Data Processing Addendum

Effective date: 13 September 2026

This Addendum forms part of the Terms of Service between "MOYSHA CRM SOLUTIONS" S.R.L. ("Processor") and the Customer ("Controller"). It is concluded under Law no. 195/2024 of the Republic of Moldova on the protection of personal data and, where the Controller is established in the European Union or processes the data of persons in the European Union, under Regulation (EU) 2016/679 (GDPR). Accepting the Terms constitutes conclusion of this Addendum in writing.

1. Roles

The Controller determines the purposes and means of processing personal data of the individuals who contact it through channels connected to Vorbly. The Processor processes that data only on the Controller's documented instructions.

For personal data of the Controller's own account users, the Processor acts as controller and the Privacy Policy applies.

2. Subject matter, duration, nature and purpose

Subject matter: provision of an AI sales assistant and associated lead management.
Duration: the term of the subscription, plus the retention periods stated below.
Nature and purpose: receiving and answering enquiries, capturing contact details, notifying the Controller, storing conversations and leads, generating summaries and quality signals.

Categories of data subjects: individuals who contact the Controller through a connected channel.

Categories of personal data: message content including images sent by the data subject; name; phone number; email address where given; channel identifier; IP address and derived country; language; page and campaign parameters of the visit; conversation summary and status.

Special categories: none are requested by the service. The Controller undertakes not to configure the assistant to collect them.

3. Instructions

The Terms of Service, this Addendum, and the settings the Controller makes in the dashboard constitute the Controller's complete documented instructions. The Processor will inform the Controller if, in its opinion, an instruction infringes applicable data protection law, and may suspend the affected processing until the instruction is amended.

4. Confidentiality

Personnel of the Processor with access to personal data are bound by confidentiality obligations that survive the end of their engagement, and receive access only to the extent required for their duties.

5. Security measures

The Processor implements and maintains: encryption in transit and at rest; additional encryption of channel credentials and other secrets with AES-256-GCM; row-level isolation between organisations at database level; role-based access control; two-factor authentication for privileged access; rate limiting and abuse detection; logging of privileged actions; automated backups; and periodic review of access rights. The Processor may change specific measures provided the level of protection is not reduced.

6. Sub-processors

The Controller gives general authorisation for the engagement of sub-processors. The current list is published at https://vorbly.ai/subprocessors. The Processor will give at least 30 days' notice before adding or replacing a sub-processor and the Controller may object on reasonable data protection grounds; if the objection cannot be resolved, the Controller may terminate the affected service without penalty and receive a pro-rata refund.

The Processor remains fully liable to the Controller for the performance of its sub-processors' obligations.

7. Assistance with data subject rights

Where a data subject exercises a right directly with the Controller, the Processor provides, on request and without undue delay, the information and technical means required to respond.

Where a data subject sends the request to the Processor, the following applies and constitutes the Controller's standing instruction:

1. The Processor identifies the records concerned and notifies the Controller by the notification channels configured in the dashboard, with a direct link to those records.
2. The Controller has 14 calendar days to either execute the request itself, or refuse it, stating a lawful ground (for example: the request was withdrawn; the data is necessary for the performance of a contract with the data subject; retention is required by law). A refusal is recorded and the Processor takes no further action on that request; responsibility for the refusal rests with the Controller.
3. If the Controller does neither within 14 calendar days, the Processor deletes the data concerned from its own systems and informs both the Controller and the data subject. This is a deletion of the Processor's copy only; it does not affect any copy the Controller holds in its own CRM, inbox or records.
4. Automatic deletion applies only to records where the phone number matched in full. Matches on name alone, or on part of a number, are never deleted automatically: they are shown to the Controller for decision, and if the Controller does not respond, they are referred for manual review by the Processor.
5. Reminders are sent on the day of the request and on days 7 and 12.

Data obtained through Meta platforms (Instagram, Messenger, WhatsApp) is deleted by the Processor without undue delay upon a valid request, without waiting for the Controller, as required by Meta's Developer Data Use Policy. The Controller is informed.

8. Personal data breach

The Processor notifies the Controller without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting the Controller's data, providing the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken. The Processor assists the Controller in meeting its own notification obligations.

9. Data protection impact assessments

The Processor provides reasonable assistance with impact assessments and prior consultations with the supervisory authority, taking into account the nature of the processing and the information available to it.

10. Retention, return and deletion

Conversation data is retained for the period set by the Controller in the dashboard (default 365 days, configurable between 30 and 3650 days) and is then deleted automatically.

On termination, the Controller may export leads and conversations for 30 days. After that period the Processor deletes all personal data processed on the Controller's behalf, including from backups on their normal rotation cycle (not exceeding 90 days), except where retention is required by law.

11. Audit

The Processor makes available the information necessary to demonstrate compliance with this Addendum. Where the Controller reasonably requires more, an audit may be carried out once per calendar year, on 30 days' written notice, during business hours, by the Controller or an independent auditor bound by confidentiality and not a competitor of the Processor, without disrupting the service and at the Controller's cost.

12. International transfers

The Processor may transfer personal data to the sub-processors listed at https://vorbly.ai/subprocessors, including to the United States. Such transfers take place under standard contractual clauses or another transfer mechanism permitted by applicable law, copies of which are available on request.

13. Precedence

In case of conflict between this Addendum and the Terms of Service, this Addendum prevails in respect of the processing of personal data.