Data Processing Agreement

Controller

You, the Serlion customer, identified by the account you subscribed with.

Processor

Farooq Quraishi, trading as Serlion (Einzelunternehmen)

Processor address

c/o Impressumservice Dein-Impressum Stettiner Str. 41 35410 Hungen Germany

Processor contact

[email protected]

You determine the purposes and means of processing the personal data of your website's visitors. We process it only for you. Where this agreement and the Terms of Service disagree about the processing of that data, this agreement wins.

Subject matter

The subject matter is the processing needed to deliver the Serlion chat assistant and, where you use it, Lanus, as described in the Terms of Service.

Duration

This agreement starts when you create an account and runs for as long as we process personal data on your behalf. Its obligations continue after your subscription ends until the data is deleted or returned under section 11.

We process personal data only on your documented instructions, including as to transfers, unless required otherwise by EU or Member State law. Where such a legal requirement applies we will inform you before processing, unless the law forbids that notice.

Your documented instructions are, taken together:

• this agreement and the Terms of Service;
• the settings you choose in your dashboard, including the assistant’s configuration, the knowledge base you upload, your retention plan, your AI provider on Bring Your Own Key plans, and any chat channel, team alert, webhook or Cal.com integration you enable;
• any further written instruction you send to [email protected].

Default step

One processing step happens by default rather than by a setting you choose, so it is recorded here as part of the service: ten minutes after a conversation goes quiet, its transcript is copied to Lanus, which runs on our infrastructure under the same controller and the same retention windows. You may ask us to exclude your account at any time by writing to [email protected], and we will do so.

Unlawful instructions

We will tell you if, in our opinion, an instruction infringes the GDPR or other data protection law.

Never

We do not use your visitors' personal data for our own purposes, do not sell it, and do not use it to train AI models.

Serlion is operated by a sole proprietor, and access to production systems holding customer data is limited to that one person, who is bound to confidentiality. If anyone else is ever given access, they will be placed under a written confidentiality undertaking before access is granted, and Annex A will be updated to say so.

We implement appropriate technical and organisational measures under Art. 32 GDPR, taking account of the state of the art, implementation cost, and the nature, scope, context and purposes of processing. The measures in force are set out in Annex A.

We may change individual measures as technology moves, provided the level of protection is not reduced. Material changes are announced the same way as changes to the subprocessor list.

You give general written authorisation under Art. 28(2) GDPR for the subprocessors listed in Annex B.

• We will give you at least 30 days’ notice by email before adding or replacing a subprocessor.
• You may object on reasonable data protection grounds within those 30 days by writing to [email protected].
• If we cannot offer a reasonable alternative, you may terminate the affected part of the service without penalty, with a pro rata refund of any fees paid for the unused remainder of the period.
• Each subprocessor is bound by data protection obligations no less protective than those in this agreement, and we remain fully liable to you for its performance.

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures in meeting your own obligations.

If a data subject contacts us directly about data we hold for you, we will not respond to the substance. We will forward the request to you without undue delay and tell the person that you are the controller.

Your right

We make available the information necessary to demonstrate compliance with Art. 28 and allow for audits, including inspections, conducted by you or an auditor you mandate.

Evidence first

In practice, and as Art. 28(3)(h) permits, this is satisfied in the first instance by written evidence: this agreement, Annex A, our subprocessor list, and written answers to a security questionnaire.

Audits beyond that

• are limited to once per calendar year unless a breach or a supervisory authority requires otherwise;
• must be requested at least 30 days in advance;
• must not unreasonably disrupt operations;
• are subject to confidentiality.

Costs

We may charge reasonable costs for an on-site audit.

Deadline

We notify you without undue delay, and in any event within 48 hours of becoming aware, of any personal data breach affecting data processed for you.

What it contains

The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

In phases

Where full information is not available at once we provide it in phases without further undue delay.

Your reporting

Reporting the breach to your supervisory authority under Art. 33, and to data subjects under Art. 34, is yours to do as controller.

Automatic

Conversation data is deleted automatically by a scheduled sweep after 90 days on Starter, Pro and Custom, 365 days on Scale and 15 days on Free, without you needing to ask.

On termination

On termination you may export your data from the dashboard. At your choice we delete or return all personal data processed for you within 30 days of the end of the service, and delete existing copies, unless EU or Member State law requires storage.

Backups

Backups are overwritten on their normal rotation cycle.

At rest

Personal data is stored at rest in Germany.

Transfers

Transfers occur when a request is sent to a subprocessor outside the EU, listed in Annex B, and rest on EU Standard Contractual Clauses under Art. 46(2)(c) GDPR or on the EU–US Data Privacy Framework where the subprocessor is certified.

Services you connect

Chat channels, team alert destinations and other services you connect with your own account (the last group in Annex B) receive data on your instruction, under your own agreement with that provider. Putting a valid transfer mechanism in place for them is your responsibility as controller, as for your choice of AI provider below.

Bring Your Own Key

Selecting your AI provider is your instruction under section 04. If you select a provider in a country without an adequacy decision, currently DeepSeek (China), the transfer takes place on your instruction and putting a valid Art. 46 mechanism in place for it is your responsibility as controller. We will tell you which provider your account is routed to whenever you ask.

Concluded

This agreement is concluded when you accept the Terms of Service and requires no separate signature.

Signed copy

If your organisation needs a signed counterpart for its own records, write to [email protected] and we will provide one.

Changes

Changes are notified by email at least 30 days in advance. Changes required by a change in law or by a supervisory authority may take effect sooner where necessary.

Technical and organisational measures under Art. 32 GDPR, current as of 28 September 2026.

Authorised under section 07. This list is the same one published in the Privacy Policy and is kept current.

Objections to any subprocessor go to [email protected], under the procedure in section 07.