1Parties, definitions and agreement structure
This Data Processing Agreement ('DPA') forms part of the binding agreement, order form or other written arrangement ('Customer Agreement') between ChatBucket Private Limited ('ChatBucket' or 'Processor') and the business customer ('Customer'). It applies only to personal data ChatBucket processes on Customer's documented instructions when delivering the covered business services ('Customer Personal Data').
For the purposes of this DPA, 'Applicable Data Protection Law' means the privacy and personal-data laws applicable to the relevant processing, including applicable provisions of India's Digital Personal Data Protection Act, 2023 and its rules as those provisions enter into force. 'Sub-processor' means a third party engaged by ChatBucket to process Customer Personal Data. The parties' statutory roles will depend on the facts and applicable law; where appropriate, Customer acts as Data Fiduciary or controller and ChatBucket as Data Processor or processor.
If the Customer Agreement and this DPA conflict about Customer Personal Data, this DPA prevails on data-processing matters unless a separately executed agreement expressly states otherwise. A customer-specific, signed DPA and its schedules may supplement or replace this public standard text.
2Scope, subject matter and documented instructions
ChatBucket will process Customer Personal Data only to deliver, secure, maintain, support and improve the contracted services as permitted by the Customer Agreement and Customer's lawful documented instructions, or as otherwise required by applicable law. Where legally permitted, ChatBucket will notify Customer before processing required by law that is outside its instructions.
Services may include AI chat agents, voice agents, voice calls, speech-to-text, text-to-speech, translation, contact-management integrations, knowledge-base retrieval, call summaries, analytics and human-agent handoff, but only to the extent actually purchased and enabled. Customer must not provide data beyond the agreed scope and should avoid unnecessary sensitive information.
The processing description, purpose, duration, categories of individuals, personal-data categories, authorised processing locations and special restrictions must be recorded in Schedule A of the signed customer order/DPA before production handling of sensitive or regulated datasets.
3Customer responsibilities and lawful collection
Customer determines the lawful basis and purposes of its processing, provides required notices, obtains any applicable permissions and consents, maintains lawful contact lists, and configures lawful recording, outreach and retention instructions. Customer is responsible for instructions, prompts, documents and integrations it supplies and for responding to individuals' rights requests unless the law places a direct duty on ChatBucket.
Customer must ensure its use of AI and telephony complies with applicable consent, telecom, marketing, DND, call-recording and sector-specific rules and must notify ChatBucket of any additional contractual or legal safeguards necessary for Customer's use case.
4Personnel, confidentiality and access control
ChatBucket will restrict access to Customer Personal Data to personnel and authorised service providers with a legitimate need and appropriate confidentiality obligations. Access will be managed using suitable authentication and role-based permissions, with administrative access reviewed according to risk.
The service-specific technical and organisational measures, including encryption, network protection, logging, secrets management, vulnerability handling, access reviews and backup controls, must be described in Schedule B. This public DPA is not a representation that ChatBucket holds any particular security certification.
5Sub-processors and hosting
Customer authorises only the Sub-processors identified or otherwise approved under the Customer Agreement. The current supplier list, service role, processing location and any international-transfer details must appear in Schedule C and be kept up to date. ChatBucket will require relevant Sub-processors to protect Customer Personal Data under obligations appropriate to the services they provide.
Where a contracted notification mechanism is specified, ChatBucket will provide notice of material new Sub-processors and a reasonable opportunity to object on documented data-protection grounds. If an objection cannot reasonably be resolved, the parties will follow the termination or service-change process in the Customer Agreement.
ChatBucket will not promise India-only hosting, a particular cloud provider or a specific cross-border transfer arrangement unless those details are confirmed in the signed schedules. Any overseas transfer will be subject to applicable law, customer instructions and agreed safeguards.
6Security incidents and notification
ChatBucket will maintain documented procedures to investigate, contain and respond to security incidents involving Customer Personal Data. When ChatBucket becomes aware of a confirmed personal-data breach affecting Customer Personal Data, it will notify Customer without undue delay through the agreed security contact, provide information reasonably available, and cooperate with investigation and mitigation.
The parties will set any specific contractual notice window, escalation channel, incident severity criteria and update cadence in Schedule B or the Customer Agreement. Nothing here modifies the separate statutory reporting responsibilities of either party, including any applicable CERT-In reporting duty.
7Individual rights, assessments and regulator requests
Taking account of the nature of the service and information reasonably available, ChatBucket will provide reasonable assistance so Customer can respond to valid data-subject requests, complaints, impact assessments, security enquiries and legally required communications. Customer remains responsible for determining and carrying out its legal obligations as controller/data fiduciary.
Unless legally prohibited, ChatBucket will direct requests received from individuals about Customer Personal Data to Customer. ChatBucket will communicate legally binding disclosure requests affecting Customer Personal Data to Customer where permitted, and will seek to limit disclosure to the scope required by law.
8Retention, return, export and deletion
Customer's service plan, order form and documented retention configuration govern ordinary retention of recordings, transcripts, messages, call metadata, uploaded knowledge bases, exports and related service data. Where no retention period is agreed, the parties must establish one before production processing; this DPA does not create a universal default period.
At termination or expiry, ChatBucket will, at Customer's documented choice and subject to agreed export functionality and applicable law, provide a reasonable mechanism to return or delete Customer Personal Data. Backup deletion schedules, secure deletion standards, export formats, residual legally required retention and any fees will be defined in Schedule B or the Customer Agreement. Confidentiality and security continue to apply to retained residual copies.
9AI processing and model improvement
Customer Personal Data will not be used to train general-purpose or shared AI models unless the Customer Agreement or a separate affirmative authorisation expressly permits that use. Processing needed to provide the contracted service, service security and fault investigation is governed by the agreed instructions and privacy terms.
If third-party model providers are used for a customer's deployment, their identities, processing purposes, retention options and relevant controls must be disclosed in Schedule C or approved service documentation. ChatBucket must not promise zero retention or local inference for all deployments unless technically and contractually verified.
10Audit, assistance and liability
On reasonable prior request and subject to confidentiality and security, ChatBucket will make available appropriate information to demonstrate compliance with this DPA, such as relevant summaries of controls, questionnaires or independent assurance reports if they exist. The scope, timing, frequency, cost and conditions of any onsite audit will be agreed in writing.
Liability caps, indemnities, service credits, governing law, dispute resolution and order of precedence remain governed by the Customer Agreement, except to the extent applicable law requires otherwise. This DPA does not expand a party's liability beyond those agreed terms unless expressly stated in a signed agreement.
11Schedule A — Processing description
To complete per customer: (1) contracted services and processing purpose; (2) processing duration; (3) categories of individuals; (4) personal-data categories, including whether voice recordings, transcripts, contact lists, identifiers, account records, knowledge documents or sensitive information are permitted; (5) authorised locations and transfers; (6) customer instructions and relevant restrictions.
12Schedule B — Security, incident and retention schedule
To complete per customer: verified technical and organisational controls; encryption and key-management approach; access and administrative controls; backup and recovery; incident notification contacts and deadlines; retention period for each data type; export and deletion procedure; audit and assurance arrangements; customer-specific regulatory requirements.
13Schedule C — Sub-processors and transfers
To complete per customer: provider name, service, data types, processing location, contractual protection and transfer mechanism where applicable. Publish or share an accurate current list rather than inserting unverified cloud, telecom or AI providers.
14Execution and related policies
The executed Customer Agreement must identify each legal party, authorised signatory, date, service order and agreed schedules. Publication of this page alone does not prove acceptance or create a signed customer-specific processing schedule.
For questions about this DPA, email support@chatbucket.business. See the Privacy Policy, Terms and Conditions, Cookie Policy and Acceptable Use Policy for related information.
15Questions and related policies
Contact support@chatbucket.business for questions about this policy.