This Data Processing Agreement ("DPA") applies whenever you use Brandfine to collect or store personal data about other people, such as visitors to your sites. It forms part of our Terms of Service and takes effect when you accept them; no separate signature is needed. If you need a signed copy, email hello@brandfine.co.
1. Parties and roles
"Customer" is the business that holds the Brandfine account. "Brandfine" is the service operated by a sole proprietorship registered in Turkey. For Customer Personal Data (defined below), Customer is the controller and Brandfine is the processor. Where Customer itself acts as a processor for someone else, Brandfine is Customer's sub-processor and this DPA applies in the same way.
2. Definitions
- Data Protection Law: the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, Turkey's Personal Data Protection Law No. 6698 ("KVKK"), and any other data protection law that applies to the processing.
- Customer Personal Data: personal data that Brandfine processes on Customer's behalf while providing the service, described in Annex 1.
- Sub-processor: a third party Brandfine engages to process Customer Personal Data.
- Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
Other terms (such as "controller", "processor", "data subject", and "processing") have the meanings given in Data Protection Law.
3. Processing on Customer's instructions
Brandfine processes Customer Personal Data only to provide the service and only on Customer's documented instructions. The Terms, this DPA, and the way Customer configures and uses Brandfine (for example, which features are switched on and where submissions are routed) are Customer's complete instructions. In particular, when a Customer user connects an AI assistant to Brandfine (Settings → AI access) and grants it the Inbox permission, Customer instructs Brandfine to make the Customer Personal Data in that user's inboxes available to that assistant, and to send the chat replies and appointment emails it composes. The assistant and its provider are chosen by Customer and act for Customer; they are not Brandfine's Sub-processors. Brandfine will tell Customer if it believes an instruction infringes Data Protection Law, and may then decline to follow it. If law requires Brandfine to process Customer Personal Data otherwise, Brandfine will tell Customer first unless the law forbids it.
4. Customer's responsibilities
Customer is responsible for:
- having a lawful basis for the processing and giving data subjects the information Data Protection Law requires, for example in the privacy policy of each site that uses Brandfine;
- obtaining any consent required, including consent to cookies and similar technologies on its sites. In particular, Google Analytics must only be loaded after the visitor's consent, through Customer's own cookie banner, as described in our documentation;
- its agreements with the providers of any AI assistant it connects to Brandfine and grants access to Customer Personal Data, including any transfer safeguards those providers require, and what that assistant does on Customer's behalf;
- the accuracy and lawfulness of the data it collects, and not collecting special categories of personal data (such as health data) through Brandfine unless it is necessary and lawful.
5. Confidentiality
Brandfine ensures that everyone authorised to access Customer Personal Data is bound by confidentiality and accesses it only as needed to provide, secure, or support the service.
6. Security
Brandfine implements the technical and organisational measures in Annex 2 to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, and the nature and risks of the processing. Brandfine may update these measures as long as the overall level of protection does not decrease.
7. Sub-processors
- Customer gives Brandfine general authorisation to engage Sub-processors. The current list is at brandfine.co/subprocessors.
- Brandfine will notify Customer by email at least 30 days before a new Sub-processor starts processing Customer Personal Data. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may stop using the affected feature or terminate its account, and Brandfine will refund any prepaid fees for the unused period.
- Brandfine imposes data protection obligations on each Sub-processor that are no less protective than this DPA, and remains responsible to Customer for its Sub-processors' performance.
8. Data subject requests
Customer can view Customer Personal Data in Brandfine and delete contact form submissions itself. For anything it cannot do in Brandfine, such as exporting or deleting a particular visitor's live chat conversations or appointment requests, Customer can email hello@brandfine.co and Brandfine will do it within 10 business days. If a data subject contacts Brandfine directly about Customer Personal Data, Brandfine will pass the request on to Customer and will not respond to it except on Customer's instructions.
9. Security Incidents
Brandfine will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a Security Incident. The notice will describe, as far as then known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Brandfine will take reasonable steps to contain the incident and will provide further information as it becomes available, so that Customer can meet its own notification obligations. Notifying Customer is not an admission of fault.
10. Impact assessments and consultations
Brandfine will give Customer the information reasonably needed for data protection impact assessments and prior consultations with supervisory authorities relating to Customer's use of Brandfine.
11. Deletion at the end of the service
Before closing a workspace or account, Customer can ask Brandfine for an export of its Customer Personal Data. When Customer deletes a workspace or its account, Brandfine deletes the related Customer Personal Data within 30 days, and from backups within a further 30 days, unless law requires Brandfine to keep it.
12. Information and audits
Brandfine will make available the information reasonably necessary to demonstrate compliance with this DPA, primarily through written answers to Customer's questions. If that is not sufficient, or a supervisory authority requires it, Customer may audit Brandfine's compliance once a year on at least 30 days' notice, at Customer's cost, during business hours, and subject to reasonable confidentiality obligations.
13. International transfers
Brandfine hosts Customer Personal Data in the European Union (Frankfurt, Germany). Brandfine is operated from Turkey, and some Sub-processors are located outside the EEA.
- EEA data. To the extent Customer Personal Data subject to the GDPR is transferred to Brandfine in a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA by reference: Module Two (controller to processor), or Module Three (processor to processor) where Customer is a processor. Customer is the data exporter and Brandfine the data importer. Clause 7 (docking) applies; under Clause 9(a), Option 2 applies with the 30-day notice period in section 7; the optional wording in Clause 11 does not apply; for Clause 13, the supervisory authority is the one competent for Customer; for Clauses 17 and 18, the governing law and courts are those of Ireland. Annexes I and II of the Clauses are completed by Annexes 1 and 2 of this DPA, and Annex III by the Sub-processor list.
- UK data. The UK International Data Transfer Addendum to the Standard Contractual Clauses applies, with Table 1 to 3 completed by this section and the Annexes; either party may end the Addendum as set out in its Section 19.
- Swiss data. The Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
- Turkish data. For Customer Personal Data subject to KVKK, Brandfine acts as data processor (veri işleyen) under Article 12 of KVKK, and transfers abroad are made in line with Article 9 of KVKK, including through the standard contracts published by the Personal Data Protection Authority where required.
- Brandfine ensures that onward transfers to Sub-processors are covered by the Standard Contractual Clauses or another valid transfer mechanism.
If there is a conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms.
14. Liability and term
Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law does not allow such a limitation. This DPA lasts as long as Brandfine processes Customer Personal Data. Brandfine may update this DPA to reflect changes in law or in the service, with notice as described in the Terms; an update will not reduce the protection of Customer Personal Data.
Annex 1 — Description of the processing
- Data exporter: Customer, as identified in its Brandfine account (controller). Data importer: Brandfine, hello@brandfine.co (processor).
- Data subjects: visitors to Customer's sites; people who contact Customer through forms, live chat, or appointment bookings; and anyone whose data Customer adds to Brandfine.
- Categories of personal data: contact details (name, email address, phone number); message and appointment contents; any other fields Customer's forms collect; live chat metadata (page address, referrer, browser, language, IP address, and a hash of device characteristics used only to block abuse); website analytics data (page addresses, referrer, browser, operating system, device type, screen size, language, and approximate location; IP addresses are not stored).
- Special categories: none intended. If Customer collects them, the measures in Annex 2 apply.
- Frequency: continuous, for as long as Customer uses the relevant features.
- Nature of the processing: collection through Brandfine's widgets, SDK, and tracker; storage; display to Customer's users; forwarding by email or webhook according to Customer's routing rules; generating live chat replies with AI when Customer enables it; aggregating analytics reports; making inbox data available to AI assistants Customer connects with the Inbox permission, and sending the replies they compose; deletion.
- Purpose: providing the Brandfine features Customer uses, under the Terms.
- Retention: for the lifetime of the workspace, except website analytics, which is deleted after 25 months; see section 11 for deletion at the end of the service.
- Sub-processors: as listed at brandfine.co/subprocessors, for the purposes and in the locations stated there.
Annex 2 — Technical and organisational measures
- Hosting: application servers, databases, and uploaded assets run in DigitalOcean data centers in Frankfurt, Germany, under DigitalOcean's physical and environmental security controls.
- Encryption: all traffic uses HTTPS (TLS 1.2 or higher). Integration credentials are encrypted at rest with AES-256-GCM; passwords are hashed with bcrypt.
- Access control: team roles (owner, admin, member) limit what each user can see and change; API keys are scoped to one workspace; keys placed in public pages are limited to the few actions a visitor needs; server access requires SSH keys and is limited to the operator.
- Network isolation: databases are reachable only from the application on a private network, never from the internet.
- Data minimisation: website analytics stores no IP addresses and sets no cookies; live chat creates abuse-protection identifiers only after a visitor opens the chat; Google Analytics is never loaded by Brandfine without Customer's site signalling consent.
- Retention: automated daily deletion of website analytics older than 25 months; deletion of workspace data when a workspace is deleted; server logs kept for 30 days; backups kept for 30 days.
- Monitoring and incident response: server and application logs are kept for 30 days to investigate security events; Security Incidents are handled and notified as set out in section 9.
- Sub-processor management: Sub-processors are chosen for their security practices and bound by data protection terms, as set out in section 7.