MAiCVersion française

Data Processing Agreement — MyAiCompany

Version 1.2, in force since 10 October 2026 (1.1: 8 October 2026; 1.0: 30 September 2026). Annex to the Terms of Service (§ 10), of which it forms part.

This is a translation of the French text; in case of divergence, the French text prevails.

  1. Subject and roles. This agreement governs the processing of personal data that the client entrusts to the platform to run their company. For this data, the client is the controller and NINABOT Sàrl, Chemin de Riantbosson 19, 1217 Meyrin, Switzerland, is the processor, within the meaning of Art. 28 of Regulation (EU) 2016/679 (GDPR) and Art. 9 of the Swiss Federal Act on Data Protection (FADP).
  2. Nature, purpose and duration. Hosting and publishing the client's site and shop, keeping their Town Hall (customers, products, orders, invoices), delivering their mail, storing their files and running the agents they launch — for the term of the subscription, then the closure and deletion periods of the Terms (§ 7).
  3. Data and data subjects. The client's customers, leads, contacts, correspondents and team members; identity and contact details, orders and invoices, messages and e-mails, uploaded content and files. The client does not entrust special categories of data (Art. 9 GDPR) without telling NINABOT in writing.
  4. Instructions. NINABOT processes this data only on the client's documented instructions: the Terms, this agreement and the actions the client launches or approves in the deck. If an instruction seems unlawful, NINABOT informs the client and does not carry it out.
  5. Confidentiality. Persons authorised to access the data are bound by confidentiality and access it only to operate the platform or to help the client at their request.
  6. Security. Appropriate technical and organisational measures, including: encryption in transit; production data hosted in Switzerland and encrypted backups kept in Geneva; administrative access limited to the people operating the platform, by key and private network; separation of data per company, single-use login links, audit log of actions; review of content before publication.
  7. Sub-processors. The client gives a general authorisation for the sub-processors listed in the privacy policy (§ 5). NINABOT announces any addition or replacement at least 30 days in advance, in the deck or by e-mail; the client may object and, failing agreement, close their account before that date with their data returned. NINABOT imposes equivalent data protection obligations on each sub-processor. Exception — Social networks (Postiz): this optional service is not a sub-processor chosen by NINABOT. The client switches it on, after an explicit warning, and thereby instructs that the posts, images and account access it connects be sent to Postiz. NINABOT controls neither the hosting nor the processing of that data at Postiz; it falls outside § 8. The client may revoke this instruction at any time.
  8. Transfers. Company data is hosted in Switzerland, which benefits from a European Commission adequacy decision. The text an AI task requires may be processed, for the time it takes to answer, by a sub-processor in the European Union (OVHcloud, France), whose level of protection the Swiss Federal Council recognises as adequate; never outside Switzerland and the EU. Transfers to sub-processors outside Switzerland and the European Union are limited to what their function requires and covered by standard contractual clauses or the EU–US Data Privacy Framework.
  9. Assistance. NINABOT helps the client, as far as possible, to answer data subject requests (access, rectification, erasure, portability) — in particular through the deck's one-click export — and to meet their security, impact assessment and notification obligations.
  10. Data breach. NINABOT informs the client of any personal data breach affecting them **without undue delay and at the latest 48 hours** after becoming aware of it, with the information available to let the client notify the authority and the data subjects.
  11. End of processing. At the end of the subscription the client retrieves their data through the one-click export or on request (Terms § 6). NINABOT then deletes it according to the Terms (§ 7); encrypted backups expire at the latest 90 days later, unless the law requires retention.
  12. Audit. NINABOT makes available the information necessary to demonstrate compliance with this agreement. The client may request an audit once a year, with 30 days' notice, at their own cost, carried out by themselves or by an auditor bound by confidentiality.
  13. Governing law. This agreement follows the Terms (Swiss law, courts of Geneva), without prejudice to the mandatory provisions of the GDPR where it applies to the processing.