Personal Data Processing Agreement

Last updated: July 23, 2026

This personal data processing agreement (the “Agreement” or the “DPA”) is entered into between THE CHATBOT FACTORY, a simplified joint-stock company (*société par actions simplifiée*) with a share capital of €9,600, having its registered office at 16, Villa des Nymphéas – 75020 Paris, registered with the Paris Trade and Companies Register under number 789 487 121 (“THE CHATBOT FACTORY”), and the Client, as defined in the General Terms of Use for the Genii Solution (the “GTU”, available at https://www.tolk.ai/en/legal/cgu-genii). tolk.ai is a registered trademark and the trade name owned by THE CHATBOT FACTORY.

Article 1 – Purpose and Scope

1.1. This Agreement sets out the conditions under which THE CHATBOT FACTORY processes personal data on behalf of the Client in connection with the provision of the Service, in accordance with Article 28 of Regulation (EU) 2016/679 (the “GDPR”) and French Act No. 78-17 of 6 January 1978, as amended.

1.2. The Agreement forms an integral part of the contractual framework established together with the GTU and the general terms and conditions of sale (the “GTC”, available at https://www.tolk.ai/en/legal/cgv-genii) or, where applicable, the relevant quote. It is accepted under the same conditions as the GTU. For any matter relating to the protection of personal data, the Agreement shall prevail over the GTU and the GTC in the event of any conflict.

1.3. Precedence of a Signed Agreement. Where a framework agreement including its own annexes relating to personal data, or a specific processing agreement, has been signed between THE CHATBOT FACTORY and the Client, those documents shall fully prevail over this Agreement for the Services they cover.

1.4. The Agreement applies regardless of the channel through which the Client acquired the right to use the Service: subscription via a Distribution Platform, order based on a quote, or provision through a reseller, an integrator, or a purchasing group.

Article 2 – Definitions

The terms “personal data”, “processing”, “controller”, “processor”, “recipient”, “data subject”, “personal data breach” and “transfer” have the meaning given to them by the GDPR. Terms identified by an initial capital letter and not defined in this Agreement have the meaning given to them in the GTU, in particular: Client, Collaborator, Conversation, Platform, Distribution Platform, Documentary Resources, Service, Solution, Trust Center, User.

Article 3 – Qualification of the Parties

For the processing activities described in Appendix A, carried out through the Service for the Client’s purposes: the Client, who determines the purposes and essential means of the processing through its use and configuration of the Service, acts as the controller; THE CHATBOT FACTORY acts as the processor. Where the Client benefits from the Service through a reseller, an integrator, or a purchasing group, this Agreement binds THE CHATBOT FACTORY to the entity using the Service in its capacity as controller, without prejudice to the qualifications specific to the contractual chain concerned.

Processing activities for which THE CHATBOT FACTORY acts as controller (in particular the management of Accounts and Collaborator access, the business relationship, and invoicing) fall outside the scope of this Agreement and are governed by its privacy policy, available at https://www.tolk.ai/legal/politique-de-confidentialite.

Article 4 – Effective Date and Term

The Agreement takes effect concurrently with the start of use of the Service and remains in force for its entire duration, then for the period required for the fate of the data as provided in Article 14.

Article 5 – Description of the Processing

The subject matter, duration, nature and purposes of the processing, the categories of personal data, and the categories of data subjects are described in Appendix A, which forms an integral part of the Agreement.

Article 6 – Undertakings of THE CHATBOT FACTORY

6.1. General Undertakings

As part of the processing, THE CHATBOT FACTORY undertakes to:

  • process personal data transmitted by the Client or collected in connection with the use of the Service solely on the Client’s documented instructions: the Contract, this Agreement, and the configuration of the Service constitute such instructions in particular; and only to the extent necessary for the provision of the Service and, where applicable, for the detection of security incidents and the maintenance of the Service’s consistency;
  • inform the Client if, in its view, an instruction constitutes a breach of the GDPR or other provisions of European Union or French law relating to data protection;
  • implement the technical and organizational measures intended to ensure the security, confidentiality, integrity, and availability of the data, under the conditions set out in Article 8;
  • ensure that its employees, collaborators, consultants, and subsequent sub-processors authorized to process the data within the scope of their duties are bound by an appropriate confidentiality obligation;
  • maintain a record of processing activities carried out on behalf of the Client, in accordance with Article 30.2 of the GDPR, and cooperate, at the Client’s request, with the competent supervisory authority.

6.2. Assistance to the Client

Taking into account the nature of the processing and the information available to it, THE CHATBOT FACTORY assists the Client, through appropriate technical and organizational measures, in order to: (i) respond to requests to exercise the rights of data subjects (Articles 12 to 22 of the GDPR), under the conditions set out in Article 7; (ii) ensure compliance with its obligations regarding security and data breach notification (Articles 32 to 34 of the GDPR) and, where applicable, data protection impact assessment and prior consultation (Articles 35 and 36 of the GDPR).

Article 7 – Rights of Data Subjects

7.1. It is the Client’s responsibility, as controller, to inform data subjects and respond to their requests to exercise their rights. THE CHATBOT FACTORY shall forward to the Client, without undue delay, any request to exercise rights received directly by it, without responding to it itself unless otherwise instructed by the Client or required by law, and shall make available to the Client the Service features enabling it to respond to such requests (access, export, rectification, and deletion of the data concerned).


7.2. Requests Relayed by a Distribution Platform. Where the Service has been installed via a Distribution Platform, certain access or erasure requests may be relayed to THE CHATBOT FACTORY by the operator of that platform, in accordance with its procedures. The Client acknowledges and accepts that THE CHATBOT FACTORY will respond to such requests within the timeframes and under the conditions imposed by the operator, and will inform the Client where relevant and technically possible.

Article 8 – Security

THE CHATBOT FACTORY implements the technical and organizational measures appropriate to the risk, in accordance with Article 32 of the GDPR, including in particular the encryption of data in transit and at rest, access control and traceability, the segregation of environments and data by client, regular backups, and regular testing to assess the effectiveness of the measures. The up-to-date description of the security arrangements, certifications, and qualifications of THE CHATBOT FACTORY and its hosting providers is published on the Trust Center, available at https://helpcenter.tolk.ai/trust-center

Article 9 – Location and Transfers

9.1. Personal data processed on behalf of the Client is stored and hosted in France or, on a transitional basis and where applicable, within the territory of the European Union, on the infrastructure described on the Trust Center.

9.2. No transfer of personal data outside the European Union is carried out without the Client first being informed and without the appropriate safeguards required by Chapter V of the GDPR being implemented, in particular the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, supplemented where applicable by additional measures.

Article 10 – Sub-processing

10.1. The Client generally authorizes THE CHATBOT FACTORY to engage sub-processors to assist it in providing all or part of the Service and to take part in the processing carried out under this Agreement.

10.2. The up-to-date list of sub-processors, specifying their identity, role, and location, is permanently published on the Trust Center, which is authoritative. This publication constitutes notice to the Client of the sub-processors engaged as of the date of its acceptance of the Agreement.

10.3. In the event of the addition or replacement of a sub-processor, THE CHATBOT FACTORY shall inform the Client, by email or by notification within the Service, at least thirty (30) days before it takes effect, with the Trust Center list being updated at the same time. The Client may raise legitimate objections, in writing, within fifteen (15) calendar days of such notice. If, following an objection from the Client, THE CHATBOT FACTORY does not withdraw the proposed appointment and no reasonable alternative solution can be offered, the Client may terminate its subscription under the conditions set out in the GTC or the applicable quote, without being entitled to any compensation.

10.4. THE CHATBOT FACTORY enters into agreements with its sub-processors containing, at a minimum, obligations as strict as those imposed on it under this Agreement, in accordance with Article 28.4 of the GDPR, and remains fully liable to the Client for the performance of the obligations entrusted to its sub-processors. At the end of the Agreement, THE CHATBOT FACTORY ensures that its sub-processors delete or return to it all personal data that may have been entrusted to them.

Article 11 – Personal Data Breach

11.1. THE CHATBOT FACTORY notifies the Client of any personal data breach affecting data processed on its behalf, without undue delay and no later than forty-eight (48) hours after becoming aware of it, so as to enable the Client to comply with its own notification obligations to the supervisory authority and, where applicable, to data subjects (Articles 33 and 34 of the GDPR).

11.2. This notification describes, to the extent the information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it or mitigate its effects; the information may be provided in phases. THE CHATBOT FACTORY documents the breach and cooperates reasonably with the Client. This notification and this cooperation do not constitute an admission of fault or an acknowledgment of liability on the part of THE CHATBOT FACTORY.

Article 12 – No Training and Anonymized Statistics

12.1. The Client’s data and that of its Users, including the Documentary Resources and the content of Conversations: (i) are not used to train, fine-tune, or improve artificial intelligence models, whether by THE CHATBOT FACTORY or by its sub-processors, THE CHATBOT FACTORY contractually imposing this prohibition on the latter; (ii) are not disclosed to any third party or to any other client, with the sole exception of the sub-processors referred to in Article 10 and cases where required by law.

12.2. THE CHATBOT FACTORY may compile and use, for the exclusively internal purposes of operating, securing, and improving the Service, aggregated statistics and data rendered anonymous within the meaning of applicable regulations, meaning that they no longer allow, by any reasonable means, the direct or indirect identification of a natural person or the re-identification of the Client. Such statistics, which no longer constitute personal data, are not subject to any publication, disclosure, or commercialization.

Article 13 – Compliance and Audit

13.1. THE CHATBOT FACTORY shall reasonably make available to the Client all information necessary to demonstrate compliance with this Agreement, including the documentation, certifications, and reports published or referenced on the Trust Center.

13.2. The Client may, at most once (1) per year, carry out or have carried out, at its own expense, by an independent auditor bound by confidentiality and not a competitor of THE CHATBOT FACTORY, an audit intended to verify compliance with this Agreement, subject to thirty (30) days’ prior written notice and on the basis of a scope agreed in good faith. The audit shall be conducted during business hours, without disrupting THE CHATBOT FACTORY’s activity, and may under no circumstances provide access to other clients’ data or to THE CHATBOT FACTORY’s trade secrets. Beyond five (5) hours of mobilization of its teams, THE CHATBOT FACTORY may charge for the time spent at the applicable reasonable rate. An additional audit may be conducted under the same conditions following a data breach or a request from a competent supervisory authority.

Article 14 – Fate of the Data at the End of the Service

14.1. At the end of the use of the Service, regardless of the cause, the Client chooses between the return and the deletion of the personal data processed on its behalf. For a period of sixty (60) days from the effective end of the subscription (the “Reversibility Period”), the Client may export its own data, where this feature is available, or request its return in a standard and commonly readable format, free of charge.

14.2. In the absence of instructions from the Client at the end of the Reversibility Period, THE CHATBOT FACTORY shall delete the personal data processed on behalf of the Client, as well as any copies thereof, subject to data whose retention is required by law (in particular for accounting and evidentiary purposes), which shall be retained only for the legally required periods and under restricted access. A certificate of deletion shall be provided to the Client upon request.

By way of exception, with respect to the Free Plan referred to in the GTC, the data is deleted within fifteen (15) days following the end of the trial period, without prior notice, the Client being invited to export it before that deadline.

14.3. Reservation — Distribution Platforms. Where the Service has been installed via a Distribution Platform, the deletion procedures imposed by the operator of that platform, in particular following uninstallation of the Service, shall prevail over the Reversibility Period and may reduce it, particularly with respect to personal data. The Client is therefore invited to export its data before any uninstallation.

Article 15 – Liability

The liabilities incurred under this Agreement are subject to the conditions, exclusions, and limits set out in the “Liability” clause of the GTC or, where applicable, of the agreement applicable between the parties, including the specific cap applicable to breaches relating to the protection of personal data and confidentiality. Each party otherwise remains liable for the administrative sanctions personally imposed on it by a supervisory authority in respect of its own breaches.

Article 16 – Amendment, Miscellaneous Provisions, and Governing Law

16.1. THE CHATBOT FACTORY may amend this Agreement under the same conditions as the GTU: notice of at least thirty (30) days before it takes effect, with the right to terminate free of charge in the event of a substantially unfavorable amendment. Where the subscription results from a signed quote, the version referred to in the quote remains applicable to the current order.

16.2. THE CHATBOT FACTORY’s contact person for data protection and for any question relating to this Agreement is Matthieu Bietry, who can be reached at dpo@tolk.ai.

16.3. This Agreement is drawn up in French, and any translation is provided for convenience only. It is governed by French law; any dispute relating to its formation, performance, interpretation, or termination falls within the jurisdiction of the courts designated by the GTC.

Appendix A – Description of the Processing

A.1. Purpose and Nature of the Processing

Provision, on a SaaS basis, of the Genii Solution and the associated Platform, including the collection, recording, organization, structuring, storage, consultation, use, extraction, and erasure of the data necessary for the provision of the Service.

A.2. Duration of the Processing

Duration of use of the Service, extended by the Reversibility Period provided for in Article 14, subject to applicable statutory retention requirements. During the Service, Conversations and the data associated with them are retained for the period configured by the Client via the Platform (set by default to a rolling twelve (12) months) and are then deleted.

A.3. Purposes of the Processing

  • Management of the Client’s customer relationship: assistance and support for Users through automated or assisted dialogue; personalization of interactions; retention of history and monitoring of exchanges to ensure continuity of service;
  • Personalization and improvement of the Client’s service: analysis of exchanges to identify areas for improving the journey and refining responses; understanding of recurring requests;
  • Statistical analysis and reporting for the benefit of the Client: measurement of the frequency, duration, and effectiveness of interactions; monitoring of satisfaction and usage indicators, accessible to the Client via the Platform.

A.4. Categories of Personal Data

  • Identification and contact data of Users provided during Conversations (for example: last name, first name, email address, phone number, customer or order references);
  • Content of Conversations and associated metadata (timestamps, channel, language);
  • Contextual data derived, based on the Client’s configuration, from its own systems (for example: order status);
  • Data relating to Collaborators: identity, professional email address, login credentials, connection logs;
  • Technical data strictly necessary for the operation and security of the Service.

The Service is not intended for the processing of special categories of data within the meaning of Article 9 of the GDPR; the Client undertakes not to configure the Service or its Documentary Resources in a way that leads to the collection of such data, except with prior agreement and the implementation of an appropriate framework agreed with THE CHATBOT FACTORY. A Client considering such processing, or uncertain about the classification of the data concerned, is invited to contact THE CHATBOT FACTORY’s teams beforehand.

A.5. Categories of Data Subjects

  • the Client’s Users (users and visitors of its interfaces);
  • the Client’s Collaborators;
  • where applicable, the Client’s prospects and customers whose data is processed during Conversations.

A.6. Sub-processors

The up-to-date list of sub-processors (identity, role, location, certifications) is published in the Trust Center, accessible at https://helpcenter.tolk.ai/trust-center.