Data Processing AgreementData Processing Agreement

Effective 28 October 2026.

Version 5d0654f1, effective 28 October 2026

This Data Processing Agreement ("DPA") applies whenever Fortbit d.o.o. ("AIgenica", the processor) processes personal data on behalf of a client (the controller) while building or operating automations, and forms part of the client's service agreement.

1. Subject matter and duration

AIgenica processes personal data only to provide the services described in the service agreement: analysing the client's procedures, configuring and operating AI agents and automations (for example answering enquiries, capturing leads and bookings, moving data between the client's systems), and supporting them. Processing lasts for the term of the service agreement.

2. Nature of the data

Typically: contact and enquiry data of the client's customers and prospects (names, email addresses, phone numbers, messages, booking details), and data of the client's staff who use the agents. Special categories of data are processed only if expressly agreed in writing, with the additional safeguards agreed there.

3. Our obligations

We will:

• process personal data only on the client's documented instructions, including the agents' written boundaries and the approved knowledge;
• ensure that everyone with access is bound to confidentiality;
• apply the technical and organisational measures in section 6;
• assist the client in answering data-subject requests and with security, impact assessments and consultations, taking into account the nature of the processing;
• notify the client without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach;
• at the end of the services, delete or return the personal data at the client's choice, unless law requires storage;
• make available the information needed to demonstrate compliance, and allow and contribute to reasonable audits.

4. Sub-processors

The client gives general authorisation for the sub-processors listed on our Sub-processors page, including the SuperCognit platform on which agents run. We inform the client of intended changes at least 14 days in advance; the client may object on reasonable grounds. Each sub-processor is bound by data protection obligations equivalent to this DPA.

5. International transfers

Where personal data is transferred outside the EEA, the transfer relies on an adequacy decision or the European Commission's Standard Contractual Clauses, with supplementary measures where needed.

6. Technical and organisational measures

• one separate workspace per client; no mixing of client data;
• role-based access with least privilege and two-factor authentication;
• encryption in transit (TLS) and at rest where offered by the platform;
• credentials for client systems stored in an encrypted vault and never shown to the AI model;
• agents limited to approved knowledge and written boundaries, with handover to people;
• logging of conversations and actions in the client's inbox for review;
• cost and usage caps per agent;
• documented procedures for incidents and for deletion at the end of a contract.

7. Liability and precedence

Liability follows the service agreement. If this DPA conflicts with the service agreement on data protection, this DPA prevails.

8. Contact

Fortbit d.o.o. (trading as AIgenica) Gradiščak 31A, 40313 Gradiščak, Croatia OIB 84211962389 · VAT ID HR84211962389 Email: Website: https://aigenica.com