Data Processing Addendum

This review-ready addendum describes Clickalong’s processor obligations. It is a template requiring customer details and legal review, and becomes effective only when signedby the customer and Profitonium Apps Ltd. Request an execution copy at hello@profitoniumapps.com.

1. Roles and scope

For visitor conversations, leads, imported knowledge, and other content submitted to a customer workspace, the customer is the controller and Profitonium Apps Ltd is the processor. Clickalong processes that data to provide, secure, troubleshoot, and support the service under the customer’s documented instructions, including configuration made through the product.

2. Processing details

• Subjects: customer team members, the customer’s visitors, leads, and support contacts.
• Data: identity and contact data, conversation content, knowledge content, product context, technical identifiers, and optional guided-tour evidence.
• Purpose: grounded support answers, guided assistance, shared-inbox operation, lead handling, knowledge retrieval, security, and customer-directed integrations.
• Duration: the service term plus the retention and deletion periods stated in the Privacy Policy or an executed order.

3. Processor obligations

Clickalong will process personal data only on documented instructions unless law requires otherwise; keep authorized personnel under confidentiality duties; apply appropriate technical and organizational measures; ensure subprocessors receive materially equivalent data-protection obligations; and make information reasonably necessary for a customer’s compliance assessment available under appropriate confidentiality.

4. Data subject requests

The customer remains responsible for responding to a data subject. Taking into account the nature of the processing, Clickalong will provide reasonable assistance with access, correction, export, restriction, objection, and deletion requests. Visitors should first contact the business whose widget they used; either party may contact Clickalong when processor assistance is required.

5. Security incident

Clickalong will notify the customer without undue delay after confirming a personal-data Security incident affecting the customer’s workspace, provide information reasonably available about its nature and impact, take steps to contain and remediate it, and cooperate with the customer’s legally required assessment and notices.

6. Subprocessors and transfers

The customer generally authorizes the providers in the subprocessor register. International transfers of protected EEA, UK, or Swiss personal data must use an applicable lawful mechanism, including the relevant Standard Contractual Clausesand UK Addendum where required. The execution copy must identify the exporter, importer, competent authority, transfer module, and technical measures.

7. Return and deletion

At the end of service, Clickalong will delete or return customer personal data on request, except for retained backups, legal records, security evidence, and workspace tombstones that must remain for a documented legal or operational purpose. Retained data stays protected and is not used for another purpose.

8. Execution details requiring legal review

The signed version must add the parties’ legal names, registered addresses, signatures, governing agreement, audit/confidentiality terms, liability alignment, SCC annexes, and any customer-specific retention or residency commitment. Nothing on this page asserts an unsigned DPA, certification, or data-residency commitment.