Data Processing Agreement

1. Parties and roles

The business that signs up (the "Business") is the controller of its customers' personal data. COREBIZS is the processor and processes it only on the Business's instructions, expressed through the service configuration and this agreement.

2. Data and purposes

Data processed: display names and user ids on channels, message content, details customers provide (phone, email, address, needs), requests, and documents the Business uploads for the assistant.

Purposes: answering customers, collecting details along the Business's intake flow, creating requests, alerting staff, usage statistics. COREBIZS does not use this data for its own purposes and does not sell it.

3. Storage location and transfers abroad

Source data, logs and backups are stored on infrastructure in Viet Nam.

To produce answers, the necessary part of a conversation is sent to an AI model provider abroad after phone numbers and emails are masked. The Business agrees to this transfer; COREBIZS keeps the cross-border transfer impact assessment up to date as the law requires.

4. Sub-processors

COREBIZS uses: an AI model provider (and a document search model if enabled), server and storage infrastructure in Viet Nam, an email service in Viet Nam. Messaging platforms (Zalo, Meta) are chosen and connected by the Business.

COREBIZS gives at least 15 days' notice before adding or replacing a sub-processor; the Business may object and terminate the service.

5. Security measures

Encryption in transit and at rest; each Business's data isolated at database level; two-step verification for administrators; activity logs kept at least 12 months and tamper-proof; encrypted backups in another data centre in Viet Nam; COREBIZS staff access only when needed, and logged.

6. Data subject rights

The admin has tools to export and erase one customer's data. COREBIZS helps the Business answer data subjects within the legal deadlines.

7. Retention

Conversations and requests are kept for the period the Business chooses (24 months after the last message by default) and deleted automatically when it ends.

8. Incidents

When COREBIZS discovers a personal data breach affecting the Business's data, it notifies the Business without undue delay, with the information the Business needs to meet its own notification duties.

9. Audit

The Business may ask COREBIZS for information showing compliance with this agreement, including the data map and a description of the security measures.

10. End of service

The Business has 30 days to export its data. COREBIZS then deletes it, except what the law requires to be kept (system logs, accounting records); deleted data leaves the backups after at most 12 months.

11. Effect

The agreement takes effect when the Business ticks its acceptance at sign-up. The system records the time, the text version and the IP address as proof. It ends together with the use of the service.