Data Processing Agreement

Agreement and acceptance

This Data Processing Agreement takes effect only when the operator and customer are identified, the required schedules are completed, and both parties accept it in writing or through an agreed valid acceptance process. Publication of this page alone does not execute an agreement.

The customer acts as controller, or as a processor authorized by its controller, for personal data submitted for project hosting, chatbot, and related services. The BuildBench operator acts as processor or subprocessor for those activities as agreed between the parties. Account and billing processing is described in the Privacy Policy.

Subject matter and processing schedule

Documented instructions and customer duties

Once agreed, the processor will process customer personal data only on documented lawful instructions, including for international transfers, unless required by applicable law. Where legally permitted, it will inform the customer before legally compelled processing. It will inform the customer if an instruction appears to infringe applicable data protection law and seek clarification.

The customer determines lawful purposes, provides required notices and permissions, minimizes data, configures access, and ensures its instructions and chosen integrations are lawful. If acting as a processor, the customer must have the controller’s authorization. New purposes require separate agreement and cannot be created by unilateral instructions inconsistent with law.

Confidentiality and security

Authorized personnel must be bound by appropriate confidentiality duties. BuildBench administrator access to creations and projects is limited to security purposes; administrators cannot access private chats. BuildBench does not use customer content for advertising or AI training. Schedule B must identify the technical and organizational measures actually implemented and agreed for the processing. The processor will maintain those measures and assist with applicable security obligations. The security schedule describes the controls agreed for the processing.

Subprocessors

Schedule C must identify the authorized providers, functions, and processing locations. The final agreement must specify prior specific authorization or a defined general authorization mechanism for subprocessors. Under general authorization, the processor will notify the customer of intended additions or replacements and provide a reasonable opportunity to object on data protection grounds before use, using the agreed notice period.

Authorized subprocessors must be bound by written obligations offering the required equivalent data protection. The processor remains responsible to the customer for their performance as applicable law requires. If a reasonable objection cannot be resolved, the parties must agree an alternative or end the affected processing with agreed remedies.

Requests, assessments, and cooperation

Taking account of the nature of processing and information available, the processor will assist the customer with individual rights requests, security obligations, breach notifications, impact assessments, and regulator consultation as required by applicable law. It will forward requests concerning customer-controlled data and not respond on the customer’s behalf unless instructed or legally required.

The processor will make available information necessary to demonstrate its obligations and allow and contribute to audits, including inspections by the customer or an authorized independent auditor, with reasonable confidentiality, security, and scheduling arrangements that do not defeat required audit rights. Any fees must be agreed and must not obstruct legally required assistance.

Personal data breaches

The processor will notify the customer without undue delay after becoming aware of a personal data breach affecting customer data, share available information on the incident, affected records and people, likely consequences, contact point, and mitigation, and supplement it as facts develop. It will cooperate with investigation and remediation. The customer remains responsible for regulator and individual notifications unless otherwise required by law.

International transfers

The final schedules must identify processing locations and any legally required transfer mechanism, supplementary safeguards, and transfer assessments. No standard contractual clauses, UK addendum, adequacy decision, or certification is automatically adopted by publication of this page. Restricted transfers must not begin without an applicable lawful mechanism.

Return, deletion, and precedence

At the customer’s choice on termination, the processor will return or delete customer personal data and delete existing copies, unless law requires storage. The standard account-deletion policy provides deletion of active projects, chats, and generated content within 30 days after account deletion, with security logs retained for up to 30 days, subject to lawful-preservation requirements. Export is available where supported. Schedule D must specify any customer-specific instructions, formats, backup and provider-copy expiry, and deletion confirmation; the standard active-system period is not a completed schedule for every copy. Retained data must remain protected and limited to the lawful retention purpose.

An executed DPA will prevail over conflicting service terms for its subject matter. Liability, termination, and governing provisions must be agreed consistently with applicable law and mandatory protections; publication alone does not override the Terms or establish a separate liability allocation.