Data processing addendum

1.1 This addendum (the "DPA") is concluded between the customer that runs a woble workspace ("Customer", "you") and ACA GROUP s. r. o., with its registered office at Bardejovská Nová Ves 3092, 085 01 Bardejov, Slovak Republic, Company ID (IČO) 53092996, registered in the Commercial Register of the District Court Prešov, Section Sro, Insert No. 40535/P ("Processor", "we", "us").

1.2 For the personal data inside your workspace ("Customer data"), you are the controller and we are the processor within the meaning of Article 4(7) and 4(8) GDPR. Where you are yourself a processor for another organisation, you act towards us as controller for the purposes of this DPA and you warrant that your own controller has authorised us as a subprocessor on terms consistent with this DPA.

1.3 For account data of your members, for our website, and for billing and support records, we are an independent controller and the Privacy policy applies instead of this DPA.

2.1 Terms written with a capital letter and not defined here have the meaning given in the Terms of service. In addition:

3.1 We process Customer data in order to provide woble: a team chat in which AI agents read channels, answer messages, remember rules, run routines and workflows, and act in connected services on your instructions. The processing consists of collecting, storing, displaying, transmitting to Model providers and integrated services, and deleting the data.

3.2 The processing lasts for as long as you have a workspace with us, plus the deletion period in article 12.

3.3 Categories of data subjects: your employees, contractors, customers, suppliers and any other people mentioned in your channels or in the services you connect. Categories of data: the data depend on what you put into woble and typically include names, contact details, job titles, message content, files and business records. You must not use woble to process special categories of data under Article 9 GDPR or data relating to criminal convictions under Article 10 GDPR unless you have told us in writing and we have agreed.

4.1 We process Customer data only on your documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which we are subject; in that case we will inform you of that legal requirement before processing, unless the law prohibits it on important grounds of public interest (Article 28(3)(a) GDPR).

4.2 Your documented instructions are: the Terms of service, this DPA, your configuration of the workspace (which agents exist, what they are told, which Integrations are connected, who may approve what), and the messages your members and agents send in the ordinary use of the product. Further instructions may be given in writing to privacy@woble.ai and we may charge for instructions that go beyond the functionality of the service.

4.3 We will inform you immediately if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions (Article 28(3), final sentence).

5.1 As controller you are responsible for:

6.1 We ensure that every person we authorise to process Customer data, whether employee or contractor, has committed to confidentiality in writing or is under an appropriate statutory obligation of confidentiality (Article 28(3)(b) GDPR), and is given access only to the extent their role requires. Access to production systems is logged. Our staff do not browse customer workspaces; access to Customer data happens only to fix a fault you reported, to investigate abuse, or to answer a support request that includes the data.

7.1 We implement the technical and organisational measures required by Article 32 GDPR, as described on the Security page, which forms part of this DPA. In summary:

8.1 You give us general written authorisation within the meaning of Article 28(2) GDPR to engage Subprocessors. At the date of this DPA they fall into these categories: hosting and storage (EU regions); AI model providers (to generate agent answers); email delivery (sign-in links, notifications and receipts); payments (Dodo Payments, for card processing, which receives billing data but no Customer data); and error reporting and analytics tools, which run on our public pages only after a visitor's consent and do not receive Customer data. A current list with company names and locations is available on request at privacy@woble.ai and is provided to you when this DPA starts.

8.2 Every Subprocessor is bound by a written contract that imposes the same data protection obligations as this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures (Article 28(4) GDPR). We remain fully liable to you for the performance of each Subprocessor's obligations. Model providers in particular are barred from using Customer data to train models and from retaining it beyond what is needed to serve the request and detect abuse.

8.3 We will notify the workspace owner by email at least 30 days before adding or replacing a Subprocessor that will process Customer data. If you object on reasonable, documented data protection grounds and we cannot resolve the objection, you may terminate the affected workspace before the change takes effect and we will refund any prepaid fees for the remaining period.

9.1 Taking into account the nature of the processing, we will assist you with appropriate technical and organisational measures in fulfilling your obligation to respond to requests for exercising data subjects' rights under Chapter III GDPR (Article 28(3)(e)).

9.2 If a data subject contacts us directly about data in your workspace (access, rectification, erasure, restriction, portability, objection), we will not answer on your behalf. We will forward the request to you within five working days and tell the data subject we have done so.

9.3 The product lets you export channels, delete messages, edit or delete agent memories, remove members and delete a workspace, which covers the common cases. Where a request needs something the product cannot do, we will help you within a reasonable time and may charge a reasonable fee for unusual effort.

10.1 Taking into account the nature of the processing and the information available to us, we will assist you in ensuring compliance with your obligations under Articles 32 to 36 GDPR: security of processing, breach notification, data protection impact assessments and prior consultation of supervisory authorities (Article 28(3)(f)). This DPA, the Security page and the Privacy policy are intended to give you most of what an impact assessment needs; if you need more, ask at privacy@woble.ai.

11.1 If we become aware of a personal data breach affecting Customer data, we will notify the workspace owner without undue delay and in any event within 72 hours of becoming aware of it, so that you can meet your own deadline under Article 33 GDPR. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures we have taken or propose to take, and a contact point. Where we cannot provide everything at once, we will provide it in phases without undue further delay.

11.2 We will cooperate with you and take reasonable steps to contain, investigate and remedy the breach. Notification is not an acknowledgement of fault or liability.

12.1 You can export your data from the workspace at any time while the workspace exists. When a workspace is deleted, or when this DPA ends, we delete all Customer data in it, including channels, messages, files, agents, memories, routines, workflow runs and stored integration credentials, within 30 days, and encrypted backups roll off within a further 30 days at most (Article 28(3)(g) GDPR).

12.2 We keep only what Union or Member State law requires us to keep (for example invoices under Slovak accounting law) and only for as long as it requires. On request we will confirm deletion in writing.

13.1 Customer data is stored in the European Union. Some Subprocessors, in particular AI model providers and email delivery, may process Customer data outside the European Economic Area or the United Kingdom.

13.2 Where they do, the transfer is made under the Standard Contractual Clauses (module two, controller to processor, or module three, processor to processor, as applicable), under an adequacy decision pursuant to Article 45 GDPR, or under another mechanism valid under Chapter V GDPR, and only the data needed for that Subprocessor's role is sent. We carry out and document a transfer impact assessment where the Standard Contractual Clauses require one.

13.3 We will not transfer Customer data to a third country or international organisation except under such a mechanism, and you authorise us to conclude the Standard Contractual Clauses with Subprocessors on your behalf where that is necessary.

14.1 We will make available to you all information necessary to demonstrate compliance with Article 28 GDPR and this DPA (Article 28(3)(h)), including this DPA, the Security page, our Subprocessor list and, where we hold them, summaries of independent security assessments.

14.2 If that is not enough to meet a legal obligation you have, you may audit us, including by inspection, once in any twelve-month period, or more often after a personal data breach or when required by a supervisory authority. Audits must be agreed at least 30 days in advance, take place during business hours, not disturb other customers, and be conducted by you or an independent auditor bound by confidentiality. You bear the cost of the audit and we may charge for our time beyond one working day.

15.1 The limitations and exclusions of liability in the Terms of service apply to this DPA. Each party is liable for its own breaches of data protection law in accordance with Article 82 GDPR, and nothing in this DPA limits a data subject's rights against either party.

15.2 Where we are found liable for damage caused by processing that we carried out in breach of this DPA or of obligations of the GDPR specifically directed to processors, we may recover from you the part of the compensation corresponding to your share of responsibility, and vice versa (Article 82(5) GDPR).

16.1 This DPA starts when you first use woble and lasts until all Customer data has been deleted in accordance with article 12.

16.2 If this DPA conflicts with the Terms of service or the Privacy policy on a matter of data protection, this DPA prevails. Where the Standard Contractual Clauses apply to a transfer, they prevail over this DPA to the extent of any conflict.

16.3 This DPA is governed by the laws of the Slovak Republic, and disputes arising from it are decided by the competent courts of the Slovak Republic, as set out in article 18 of the Terms of service, without prejudice to the rights of data subjects and the competence of supervisory authorities under the GDPR.

16.4 The supervisory authority competent for us is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava 27, Slovak Republic. Our full company details are on the Company details page. This DPA was last updated on 21 September 2026.