Data Processing Agreement (DPA)

Last updated: May 2026

When you use Bedaki to process personal data of your customers' end users, you are the data controller and Bedaki is your data processor (Article 7 of Law 09-08; Article 28 GDPR for EEA data subjects). This page summarizes the DPA we offer and how to sign it.

Scope

The DPA covers all personal data that Bedaki processes on your behalf in the course of providing the Service, including conversation logs, end-user identifiers, knowledge-base content, agent profiles, and platform-scoped IDs from Meta channels.

Standard DPA Terms

  • Bedaki processes data only on documented instructions from you (the controller).
  • Bedaki ensures personnel authorized to process the data are bound by confidentiality.
  • Bedaki implements appropriate technical and organizational measures, described on our Security page.
  • Bedaki assists you with data subject requests, data protection impact assessments, and breach notifications.
  • Bedaki uses only sub-processors disclosed on our Sub-Processors page, with 30 days' advance notice before adding new ones.
  • Cross-border transfers are made under Standard Contractual Clauses and, where required, CNDP authorization.
  • On termination, Bedaki deletes or returns personal data within 30 days, except where retention is required by law.

How to sign

  1. Email legal@bedaki.com with subject line "DPA request" and include your company's legal name, country of registration, and authorized signatory.
  2. We send you our pre-signed standard DPA within 5 business days.
  3. If you require non-standard amendments, our legal team will review and respond within 10 business days.
  4. Once countersigned and returned, the DPA is effective and is incorporated by reference into your Terms of Service.

DPA Annexes

  • Annex I, Description of processing (categories of data, purposes, retention)
  • Annex II, Technical and organizational measures (see Security page)
  • Annex III, List of authorized sub-processors (see Sub-Processors page)
  • Annex IV, Standard Contractual Clauses where applicable (EU-controlled data exported to non-adequate countries)