These terms apply where SearchGrants.eu processes personal data on behalf of a customer — the organisation whose staff, applicants or members use a bot. They are the Article 28 GDPR terms of the agreement between us, and they sit alongside the terms of service. Where the two disagree on data protection, these terms win.
For the personal data SearchGrants.eu decides about itself — account records, billing, the security of the service — we are the controller and the privacy policy applies instead.
1. Roles
The customer is the controller. SearchGrants.eu is the processor, and engages the subprocessors listed at /pages/subprocessors.
2. What is processed
Subject matter and duration. Operating the chatbot service for the customer, for as long as the agreement runs.
Nature and purpose. Storing and displaying conversations; sending the text of a conversation to the language model configured for that bot in order to produce an answer; searching the sources that bot is pointed at; counting usage; keeping the service available and secure.
Types of personal data. Account details of the customer’s users (name, email address, role). Anything a person types into a conversation, which the customer controls by choosing what its bots invite people to submit.
Categories of data subjects. The customer’s staff and administrators, and the visitors who use its bots.
3. Instructions
We process personal data only on the customer’s documented instructions, which include this agreement and the configuration the customer makes in the product. If we believe an instruction breaks data protection law, we will say so rather than carry it out silently. We will tell the customer if a law requires us to process data beyond its instructions, unless that law forbids telling them.
4. Confidentiality
Everyone we allow near personal data is bound to confidentiality and only gets the access their work requires.
5. Security
We keep measures appropriate to the risk under Article 32: encryption in transit, access limited by role and by tenant, isolation of one customer’s data from another’s, and monitoring that reports failures without collecting the contents of requests or visitor IP addresses.
6. Subprocessors
The customer gives general authorisation for the subprocessors listed at /pages/subprocessors. We will announce a change to that list on this site before the new subprocessor starts work, leaving time to object; a customer that objects on reasonable data protection grounds may end the affected part of the service. Every subprocessor is bound to obligations no weaker than these, and we stay responsible for their performance.
7. Helping with data subject rights
Conversations are exportable and deletable in the product, so the customer can answer most access and erasure requests without us. Where it cannot, we will help, taking into account the nature of the processing.
8. Breaches and assessments
We notify the customer without undue delay after becoming aware of a personal data breach affecting its data, with what we know and what we are doing about it. We will help with data protection impact assessments and prior consultations where the customer reasonably needs it.
9. Return and deletion
At the end of the agreement the customer may export its conversations. On request, or after a reasonable wind-down period, we delete the personal data we hold for it, except where a law requires us to keep something. Usage records are pruned after 90 days in the ordinary course.
10. Audits
We will make available the information needed to show these obligations are met, and allow an audit by the customer or an auditor it mandates, on reasonable notice and without disrupting the service.
11. International transfers
Application servers and the database are in the EU. Some subprocessors — the language model providers in particular — are outside the EEA; those transfers rely on an adequacy decision or Standard Contractual Clauses. The subprocessor list says where each one sits, so a customer that must keep processing in the EEA can see which bot configurations are open to it.
12. Changes
Material changes to these terms will be announced on this page before they take effect. Ask for a signed copy through the contact form.
