Data processing agreement

Version: 1.2 · Published: 4 November 2026 · In force from 1 December 2026. Until then, the provisions of the service contract apply.

Subject matter, duration, nature and purpose

1.1. These terms govern the processing of personal data processed in the course of operating the SmartAIAssist service. The subject matter of the processing is the personal data processed by the customer while using the service.

1.2. The processing lasts for the term of the service agreement and for the period necessary for the return and deletion of the data after its termination (clause 10.2). The processor’s obligations continue until the return and deletion have been completed.

1.3. The nature of the processing is collection, storage, structuring, retrieval, transmission and erasure. Its purpose is the provision of the service: operating the assistant, managing conversations and the knowledge base, and providing the functions ordered.

1.4. Prospect data provided on the website forms are processed by R-Szoft as a controller in its own right; these are covered by the Privacy policy.

The controller and the processor

2.1. The customer of the service is the controller, and R-Szoft Informatikai Korlátolt Felelősségű Társaság (R-Szoft Kft.) is the processor.

2.2. The processor processes personal data solely on behalf of the controller and on the basis of its documented instructions, unless processing is required by Union or Member State law; in that case we inform the controller.

Categories of data processed

3.1. Data processed and data subjects, by product:

• Chat AI: website visitors; their messages, the contact details they provide, and the time and technical identifiers of the conversation.
• Knowledge AI: the User’s staff and the persons appearing in the uploaded documents; the questions, the answers and the content of the documents.
• Email AI: the senders and recipients of the emails and the persons appearing in them; the email headers (sender, recipients, subject, date) and content, and the reply drafts.
• Web AI: the public content of the User’s website; personal data only to the extent publicly available on the website.
• Video AI and Social AI: as set out in clauses 3.3 and 3.4.

For every product, the processing covers the content stored in the knowledge base.

3.2. The controller is responsible for ensuring that a legal basis exists for processing data originating from third parties.

3.3. Where Video AI is ordered, the processing also covers the video script, the images uploaded by the controller and the generated audio, image and video files.

3.4. Where Social AI is ordered, the processing also covers the posts, comments and reactions of the controller’s Facebook Page, the names and Facebook IDs of commenting users, the posts’ interaction data (number of reactions and comments) and the Page access token; in this case, the data subjects also include third parties commenting on the Facebook Page. The processor does not filter the content of comments; where they contain special categories of data (for example data concerning health), the controller is responsible for the legal basis of the processing under clause 3.2. The processor uses such comments only to prepare reply suggestions; apart from the controller’s authorised users, only the processor’s support staff have access to them, and they are deleted in accordance with clause 10.3.

Processing in accordance with instructions

4.1. The processor processes personal data solely on the basis of the documented instructions of the controller.

4.2. Neither the controller nor the processor is entitled to use personal data received from the other party for any purpose other than the legal relationship, in accordance with the GDPR and the Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.).

4.3. The processor immediately informs the controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

Confidentiality

5.1. Persons with access to the processing undertake a confidentiality commitment, and only authorised persons have access to the data.

Security measures

6.1. The processor applies technical and organisational measures in accordance with Article 32 GDPR: communication is encrypted, data at rest are encrypted, administrative access is protected by multi-factor authentication, and access is restricted by role.

6.2. The processor logs AI interactions for security and troubleshooting purposes.

Sub-processors

7.1. On the basis of the general authorisation of the controller, the processor engages the sub-processors listed below. The chat, conversation and knowledge base data remain in an EU region; Video AI voice and video generation also takes place outside the EEA, as set out in clause 7.5:

• Amazon Web Services EMEA SARL, AWS eu-central-1 (Frankfurt) – platform and storage – EU
• Google Cloud EMEA Limited, Vertex AI (Gemini), regional EU endpoint – model calls – EU
• Amazon Web Services EMEA SARL, AWS Bedrock eu-central-1 – fallback model – EU
• Amazon Web Services EMEA SARL, Amazon SES – email sending – EU
• UAB “Data Troops” (Decodo), company code 305893779, Švitrigailos str. 34, Vilnius, Lithuania – demo scanning – EU
• implementation partners in Romania (Partners) – onboarding, knowledge base upload and support, only for the data of the customer that ordered through the Partner – Romania (EU); the name and registered office of the Partner are stated in the order confirmation
• Eleven Labs Inc. – text-to-speech for Video AI videos (the script and the generated audio file) – United States
• HeyGen Technology, Inc. – avatar video rendering for Video AI videos (the audio file and the finished video) – United States
• Google Cloud EMEA Limited, Vertex AI – ad image generation, regional EU endpoint – EU
• Google Cloud EMEA Limited, Vertex AI – ad video generation, global endpoint – EU and United States

7.2. The processor informs the controller by email of any addition to or change of sub-processors at least 15 days before the change or, where the processor itself is notified of the change at shorter notice, without delay after becoming aware of it. The controller may raise a reasoned objection after receiving the information; where the objection is well-founded and the change affects a service ordered by the controller, the controller may terminate the affected service with effect from the date on which the change takes effect. In the absence of an objection, the change shall be deemed accepted.

7.3. The processor concludes with its sub-processors a data processing agreement containing the guarantees set out in Article 28(3)–(4) GDPR.

7.4. As a sub-processor, the Partner has access to the data only to the extent and for the period necessary for onboarding and support. The Partner is subject to the same data protection obligations as the processor (Article 28(4) GDPR); the processor remains liable for the Partner’s performance.

7.5. Transfers outside the EEA. When Video AI is used, the script, the uploaded images and the generated files are transferred to Eleven Labs Inc., HeyGen Technology, Inc. and – when an ad video is generated – Google LLC in the United States. The transfer is based on their certification under the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) or, where no certification applies, on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (SCC, Module Three: processor to processor). By ordering Video AI, the controller instructs this transfer; the processor recommends that the script and the images contain no more personal data than necessary.

7.6. Social AI and Meta. To use Social AI, the controller grants access to its Facebook Page through the platform of Meta Platforms Ireland Limited (Facebook Login for Business). Meta is not a sub-processor of the processor: it processes the data of the Facebook Page and its visitors as an independent controller under its own terms. On behalf of the controller and in accordance with Meta’s platform terms, the processor processes the Page’s posts, comments and reactions, the names and identifiers of commenters and the posts’ interaction data, stores the access token in encrypted form, keeps the data received from Facebook separate from the data of other controllers and does not use them for any other purpose, including the training of artificial intelligence models. The controller may revoke the access at any time; we delete the data received from Facebook within 30 days of revocation.

Assistance with data subject rights and the controller’s obligations

8.1. Taking into account the nature of the processing, the processor assists the controller by appropriate measures in handling requests relating to the exercise of data subject rights (access, rectification, erasure, restriction, data portability, objection).

8.2. Taking into account the nature of the processing and the information available to it, the processor assists the controller in fulfilling its obligations under Articles 32 to 36 GDPR: security of processing, notification of personal data breaches and communication to data subjects, data protection impact assessments and prior consultation. To this end, on request, it provides written information on the operation of the service, the sub-processors and the measures under clause 6.

Breach notification

9.1. The processor notifies the controller of a personal data breach without undue delay and provides it with the information referred to in Article 33(3) GDPR.

Deletion and return

10.1. Conversations and emails processed by Email AI are retained for 90 days and are then deleted automatically. The demo preview is deleted after 24 hours.

10.2. Upon termination of the contract, at the choice of the controller, we return the data (by export under clause 7.9 of the Terms and conditions) and delete them, or delete them without returning them. Deletion takes place after the 30-day export period and no later than 60 days after termination, unless further storage is required by law; it covers active data stores and copies held by sub-processors. Data in search indexes, in data derived from them and in backups are deleted no later than 90 days after termination; until then they are accessed only for restoration purposes, and if a restoration takes place, data already deleted are deleted again. On request, we confirm completion of the deletion in writing.

10.3. Under Social AI, raw notifications received from Facebook (webhooks) are deleted after 14 days. Comments and the names and identifiers of commenters are deleted after the retention period of the package (30, 90 or 365 days, as set out in the price list), and expired approval requests 30 days after expiry; the controller may request the deletion of all data of a commenter in one step. The Social AI log does not contain the text of comments or the names of commenters; the identifiers of the operations are processed with restricted access and deleted no later than 90 days after termination of the contract. Upon revocation of access, termination of the contract or at the controller’s request, all data received from Facebook are deleted within 30 days. The audio and video files generated by Video AI are deleted from the sub-processors within 90 days after rendering; the finished video remains in the controller’s account until termination of the contract and can be exported under clause 10.2.

10.4. The specific deadlines in clause 10.3 apply to data received from Facebook: upon revocation of access and upon termination of the contract, the 30-day deletion deadline takes precedence over the deadline under clause 10.2 and over the retention period of the package.

Exclusion of model training

11.1. The processor does not use conversations or knowledge base content for model training.

11.2. The processor and its sub-processors use the controller’s personal data solely to provide the Service and not to train artificial intelligence models. For Video AI, the processor has disabled the use of content for model training at HeyGen Technology, Inc.; HeyGen has confirmed this in writing.

Verification, audit

12.1. The processor makes available to the controller the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and, subject to reasonable prior arrangement and without prejudice to trade secrets and the security of other customers’ data, allows audits conducted by the controller or by an auditor mandated by it.

EU AI Act

13.1. In accordance with the transparency obligation under Article 50 of the EU AI Act, the service informs the end user that they are interacting with artificial intelligence.

13.2. The system does not process biometric data and, within the scope of the processing, does not take automated decisions producing legal or similarly significant effects.

13.3. The service marks the audio, image and video files generated by Video AI in a machine-readable format as generated by artificial intelligence (Article 50(2) of the AI Act). The videos use library voices and library avatars used under licence; the service does not process biometric data for these either.