Data processing agreement

Last updated: 7 October 2026

This agreement applies when you use Botti. It governs how AHB GmbH ("processor", "we") processes personal data on behalf of the business using Botti ("controller", "you"). It supplements our terms of service, is part of the contract, and meets the requirements of Art. 9 of the Swiss Federal Act on Data Protection (FADP) and, where applicable, Art. 28 of the EU General Data Protection Regulation (GDPR).

1. Subject and duration

We process personal data to provide Botti to you. This agreement lasts as long as your subscription, and for any period afterwards during which we still hold your data.

2. What we process

• Purpose: importing reviews of your Google Business Profile locations, drafting replies with AI, publishing approved replies, and producing reports.
• Data subjects: people who review your locations on Google; the users you invite to Botti.
• Personal data: reviewers' display names and profile picture links as shown on Google, review text, star ratings and dates; reply text; users' names, email addresses, roles and activity records.
• Special categories: none intended. Reviews are free text, so they may occasionally contain such data (for example health details in a review of a clinic). We process it only as part of the review.

3. Your instructions

• We process personal data only on your documented instructions. These instructions are the terms of service, this agreement, and the settings and rules you configure in Botti.
• If we believe an instruction breaks data protection law, we tell you and may suspend it until it is clarified.
• We only process data for another purpose if the law requires it, and then tell you beforehand unless the law forbids it.

4. Confidentiality

Everyone at AHB GmbH who can access personal data is bound to confidentiality and only accesses it as far as needed for their task.

5. Security

We take appropriate technical and organisational measures to protect personal data. Annex 2 describes them. We may update them, provided the level of protection does not decrease.

6. Sub-processors

• You authorise us to use the sub-processors listed in Annex 1.
• We tell you at least 30 days before adding or replacing a sub-processor. You may object on reasonable data protection grounds; if we cannot resolve the objection, you may terminate the affected service with effect from the change.
• We bind each sub-processor to data protection obligations equivalent to this agreement, and remain responsible for them.

7. Transfers outside Switzerland and the EU

We transfer personal data to countries without adequate data protection only with appropriate safeguards: the Swiss-U.S. Data Privacy Framework for certified recipients, or standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) and the European Commission.

8. Helping you

Taking into account the nature of the processing, we help you:

• respond to requests from data subjects (for example access or deletion). If a request reaches us directly, we forward it to you without undue delay and do not answer it ourselves unless you instruct us to;
• meet your security obligations, and carry out data protection impact assessments and consultations with authorities where required.

9. Data breaches

We notify you without undue delay, and where possible within 48 hours, after becoming aware of a breach of data security affecting your personal data. We provide the information you need to assess the breach and meet your own notification duties, and take steps to contain it.

10. End of the contract

After your subscription ends, you can export your data for 30 days. We then delete the personal data we process for you, including copies, unless the law requires us to keep it. Backups are overwritten within a further 30 days.

11. Audits

We make available the information needed to demonstrate compliance with this agreement. You may audit us, or have an independent auditor bound to confidentiality audit us, once a year with at least 30 days' notice, during business hours and at your own cost. Audits prompted by a data breach at our end are not limited to once a year.

12. Liability and precedence

Liability follows the terms of service. If this agreement and the terms of service conflict on data protection, this agreement prevails.

Annex 1 — Sub-processors

Annex 2 — Technical and organisational measures

• Encryption: all connections use TLS. Google access tokens are encrypted at rest. Backups are encrypted.
• Access control: staff access follows least privilege, requires two-factor authentication and is logged.
• Separation: each customer's data is kept logically separate; every query is scoped to the customer's organisation.
• Availability: regular backups, with restores tested periodically.
• Integrity: an audit trail records who approved, edited or published each reply.
• Development: code review before release, dependencies kept up to date, no production personal data in test environments.
• Incident response: a documented process to detect, contain, assess and report data breaches.
• Deletion: data is deleted on request and at the end of the contract, as set out in section 10.