Data processing agreement

1. Who this covers

This agreement applies between the business that holds a Sajama One workspace ("you", the controller) and Sajama One ("we", the processor). It covers personal data we process on your behalf in order to provide the service - it does not cover data we process as a controller, such as your billing record, which is described in the privacy notice.

It forms part of the terms of service and takes effect when you accept them.

2. What we process

Categories of data subject: your customers, your visitors, and the agents you invite into the workspace.

Categories of personal data: names, email addresses, phone numbers, social handles, conversation content, files and images you or your customers upload, and the metadata needed to deliver a message. We do not ask for special category data, and you should not send it.

Purpose: providing the inbox, routing messages, matching your saved answers, analytics on your own workspace, and support you ask for. Nothing else. We do not sell data, and we do not use your customers' conversations to train models.

Duration: for as long as your workspace exists, plus the deletion window in clause 9.

3. Our obligations

• Process personal data only on your documented instructions, including when transferring it outside your country - unless the law requires otherwise, in which case we tell you first unless we are legally barred from doing so.
• Ensure everyone who can access the data is bound by confidentiality.
• Implement the technical and organisational measures in clause 4.
• Assist you with data subject requests, impact assessments and prior consultations, taking into account what we can actually do as a processor.
• Tell you without undue delay if we become aware of a personal data breach.
• Delete or return the data at the end of the agreement, as set out in clause 9.

4. Security measures

Row-level security on every application table, with a blanket revoke of browser-role access; tenant scoping enforced in the data layer; AES-256-GCM encryption for stored channel and CRM tokens; TLS in transit; signed and timing-safe verification of every inbound webhook; two-factor authentication, available to every user and enforceable across a whole workspace; rate limiting and audit records on privileged actions.

The full description, including what we do not yet have, is on the security page. We would rather you read the gaps there than discover them in an incident.

5. Subprocessors

You give general authorisation to the subprocessors listed on the subprocessor page. We impose the same data protection obligations on each of them that we accept here, and we remain responsible to you for their performance.

We will give you notice before adding or replacing a subprocessor that processes personal data, and a reasonable opportunity to object. If you object on data protection grounds and we cannot resolve it, you may end the affected subscription before the change takes effect.

6. International transfers

Where personal data is transferred out of the UK, the EEA or another jurisdiction with transfer restrictions, we rely on the Standard Contractual Clauses (2021/914) or an equivalent approved mechanism, together with the security measures in clause 4 as supplementary measures. Tell us which framework applies to you and we will complete the annexes.

Data at rest sits in the region chosen for your workspace's Supabase project. We do not currently offer a choice of region after the workspace is created - say so early if you need one.

7. Breach notification

We notify you without undue delay and, where possible, within 72 hours of becoming aware of a personal data breach affecting your data. The notice includes what happened, the categories and approximate volume of data affected, the likely consequences, what we have done, and what we recommend you do.

Where we cannot give everything at once, we give it in phases rather than waiting for a complete picture. You are responsible for your own notification to your regulators and your customers.

8. Audits and information

On request, once a year, we will answer a security questionnaire and provide the evidence we hold - configuration, architecture and control descriptions. Remote review only; we do not offer on-site audits at this stage.

We do not hold a SOC 2 report or an ISO 27001 certificate, and this agreement does not claim otherwise.

9. Deletion and return

You can export your workspace at any time from Settings, as JSON, including the audit trail. On termination, export remains available for 30 days. After that window we delete the workspace data, and it leaves backups within 90 days.

Deleting a workspace in the product is a request with a reversal window; once it completes, the data is gone. We keep only what the law requires us to keep - for example, billing records - and nothing else.

10. Liability and order of precedence

Liability under this agreement is subject to the limitations in the terms of service. If this agreement conflicts with the terms on a data protection question, this agreement wins.

11. How to sign it

Email support@sajamaone.com with your legal entity name, registered address and the name and title of your signatory. We return a signed copy, with the clauses above unchanged, within five business days.

If your organisation requires its own template, send it. We accept most customer paper where the substance matches this document; we are a small company and we will tell you honestly if we cannot meet a term, rather than sign something we cannot operate.