Data Processing Agreement (DPA)

• "GDPR" means EU General Data Protection Regulation 2016/679 and, where applicable, UK GDPR
• "Personal Data", "Data Subject", "Processing", "Controller", "Processor", "Sub-Processor" — as defined in GDPR Art.4
• "Services" — the Botvee.ai SaaS platform provided to the Controller under the Terms and Conditions
• "SCCs" — Standard Contractual Clauses per EU Commission Decision 2021/914
• "Applicable Data Protection Law" — GDPR, UK GDPR, Swiss FADP, and any other applicable data protection legislation

Subject matter: Processing of personal data of the Controller's end-users through the Botvee platform.

Nature: Automated processing including: collection via AI agent, storage, retrieval, consultation, use, and deletion of end-user personal data.

Purpose: Delivering AI agent services as subscribed to by the Controller under the Terms and Conditions.

Duration: For the term of the subscription agreement and the period required to complete deletion per this DPA after termination.

Botvee shall, with respect to any personal data processed on behalf of the Controller:

• Process personal data only on documented instructions of the Controller — including with regard to transfers — unless required to do so by applicable law
• Ensure that persons authorised to process personal data have committed to confidentiality or are under a statutory obligation of confidentiality
• Implement appropriate technical and organisational security measures per GDPR Art.32 — see Security Policy
• Respect the conditions for engaging sub-processors as set out in Section 6
• Assist the Controller in responding to data subject rights requests by appropriate technical and organisational measures
• Assist the Controller in ensuring compliance with GDPR Arts.32-36 (security, breach notification, DPIA, prior consultation)
• At the Controller's choice, delete or return all personal data upon termination of services
• Make available all information necessary to demonstrate compliance with GDPR Art.28 obligations
• Allow for and contribute to audits conducted by the Controller or an auditor mandated by the Controller — with reasonable notice and at Controller's cost

The Controller shall:

• Ensure a lawful legal basis exists for all personal data collected from data subjects via Botvee AI agents
• Inform data subjects about Botvee's role as data processor through the Controller's own privacy notice
• Not instruct Botvee to process personal data in a way that would violate applicable data protection law
• Obtain required consents from data subjects before collecting their personal data through Botvee AI agents
• Handle all data subject rights requests received from the Controller's own end-users

The Controller provides general authorisation for Botvee to engage sub-processors. Current sub-processors are listed at www.botvee.ai/subprocessors. Botvee will:

• Notify the Controller of any intended addition or replacement of sub-processors with at least 14 days' prior written notice
• Give the Controller the opportunity to object to such changes on reasonable data protection grounds
• Impose equivalent data protection obligations on all sub-processors by contract (including SCCs where applicable)
• Remain fully liable to the Controller for the acts and omissions of its sub-processors

Where Botvee transfers personal data from the EU/UK/Switzerland to sub-processors in non-adequate countries, Botvee will apply the applicable legal transfer mechanism including:

• EU Standard Contractual Clauses (SCCs) per Commission Decision 2021/914 — Module 2 (Controller to Processor)
• UK International Data Transfer Agreements (IDTAs) or UK Addendum for UK data
• Swiss Federal Act on Data Protection (FADP) transfer safeguards for Swiss data
• Transfer Impact Assessments (TIAs) conducted for all transfers to non-adequate countries

The SCCs are incorporated by reference into this DPA and form part of the legal transfer mechanism for EU/UK data transfers.

Botvee will notify the Controller within 48 hours of becoming aware of a personal data breach affecting data processed on behalf of the Controller. The notification will include all information available at the time to enable the Controller to meet its own GDPR Art.33 72-hour notification obligations. Botvee will cooperate with the Controller in investigating, mitigating, and remedying the breach.

Botvee will provide reasonable technical assistance to the Controller to fulfil data subject rights requests (access, rectification, erasure, restriction, portability, objection) within 30 calendar days (45 days for CCPA). The Controller remains responsible for receiving and responding to requests from its own end-users.

Upon termination, Botvee will at the Controller's written election: (a) securely delete all personal data processed on behalf of the Controller within 30 days of termination, or (b) return data in a structured machine-readable format (CSV/JSON) before deletion. Written confirmation of deletion provided on request.

Note: Billing records must be retained by Botvee for 7 years under mandatory FBR requirements — these are Botvee's own financial records, not the Controller's end-user data.

This DPA is governed by the laws of Pakistan (Contract Act 1872, Companies Act 2017) and applicable EU/UK data protection law to the extent required for GDPR compliance. Disputes are subject to the dispute resolution mechanism in the Terms and Conditions (Courts of Karachi, Sindh, Pakistan).

1. Email legal@botvee.ai — Subject: "DPA Execution Request — [Your Company Name]"
2. Provide: company legal name, registered address, company registration number, and contact person details
3. Botvee will provide a completed, execution-ready DPA within 5 business days
4. Both parties sign electronically — the executed DPA is stored securely by both parties
5. The DPA takes effect from the date of the Controller's last signature