Data Processing Agreement

Last updated: 31 October 2026 · Deutsche Fassung

This Data Processing Agreement (“DPA”) under Art. 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) is part of the contract between the business that uses Avokado (“Customer”) and Aleksandr Kadesnikov, sole trader, Company ID (IČO) 23037717, Olgy Havlové 2931/37, 130 00 Praha 3 – Žižkov, Czech Republic (“Avokado”). It applies whenever Avokado processes personal data on the Customer’s behalf and takes effect when the Customer accepts our Terms of Service. If the Customer needs a signed copy, write to hello@avokado.chat.

1. Subject matter and duration

Avokado provides the Customer with an AI assistant that replies to messages from the Customer’s clients on Instagram, Facebook Messenger, WhatsApp, Telegram and in website chats, together with a client portal and notifications. To do so Avokado processes personal data on the Customer’s behalf. The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1. This DPA applies for as long as Avokado processes personal data for the Customer.

2. Roles

The Customer is the controller and Avokado is the processor. The Customer is responsible for the lawfulness of the processing, including having a legal basis for it, informing its clients (for example in its own privacy notice) and handling the requests of data subjects. The Customer’s instructions are set out in the contract, the settings it chooses in Avokado (for example the assistant’s instructions, connected channels, enabled tools and recipients of notifications) and any further written instructions, including by email.

3. Avokado’s obligations

1. Avokado processes personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless EU or Czech law requires otherwise; in that case Avokado informs the Customer before processing, unless the law prohibits this. Avokado tells the Customer without delay if, in its opinion, an instruction infringes data protection law.
2. Avokado does not use the personal data for its own purposes, does not sell it, does not use it for advertising and does not use it to train AI models.
3. Everyone authorised by Avokado to process the personal data is bound to confidentiality.
4. Avokado takes the technical and organisational measures described in Annex 2 (Art. 32 GDPR) and may adapt them as technology develops, as long as the level of protection does not fall.
5. Taking into account the nature of the processing, Avokado assists the Customer with appropriate measures in responding to requests from data subjects (Art. 12–22 GDPR), for example by finding, exporting or deleting a person’s conversation. Requests that reach Avokado directly are forwarded to the Customer without delay.
6. Avokado assists the Customer in meeting its obligations under Art. 32–36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to Avokado.
7. Avokado notifies the Customer of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, with the information available at that time (Art. 33(2) GDPR), and supplements it as more becomes known.
8. Avokado makes available the information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates. Audits are announced at least 30 days in advance, take place during business hours, at most once a year unless there is a specific reason such as a breach, and must not compromise the security or confidentiality of other customers’ data. Avokado may first answer with written information and existing certifications of its providers.

4. Sub-processors

The Customer gives Avokado general authorisation to engage the sub-processors listed in Annex 3. Avokado informs the Customer of any intended addition or replacement at least 30 days in advance by email; the Customer may object on reasonable data protection grounds within that period. If no solution can be found, the Customer may terminate the affected services. Avokado imposes data protection obligations on each sub-processor that offer at least the protection required by this DPA and remains responsible to the Customer for its sub-processors.

Messaging platforms that the Customer chooses to connect — Meta (Instagram, Messenger, WhatsApp) and Telegram — are not Avokado’s sub-processors. The Customer uses them under its own agreements with those platforms; Avokado exchanges messages with them on the Customer’s instruction.

5. Transfers outside the EU/EEA

Avokado transfers personal data to a country outside the EU/EEA only where Chapter V GDPR is met: on the basis of an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework for certified recipients) or of the European Commission’s Standard Contractual Clauses with additional measures where needed. Annex 3 shows where each sub-processor processes data.

6. Deletion and return at the end

Message history is deleted automatically after 180 days. When the contract ends, Avokado deletes all personal data processed for the Customer within 30 days, including access tokens for connected accounts, unless EU or Czech law requires storage. Before that, the Customer can export its leads (CSV in the client portal) or ask for an export of its conversations by email. Avokado confirms the deletion on request.

7. Liability and final provisions

Liability under this DPA follows the Terms of Service, without prejudice to Art. 82 GDPR. If this DPA and the other parts of the contract conflict, this DPA prevails for the processing of personal data. The governing law and place of jurisdiction are those of the Terms of Service: the law of the Czech Republic and the competent courts of the Czech Republic. If a provision is invalid, the rest remains in force. Avokado may update this DPA where the law or its services change; material changes are announced at least 30 days in advance and the Customer may object as described in the Terms of Service. The German version at avokado.chat/avv is a translation; if they differ, the English version prevails.

Annex 1 — Details of the processing

Annex 2 — Technical and organisational measures

• Hosting and location: servers and database at Hetzner in Finland (EU); the AI model by default at a provider in the EU.
• Encryption: all traffic to the service is encrypted (TLS) and passes through Cloudflare; access tokens and API keys for connected accounts are stored encrypted in the database.
• Network: the servers are not directly reachable from the internet; all requests pass through the proxy. Webhooks from messaging platforms are accepted only with the platform’s signature or secret.
• Access control: personal logins with hashed passwords (scrypt) and separate sessions for the team panel and the client portal; the team panel is not available on the client portal’s domain; customers see only their own data; changes to connections and access are logged.
• Minimisation and retention: only the data needed for the service; automatic deletion of message history after 180 days; no use for advertising or AI training.
• Abuse protection: rate limits on logins and the website chat, human check (Cloudflare Turnstile) before a website chat starts.
• Availability: monitoring of the service; providers with redundant infrastructure.
• Organisation: confidentiality obligations for everyone with access; a procedure for handling and reporting personal data breaches; regular review of these measures.

Annex 3 — Sub-processors

If the Customer chooses a different AI model provider in its settings, that provider is added for this Customer.