Data Processing Agreement
1. Parties and instructions
This DPA forms part of the ClaraClient Terms between the activated customer company and UAB Isandra, company code 306832302. The customer is the controller or authorized business determining inquiry purposes; UAB Isandra acts as processor or service provider for customer-directed processing. Documented instructions comprise the agreement, enabled settings and lawful written support instructions. We notify the customer if an instruction appears unlawful and process outside instructions only when law requires, informing the customer where permitted.
2. Processing details
Processing includes collecting, storing, organizing and displaying inquiries and messages, generating AI responses, classifying buying intent, managing catalog context, usage and contact preferences, delivering requested notifications and supporting the service. Data subjects are customer visitors, prospects and authorized personnel. Data may include names, contact information, project details, chat text, intent categories, consent records and technical metadata. Processing lasts during the service and the return/deletion period needed to complete the customer’s lawful instructions. Special-category data and government identifiers are outside the intended scope.
3. Purpose limitation and confidentiality
We process customer data only to provide the contracted service and permitted business purposes, not to sell or share it for behavioral advertising, build unrelated consumer profiles or train our own general-purpose models. We do not combine customer data for unrelated purposes except where applicable law expressly allows. Access is limited to authorized persons subject to confidentiality. We will notify the customer if we can no longer meet applicable service-provider obligations and cooperate with reasonable steps to stop and remediate unauthorized use.
4. Security and incidents
Measures include HTTPS, server-side authentication, company membership checks, row-level access controls on exposed tables, restricted service-role operations, rate limits, and server-side secret storage. The customer protects staff credentials and its own devices. We do not represent a certification, guaranteed backup schedule or recovery time. We notify the customer without undue delay after becoming aware of a personal data breach affecting its data, provide available details and updates, preserve necessary evidence and assist legally required notifications.
5. Subprocessors
The customer authorizes Vercel (hosting), Supabase (database and authentication), Cloudflare (security), OpenAI (AI inference) and Resend (email) where used for its enabled service. Equivalent data-protection duties must bind subprocessors; UAB Isandra remains responsible for their performance under this DPA. We give notice of planned material additions or replacements at least 30 days in advance where practicable, except urgent security replacement with prompt notice. A customer may raise a reasonable data-protection objection by emailing info@isandra.lt before the change. We work toward an alternative; if none is reasonably available, the affected processing must stop or the affected service may be terminated.
6. Assistance, audit and transfers
We assist with data-subject requests, impact assessments and regulatory consultations in proportion to the processing and information available. We provide compliance information and cooperate with reasonable audits subject to confidentiality and protection of other customers. The customer may take reasonable steps to assess compliance and require remediation. The production database is in the United States. Transfers requiring GDPR Chapter V safeguards must use a valid mechanism and applicable provider contractual safeguards before transfer; this DPA alone does not purport to replace completed standard contractual clauses or a necessary transfer assessment. Contact info@isandra.lt for the applicable documentation.
7. Return, deletion and survival
On verified customer instruction or termination, we return a reasonably accessible copy or delete customer data, unless law requires retention. Export and deletion requests are currently handled through info@isandra.lt after authority verification. Restricted backup copies may remain until normal provider rotation and must not be used for other purposes. If a backup is restored, applicable deletion instructions must be reapplied. The customer must identify any legally required retention. Confidentiality, purpose limitations and protection duties survive for retained data. Mandatory law controls any conflicting term.