1. Scope and roles
This Data Processing Agreement ("DPA") forms part of the Terms of Service between AlbTech Solutions Group SHPK ("Processor") and the business using AlbTech Agents ("Controller"). It applies whenever the Processor handles personal data on the Controller's behalf, and meets Article 28 of the EU General Data Protection Regulation and Albanian Law No. 124/2024 on Personal Data Protection. If this DPA conflicts with the Terms, this DPA wins for personal data.
2. Details of the processing
| Subject matter | Operating AI agents that exchange WhatsApp messages with the Controller's customers. |
|---|---|
| Duration | The term of the Controller's subscription, plus the deletion periods in section 9. |
| Nature and purpose | Receiving, storing, analyzing with AI models, and sending messages; writing task results to the Controller's systems. |
| Data subjects | The Controller's customers and prospects (End Customers) and the Controller's staff using the studio. |
| Personal data | WhatsApp phone number or username and business scoped user ID, profile name, message content and media, timestamps, opt in records, and task data such as bookings or orders. |
| Special categories | Not intended. The Controller must not configure agents to collect them unless it has a lawful basis and tells us in writing. |
3. Processor obligations
- Process personal data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's configuration in the studio.
- Tell the Controller if an instruction appears to break data protection law.
- Ensure everyone with access is bound by confidentiality.
- Keep each Controller's data logically separate from every other customer's data.
- Never use the personal data to train or improve AI models, for advertising, or for our own purposes.
- Help the Controller answer data subject requests, carry out impact assessments and consult authorities where needed.
4. Security measures
- Database level workspace isolation (row level security) enforced on every query.
- Encryption in transit (TLS) and at rest; Meta access tokens encrypted with separate keys.
- Multi factor authentication and least privilege access for staff, with access logging.
- Verification of every Meta webhook signature before processing.
- Encrypted backups, monitoring, and a documented incident response process.
5. Sub processors
The Controller authorizes the following sub processors. We give at least 30 days' notice by email before adding or replacing one, and the Controller may object on reasonable data protection grounds.
| Sub processor | Purpose | Location |
|---|---|---|
| Meta Platforms Ireland Ltd. and affiliates | WhatsApp Business Platform (Cloud API) message delivery | EU and global, under Meta's terms |
| Anthropic, PBC | AI model inference, no training on customer data | United States (SCCs) |
| OpenAI, L.L.C. | AI model inference, no training on customer data | United States (SCCs) |
| EU cloud hosting provider | Application hosting, database and backups | European Union |
Each sub processor is bound by written terms that protect personal data at least as well as this DPA.
6. International transfers
Transfers of personal data from the European Economic Area to countries without an adequacy decision, including access by our team in Albania, rely on the European Commission's Standard Contractual Clauses (2021/914), which are incorporated into this DPA by reference.
7. Personal data breaches
We notify the Controller without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting its data, with the information the Controller needs to meet its own reporting duties.
8. Audits
We make available the information needed to show compliance with this DPA and allow audits by the Controller or an independent auditor it appoints, on 30 days' written notice, no more than once a year unless required by an authority.
9. Return and deletion
When the subscription ends, the Controller can export its data for 30 days. We then delete the personal data within 30 days, and backups within a further 30 days, unless the law requires us to keep it. See Data Deletion.
10. Signed copy and contact
Need a countersigned copy for your records? Email info@albtechsolutions.com with your company's legal details and we will send one.