That processing is described in our privacy notice.

Where the Client is subject to the Swiss Federal Act on Data Protection (revFADP), PIPEDA or Quebec Law 25, this DPA applies correspondingly to the obligations under those laws.

2. Subject matter, nature and purpose

LogiNet provides the DealerBrain AI sales chat on the Client’s websites and the related tools for the Client’s staff: inventory and model search, content recommendations, lead capture, appointment requests, ticket management, human takeover and reporting. The details of processing, the categories of data subjects and the types of personal data are listed in Annex 1.

This DPA applies for as long as LogiNet processes Client Personal Data under the service agreement, and until that data has been deleted or returned under section 11.

3. Instructions

LogiNet processes Client Personal Data only on the Client’s documented instructions, including with regard to transfers to third countries, unless EU or Member State law requires otherwise. In that case LogiNet informs the Client before processing, unless that law prohibits it.

The service agreement, this DPA and the Client’s configuration of the service (for example its persona, rulebook, retention rules, consent settings and integrations) are the Client’s instructions. Further instructions must be given in writing. LogiNet informs the Client without delay if it believes an instruction infringes data protection law.

4. Client responsibilities

The Client is responsible for the lawfulness of the processing it instructs. In particular the Client:

• provides the information required by Articles 13 and 14 GDPR to visitors of its websites, including that they are speaking with an AI,
• obtains any consent required, for example for follow-up by email or SMS, using the consent features of the service,
• decides which data sources, integrations and AI providers are connected to the service,
• does not instruct the service to collect special categories of personal data unless it has a legal basis to do so.

5. Confidentiality

LogiNet ensures that everyone it authorises to process Client Personal Data has committed to confidentiality or is under a statutory obligation of confidentiality, and that access is limited to the people who need it to provide, support or secure the service.

6. Security

LogiNet implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. The measures are described in Annex 2. LogiNet may update them as technology develops, provided the overall level of protection is not reduced.

7. Sub-processors

The Client grants LogiNet general authorisation to engage sub-processors. The sub-processors engaged when this DPA is concluded are listed in Annex 3.

LogiNet informs the Client at least 30 days in advance of any intended addition or replacement of a sub-processor. The Client may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Client may terminate the affected part of the service without penalty.

LogiNet imposes on each sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and remains liable to the Client for the sub-processor’s performance.

8. Location and international transfers

The DealerBrain service and Client Personal Data are hosted on servers in the European Union. LogiNet does not transfer Client Personal Data to a country outside the European Economic Area unless the Client instructs it to, or the transfer is safeguarded under Chapter V GDPR, for example by an adequacy decision or the European Commission’s standard contractual clauses.

If the Client connects its own AI provider account to the service (bring your own key), that provider is engaged by the Client under the Client’s own agreement with it, and the Client is responsible for that provider’s processing and any related transfers. The same applies when the Client runs the AI layer in its own cloud account or on its own premises.

9. Assistance to the Client

Taking into account the nature of the processing, LogiNet assists the Client:

• in responding to requests from data subjects exercising their rights, mainly through the export, correction and deletion functions of the service and the REST API; LogiNet forwards any request it receives directly to the Client without delay,
• in ensuring compliance with its security obligations, data protection impact assessments and prior consultations with supervisory authorities (Articles 32 to 36 GDPR), by providing the information available to LogiNet.

10. Personal data breaches

LogiNet notifies the Client without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. LogiNet supplements the information as it becomes available and takes reasonable steps to contain the breach and limit its effects.

11. Deletion and return

The Client can export its data at any time through the service and the REST API. At the end of the service agreement, LogiNet deletes or returns all Client Personal Data at the Client’s choice within 30 days, and deletes existing copies, unless EU or Member State law requires storage. During the service, data is deleted according to the retention rules the Client configures.

12. Information and audits

LogiNet makes available to the Client all information necessary to demonstrate compliance with this DPA and Article 28 GDPR, including its certificates and summaries of relevant audit reports. Where this is not sufficient, the Client or an independent auditor it appoints may carry out an audit, at most once a year, with at least 30 days’ written notice, during normal business hours and subject to confidentiality. Each party bears its own costs.

13. Liability, precedence and governing law

Liability under this DPA is governed by the service agreement, without prejudice to Article 82 GDPR. In the event of a conflict on data protection matters, this DPA prevails over the service agreement.

This DPA is governed by Hungarian law. The courts of Budapest have jurisdiction. If any provision is invalid, the remaining provisions remain in force.

Annex 1. Details of processing

Annex 2. Technical and organisational measures

• Hosting on servers in the European Union, in data centres operated by our hosting sub-processor.
• Encryption of data in transit between browsers, the service and connected systems.
• A login-protected admin interface with role-based permissions (admin and agent) and the ability to deactivate users.
• Logical separation of each client’s data, and conversations tied to the website they came from.
• Logging of AI calls, consents and withdrawals, handovers and messages with timestamps, for audit and traceability.
• Separation of internal notes and service data from anything shown to customers.
• Configurable retention and deletion rules per client.
• Filtering of spam and automated traffic before it reaches the AI or the Client’s staff.
• Access to production systems limited to authorised staff on a need-to-know basis, under confidentiality obligations.
• A quality management system certified to ISO 9001, with documented processes for change management and incident handling.

Annex 3. Sub-processors

LogiNet engages the following sub-processors for the DealerBrain service:

Other providers

Vercel Inc. (USA) hosts our marketing website, dealerbrain.io. It is not a sub-processor: no Client Personal Data or conversation data passes through it. AI providers that the Client connects with its own key are engaged by the Client (see section 8).