Data processing agreement (DPA)

This agreement applies to personal data the customer supplies to the service or processes through workflows, analytics, functions and instructions to the AI assistant, including website visitors’ data. It does not apply to processing by Plaka Studio S.L. as controller for account administration, billing, security and its own obligations, described in the Privacy policy.

The customer is the controller: it decides why and how its visitors' data is processed. Plaka Studio S.L. is the processor and only processes that data to provide the service.

The purpose is to deliver the subscribed features: creating and running workflows, A/B tests and personalisation, measuring results and assisting the customer with AI. Processing may include collection, recording, organisation, storage, retrieval, transmission to authorised providers, aggregation, return and deletion. It lasts while the service is provided and afterwards only for return, deletion or legally required retention.

Data subjects: visitors to the customer's websites and, if the customer configures it, its end users or customers.

Categories of data:

• random visitor identifier and assigned variants;
• IP address, browser, operating system, device and language;
• country and region (e.g. Spanish autonomous community or US state) the visitor connects from, worked out on our servers from their IP address;
• pages visited, referrer, UTM parameters, events and conversions;
• any additional data the customer chooses to capture in its workflows (for example, form answers), and personal data included in resources, files or AI instructions.

The customer must not send Bixlow special categories of data (health, beliefs, etc.) or data about minors.

Plaka Studio S.L. processes data on the customer’s documented instructions, including transfer instructions: the contract, authorised configuration and written instructions. It will immediately inform the customer if it considers an instruction contrary to data protection law. If legislation requires other processing, it will inform the customer beforehand unless legally prohibited. Authorised personnel are bound by confidentiality.

The customer gives Plaka Studio S.L. general authorization to use the subprocessors on the public list. Plaka Studio S.L. imposes on each of them data protection obligations equivalent to this agreement and remains liable for their compliance. We will give at least 15 days' notice of any addition or replacement; the customer may object on reasonable grounds and, if no solution is found, terminate without penalty.

International transfers will follow the customer’s documented instructions and use a valid mechanism under chapter V of the GDPR. Engaging a US provider does not itself establish a safeguard. The receiving entity, covered processing, countries and applicable mechanism must be verified before data is transferred; customers may request information and copies of safeguards at bixlow@plakastudio.com.

Plaka Studio S.L. applies technical and organizational measures appropriate to the risk (art. 32 GDPR), including:

• encryption in transit (TLS) for public access to the service;
• per-customer isolation in the database with row-level security;
• production access limited to staff who need it and role separation in the database;
• encryption of Bixlow Functions secrets;
• per-IP request limits and an anti-bot proof-of-work that the browser solves and our servers check, with no third party;
• a public runtime with no access to credentials or other customers' data.

Plaka Studio S.L. will help the customer, as far as possible, to respond to data subject requests, carry out impact assessments and prior consultations, and meet its security obligations. If a data subject contacts Plaka Studio S.L. directly, it will forward the request to the customer.

Plaka Studio S.L. will notify the customer without undue delay, and in any case within 48 hours of becoming aware, of any breach affecting its data, with the information available so the customer can meet its obligation to notify the authority within 72 hours.

Plaka Studio S.L. will provide information needed to demonstrate compliance and allow and contribute to audits and inspections by the customer or an authorised auditor. Scope, confidentiality, reasonable costs and advance notice will be coordinated without preventing effective exercise of this right. A breach, suspected non-compliance or an authority’s request may require urgent or additional review. Other customers’ data will be protected.

When the service ends, the customer may choose return or deletion of its personal data. Plaka Studio S.L. will carry out that instruction and delete remaining copies within 90 days, unless retention is legally required. Copies awaiting deletion remain protected and will not be used for other purposes. Request return before ordering irreversible deletion through the application. Confidentiality obligations survive termination.

The customer warrants that it has a legal basis for the processing, that it informs its visitors in its privacy and cookie policies, and that it obtains their consent where the law requires it (for example, for browser storage used for analytics or A/B testing) before loading bixlow.js.

Each party's liability is governed by the Terms of service, without prejudice to the GDPR. In case of conflict on data protection matters, this agreement prevails.