Data Processing Addendum
This Data Processing Addendum (the "DPA") supplements the HumanBot Terms and Conditions and any other agreement governing the Customer's use of HumanBot (together, the "Agreement").
HumanBot is operated by Strontium Corp, a company registered in Ontario, Canada, with its office and mailing address at 209 - 980 Fraser Drive, Burlington, ON L7L 5J1, Canada ("Strontium", "HumanBot", "we", or the "Processor"). Data protection contact: paul@strontium.ai.
The "Customer" is the legal person or individual responsible for the HumanBot account that accepts this DPA. For personal data that Customer determines is to be processed through its deployed chatbots, Customer generally acts as the "Controller" and Strontium acts as the "Processor" under Regulation (EU) 2016/679 ("GDPR"). If Customer acts as a processor on behalf of another controller, these terms apply to Customer as a processor and Strontium as its sub-processor, as applicable.
How this DPA becomes binding: Strontium offers this DPA as part of the Agreement. An authorized account representative may accept it by checking the expressly labeled DPA acceptance box in the HumanBot account interface and submitting that acceptance. The effective date is the UTC date and time recorded by HumanBot for that acceptance. The record identifies the accepting account, authorized user and DPA version; Strontium will retain an evidentiary copy of the accepted version. The electronic acceptance constitutes the parties' agreement to this DPA.
1. Scope, roles and documented instructions
1.1. This DPA applies to personal data processed by Strontium on behalf of Customer through HumanBot chatbot, voice, lead-capture and related features ("Customer Personal Data"). Strontium may independently control personal data collected for its own direct account, billing, security and business administration purposes, as described in the applicable Privacy Policy.
1.2. Strontium will process Customer Personal Data only on Customer's documented instructions, including regarding transfers outside the EEA, unless legally required otherwise. Where legally permitted, Strontium will inform Customer before any legally compelled processing that falls outside those instructions.
1.3. Documented instructions include the Agreement, this DPA, Customer's configuration and use of the Services, and written instructions reasonably provided by Customer. Strontium will promptly inform Customer if it believes an instruction infringes GDPR or applicable EU or Member State data protection law.
1.4. Customer is responsible for selecting a lawful basis for its processing, providing notices to visitors, obtaining consent when required, and configuring HumanBot appropriately. Customer will not intentionally collect special-category data or children's data using the Services without first agreeing with Strontium on any necessary additional safeguards.
2. Confidentiality and security
2.1. Strontium will ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations or statutory duties and access it only as necessary to provide or support the Services.
2.2. Strontium will implement appropriate technical and organizational security measures consistent with Article 32 GDPR, taking account of the nature of the data and risks to individuals, and periodically review them. An overview of these measures is set out in Annex B.
2.3. Strontium will not materially reduce the overall security protections described in this DPA during the term without providing appropriate replacement safeguards.
3. Sub-processors
3.1. Customer gives general written authorization for Strontium to appoint the sub-processors identified in Annex C for the specified purposes. Strontium will maintain and make available an accurate list of sub-processors processing Customer Personal Data.
3.2. Strontium will inform Customer by email to its designated account contact at least 30 days before adding or replacing a sub-processor that handles Customer Personal Data. Customer may object in writing during that period on reasonable data-protection grounds. The parties will cooperate to find a reasonable remedy; if none is available, Customer may discontinue the affected feature or terminate the affected Services in accordance with the Agreement.
3.3. Strontium will ensure each engaged sub-processor is bound by written data-protection obligations that provide substantially the same protections required by this DPA and will remain responsible to Customer for the performance of its sub-processors' obligations as required by Article 28(4) GDPR.
3.4. Third-party integrations selected and contracted directly by Customer, including its own Zapier account, are not automatically HumanBot sub-processors merely because Customer directs the transmission of data to them. The responsible party for each integration depends on the actual contractual relationship and data flow.
4. Data-subject rights and assistance
4.1. Taking account of the nature of the processing, Strontium will provide reasonable technical and organizational assistance to Customer, insofar as possible, in responding to data-subject requests for access, correction, erasure, restriction, portability and other applicable rights.
4.2. Where Strontium receives a request directly from a website visitor about Customer-controlled chat data, it will direct the request to Customer where reasonably identifiable, unless legally required to respond otherwise. Customer may delete conversation logs from the HumanBot control panel and request further assistance by emailing paul@strontium.ai.
4.3. Strontium will reasonably assist Customer with data protection impact assessments, prior consultations with supervisory authorities, and demonstrating applicable GDPR compliance, taking account of the nature of processing and available information.
5. Personal-data breaches
5.1. Strontium will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. The notification will contain available details relevant to Customer's obligations, including the nature of the breach, affected categories of data and individuals where known, likely consequences, and containment or remediation steps.
5.2. Strontium will reasonably cooperate in investigating and mitigating the incident and provide further relevant details as they become available. Notification will be sent to Customer's designated account email or other agreed security contact. Customer remains responsible for deciding whether and when to notify regulators and affected individuals under applicable law.
6. Storage, return and deletion
6.1. Conversation history is retained in the Customer's HumanBot account until Customer deletes it through the control panel. HumanBot does not currently apply an automatic time-based expiry to those conversation logs. Other operational records, submitted materials and service-provider data are handled according to their purposes, applicable service terms, Customer instructions and legal retention requirements.
6.2. Upon termination or expiry of the Services, Strontium will, at Customer's choice, return or delete Customer Personal Data and existing copies unless retention is required by applicable law. Customer may communicate its choice through the account or by contacting paul@strontium.ai. Material retained under law or temporarily present in protected backups will remain subject to appropriate safeguards and will not be processed for unrelated purposes.
6.3. Customer may request confirmation of completion of deletion. Data held temporarily in protected backups will remain restricted to backup, recovery and security purposes until removed through the applicable backup lifecycle. Strontium will ensure that such retained copies remain protected and are deleted or overwritten in accordance with the applicable retention process, except where the law requires further retention.
7. Compliance information and audit
7.1. Strontium will make available information reasonably necessary to demonstrate its compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, by Customer or an auditor mandated by Customer.
7.2. Audit activity will be arranged with reasonable notice and subject to confidentiality, security and operational protections that do not defeat Customer's applicable audit rights. The parties will generally first seek to address requests through relevant documentation and evidence where adequate.
8. International processing and transfers
8.1. Strontium Corp is established in Ontario, Canada. The European Commission recognizes an adequacy decision for qualifying commercial organizations in Canada; the scope of this decision must cover the relevant transfer and processing activity before it is relied upon.
8.2. HumanBot's application servers are hosted on WebNX dedicated infrastructure in Ogden, Utah, United States. Other authorized AI and voice providers may process data in countries determined by the configured service and region. Customer Personal Data should therefore not be assumed to remain in Canada or the EEA.
8.3. To the extent GDPR Chapter V applies, Strontium will ensure applicable restricted transfers and onward transfers are supported by a valid legal transfer mechanism, such as an applicable adequacy decision, a recipient's verified EU–US Data Privacy Framework certification for the covered data, or executed EU Standard Contractual Clauses with any required assessments and supplementary measures.
8.4. The European Commission's international-transfer Standard Contractual Clauses are separate from this Article 28 DPA. Where the clauses apply, the relevant parties must execute the applicable module(s) and complete the required annexes. Acceptance of this DPA by itself does not execute those transfer clauses with WebNX or any other provider.
9. General terms
9.1. This DPA remains effective while Strontium processes Customer Personal Data under the Agreement. Where a provision of this DPA conflicts with the Agreement on a matter of Customer Personal Data protection, this DPA controls to the extent of the conflict. Validly executed EU Standard Contractual Clauses take precedence to the extent required by those clauses.
9.2. Material changes to this DPA that affect either party's contractual data-protection rights or obligations will be subject to a legally effective agreement or re-acceptance process. A new version will have a new version identifier. Strontium will preserve the version accepted by each Customer.
9.3. This DPA is governed by the governing-law provisions of the Agreement, except where mandatory law or properly executed international-transfer clauses require otherwise. If a provision is held unenforceable, the remainder continues to apply so far as legally permissible.
Annex A — Description of processing
| Subject matter | HumanBot chatbot and Customer-selected AI responses, voice, lead collection, knowledge/training materials, conversation history and integration features. |
|---|---|
| Nature and purpose | Receiving, storing, retrieving, using and transmitting data in order to operate Customer-configured chatbot experiences, respond to visitors, generate speech where enabled, collect leads and supply integration functionality. |
| Data subjects | Visitors to Customer websites, chat participants, prospective leads and Customer users whose information appears within chat content or training materials. |
| Types of personal data | Chat text, submitted names, email addresses, telephone numbers, forms and uploads; training materials containing personal data; conversation identifiers and timestamps; technical/network information such as IP addresses and browser data where collected; location-related information where used; and audio or transcripts where voice features are enabled. |
| Duration | For the duration of the Agreement, subject to Customer-directed deletion, termination obligations and any legal retention requirements. HumanBot chat logs remain until Customer removes them in the control panel; no automatic chat-log expiration is currently applied. |
| Primary application hosting | WebNX dedicated servers, Ogden, Utah, United States. Provider-specific external processing can occur separately, depending on the feature used. |
| Data-subject assistance | Customer uses available control-panel functions and may request additional reasonable assistance from paul@strontium.ai. |
Annex B — Technical and organizational security measures
Strontium will maintain security measures appropriate to the nature of the Services and the risks presented by processing Customer Personal Data. Measures may evolve as technology and security needs change, provided the overall level of protection is not materially reduced.
| Area | Security commitment |
|---|---|
| Data in transit | HumanBot's browser-facing application communications use HTTPS/TLS. Strontium will apply appropriate protections to service and provider communications that transmit Customer Personal Data. |
| Stored information | Strontium will protect stored Customer Personal Data through access restrictions and appropriate application, server and storage safeguards, using encryption and related measures where appropriate to the risk and processing environment. |
| Access and authentication | Strontium will restrict access to authorized personnel who need it for their responsibilities, apply appropriate authentication and permission controls, and revoke access when it is no longer required. |
| Infrastructure and resilience | HumanBot's application servers use WebNX infrastructure in Ogden, Utah. Strontium will maintain appropriate arrangements for the availability and recovery of the Services and protect any backup copies against unauthorized use. |
| Monitoring and incidents | Strontium will maintain risk-appropriate practices for security monitoring, maintenance, vulnerability remediation and responding to suspected or confirmed incidents affecting Customer Personal Data. |
| Segregation and deletion | Strontium will use access-control and application measures designed to prevent unauthorized cross-account access. Customers can remove conversation logs in their control panels; further return or deletion obligations are described in Section 6. |
Annex C — Infrastructure and AI service providers
The following third-party providers are used for HumanBot's hosting, chatbot and voice functions. A listed provider acts as a sub-processor to the extent it processes Customer Personal Data on Strontium's behalf. Actual processing countries for cloud-based AI and speech services depend on the contracted service, region configuration and the provider's infrastructure; a provider's headquarters does not necessarily identify every place where data is processed.
| Provider | Service / relevant data | Location / processing region |
|---|---|---|
| WebNX | Dedicated-server hosting for the HumanBot application and associated stored data | United States — Ogden, Utah (ODG1). |
| OpenAI | AI-generated chatbot replies using data sent to the selected AI service | Provider-operated processing facilities, including the United States and other locations permitted by the applicable service terms. |
| Microsoft | Text-to-speech processing when a Microsoft voice is selected | Cloud processing locations associated with the configured voice service. |
| Text-to-speech processing when a Google voice is selected | Cloud processing locations associated with the configured voice service. | |
| Amazon Web Services (AWS) | Text-to-speech processing when an AWS voice is selected | AWS service regions associated with the configured voice service. |
HumanBot also has internally operated text-to-speech technology. Internal processing by the same Strontium Corp legal entity is not a separate third-party sub-processor. Zapier may be a Customer-directed integration, depending on how the Customer configures and contracts for that service.
Annex D — International transfer arrangements
| Transfer / provider | Location | Data protection arrangement |
|---|---|---|
| Customer in the EEA to Strontium Corp | Canada | Where applicable to the processing and the receiving organization, transfers to Canada are covered by the European Commission's adequacy decision for Canadian commercial organizations. EU adequacy information. |
| HumanBot hosting via WebNX | United States — Utah | Strontium Corp will ensure that restricted international transfers to or through this hosting provider are protected by an appropriate mechanism under GDPR Chapter V, where applicable, such as executed Standard Contractual Clauses or another lawful transfer basis. |
| OpenAI, Microsoft, Google and AWS processing | Cloud service locations determined by the relevant service agreement and configuration | Strontium will rely on applicable provider data-processing terms and international-transfer safeguards, including Standard Contractual Clauses where required, or another lawful transfer mechanism for the processing concerned. |
The European Commission's international-transfer Standard Contractual Clauses are available on its website. Where used, they must form part of the applicable agreement between the relevant contracting parties, with the necessary module(s), annexes and selections. This DPA governs Strontium's relationship with Customer; it does not itself sign agreements on behalf of independent infrastructure or AI providers.
Electronic execution
By accepting this DPA through HumanBot as an authorized representative, Customer agrees to its terms, and Strontium Corp agrees to the obligations stated herein. HumanBot's electronic record of the Customer, accepting user, accepted version and acceptance timestamp is evidence of execution. This DPA may also be accepted by a separate authorized written signature where arranged with Strontium.