DRAFT FOR LEGAL REVIEW — not final
This is a working draft prepared from AIMER's verified data inventory and current production implementation. It is provided for legal review, is not legal advice, and is not yet in force. Qualified legal counsel must review and approve it before it becomes binding.
DRAFT FOR LEGAL REVIEW. This draft forms the Article 28 GDPR data processing agreement between the business customer (controller) and AIMER (processor), based on AIMER's verified architecture and published Subprocessor List. It is provided for legal review and is not yet binding.
1. Parties and roles
The business customer is the data controller for personal data about its own end-customers. AIMER is the data processor that handles that personal data solely to provide the AI Employee service. AIMER is an independent controller for its own account, billing and platform-security data (covered by the Privacy Policy).
2. Subject matter, nature, purpose and duration
AIMER processes the controller's end-customer personal data to operate AI-assisted customer conversations, bookings, reminders and follow-ups. Processing lasts for the duration of the service subscription and any agreed wind-down period.
3. Data subjects and categories of data
Data subjects: the controller's end-customers and contacts. Categories: identification and contact details (e.g. name, email), conversation content, booking details, and any personal data contained in the knowledge-base content the controller provides. No payment card data is processed by AIMER.
4. Controller instructions and processor obligations
AIMER processes personal data only on the controller's documented instructions (this DPA, the service configuration and settings). AIMER ensures persons authorised to process data are bound by confidentiality and processes data only as needed to deliver the service.
5. Security measures (Art. 32)
Technical and organisational measures reflect the actual build: encryption in transit (TLS); passwords stored as bcrypt hashes; OAuth tokens encrypted at rest (AES-256-GCM); strict tenant isolation by tenant identifier; role-based access control (Owner, Admin, Manager, Agent, Viewer); rate-limiting and brute-force protection; and audit logging.
6. Sub-processors
The controller grants general authorisation to engage the sub-processors listed in AIMER's public Subprocessor List (/legal/subprocessors), currently Emergent (hosting/database), OpenAI via the Emergent LLM gateway (AI responses), Resend (transactional email), Stripe (billing) and Google (Calendar API, only when connected). AIMER will inform the controller of intended changes and give an opportunity to object. All sub-processors are engaged under written terms with obligations no less protective than this DPA.
7. International transfers
Where sub-processors process data outside the EU/EEA (e.g. in the United States), transfers rely on appropriate safeguards such as EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. Specific safeguards per provider are being verified as part of legal review before launch.
8. Assistance to the controller
AIMER assists the controller, taking into account the nature of processing, in responding to data-subject requests (via in-app data export and deletion tools and the Privacy Request Center) and in meeting security, breach-notification and data protection impact assessment obligations.
9. Personal data breach notification
AIMER will notify the controller without undue delay after becoming aware of a personal data breach affecting the controller's data, and will provide information reasonably available to help the controller meet its own notification duties. AIMER maintains an internal incident-response runbook.
10. Audit and information
AIMER will make available information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits, subject to reasonable confidentiality and security conditions.
11. Deletion and return of data
On termination, AIMER will delete or return the controller's personal data at the controller's choice, save where retention is required by law (e.g. bookkeeping). In-app deletion controls and configurable retention sweeps support this; automatic deletion is off by default and controlled by the controller.
12. AI-specific terms
Customer conversation data and knowledge-base content are not used to train third-party AI models (per the providers' API terms). AI outputs are automated and may be inaccurate; the controller remains responsible for reviewing outcomes, and the AI does not autonomously confirm bookings or take payments.
13. Governing law and precedence
Governing law, venue and the order of precedence between this DPA and the main agreement will be confirmed at legal review.
For legal and privacy questions during this draft period, contact hello@getaimer.ai. Final contact and data controller details will be published at launch.