Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other agreement between Pengo and the Customer (the “Agreement”) and applies when Pengo processes Customer Personal Data on the Customer’s behalf. Terms such as “controller”, “processor”, “personal data”, “processing” and “data subject” have the meanings given in the GDPR. If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data.

Scope and roles

• Customer Personal Data means personal data in Customer Data that Pengo processes on the Customer’s behalf when providing the Service, such as visitor messages and contact details.
• For Customer Personal Data, the Customer is the controller (or a processor acting for its own customers), and Pengo is the processor (or subprocessor).
• Pengo processes account, billing and usage data about the Customer’s own users as a controller, as described in our Privacy Policy. That processing is outside this DPA.
• “Data Protection Laws” means all privacy and data protection laws that apply to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP and US state privacy laws such as the CCPA.

Details of processing

Processing on your instructions

Pengo processes Customer Personal Data only on the Customer’s documented instructions. The Agreement, this DPA and the Customer’s configuration of the Service (including its AI, retention, integration and Action settings) are the Customer’s complete instructions. Pengo will tell the Customer if it believes an instruction breaches Data Protection Laws, unless the law forbids it. Pengo will not sell Customer Personal Data or use it to train AI models for other customers.

The Customer is responsible for having a lawful basis and giving any required notices to data subjects, including that it uses Pengo and AI to provide chat and support.

Confidentiality

Pengo ensures that everyone authorized to process Customer Personal Data is bound by confidentiality obligations, and limits staff access to what is needed to provide, secure and support the Service. Access to a Customer’s workspace for support happens only with the Customer’s request or permission, or when needed to investigate abuse or a security incident, and is logged.

Security measures

Pengo maintains appropriate technical and organizational measures to protect Customer Personal Data, including:

• encryption in transit with TLS and at rest, and AES-256-GCM encryption for integration secrets;
• row-level security isolating each workspace’s data in the database, with ownership checks on every API route;
• private, token-authenticated realtime channels;
• single sign-on, two-factor authentication, role-based permissions and audit logs for customer workspaces;
• least-privilege staff access, protected production credentials, and code review for every change;
• automated backups, monitoring and alerting, and a documented incident response process;
• regular review of these measures as technology and threats change.

More detail is on our Security page.

Subprocessors

The Customer gives general authorization for Pengo to use subprocessors. Pengo imposes data protection obligations on each subprocessor that are at least as protective as this DPA, and remains responsible for their performance. The current subprocessors are:

Channel providers marked “if enabled” process data only for Customers that connect that channel. Integrations the Customer connects, such as its store or CRM, are the Customer’s own vendors, not Pengo subprocessors.

Pengo will update this list and notify Workspace owners by email at least 30 days before a new subprocessor starts processing Customer Personal Data. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining term.

Data subject requests and assistance

The Service lets the Customer access, export, correct and erase Customer Personal Data, for example by exporting a contact’s data or erasing a contact from their profile. If Pengo receives a request directly from a data subject, it will forward it to the Customer and not respond itself, except to direct the person to the Customer. Taking into account the nature of the processing, Pengo will reasonably help the Customer meet its obligations for data subject requests, security, breach notification, data protection impact assessments and consultations with supervisory authorities.

Personal data breaches

Pengo will notify the Customer without undue delay, and in any event within 72 hours, after confirming a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the data and data subjects involved, the likely consequences and the measures taken or proposed. Pengo will provide updates as more information becomes available and take reasonable steps to contain and remedy the breach. Notification is not an acknowledgement of fault.

International transfers

Customer data is stored in the hosting region selected at signup, and may be accessed or processed by Pengo and its subprocessors in other countries, including the United States. Where Customer Personal Data is transferred from the EEA, UK or Switzerland to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), which are incorporated by reference:

• Module 2 (controller to processor) or Module 3 (processor to processor) applies, as appropriate;
• Clause 7 (docking) applies; Clause 9 option 2 (general authorization) applies with the notice period in section 6;
• Clause 11 optional language does not apply; Clauses 17 and 18 select the law and courts of Ireland;
• Annex I is completed by section 2 of this DPA, Annex II by section 5, and Annex III by the list in section 6;
• for UK transfers, the UK International Data Transfer Addendum applies, and for Swiss transfers, references to the GDPR are read as references to the FADP.

Where a subprocessor is certified under the EU-US Data Privacy Framework or its UK and Swiss extensions, Pengo may rely on that certification.

Audits

On written request, no more than once a year, Pengo will provide information reasonably needed to demonstrate compliance with this DPA, such as completed security questionnaires, summaries of policies and, when available, third-party audit reports. If that is not enough to meet a requirement of Data Protection Laws or a supervisory authority, the Customer may conduct an audit at its own cost, with 30 days’ notice, during business hours, under confidentiality, and in a way that does not disrupt the Service or compromise other customers’ data.

Return and deletion

The Customer can export Customer Personal Data at any time during the Agreement. After the Agreement ends, Pengo will delete Customer Personal Data within 90 days, unless the law requires it to be kept. Data in backups is deleted as backups roll off, and remains protected by this DPA until then.

US state privacy laws

Where the CCPA or similar US state laws apply, Pengo is a “service provider” or “processor”. Pengo will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service, or combine it with personal data from other sources except as the law permits. Pengo will comply with those laws and tell the Customer if it can no longer meet its obligations.

General

This DPA lasts as long as Pengo processes Customer Personal Data. The limitations of liability in the Agreement apply to this DPA, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. If your organization needs a countersigned copy, email privacy@pengo.chat.