Definitions
Personal data: any information relating to an identified or identifiable natural person.
Special categories of data: data referred to in Article 9 GDPR, in particular data concerning health.
Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Instructions: documented directions from the Client to Godia.ai regarding the processing of personal data.
Sub-processor: any third party engaged by Godia.ai to carry out part of the processing.
Parties
Controller (Client): the client entity identified in the order form.
Processor (Godia.ai): 777 Industries Luxembourg S.à r.l., 161, rue du Kiem, L-8030 Strassen, Luxembourg (RCS B302454). Contact: legal@godia.ai, support@godia.ai.
Subject matter and duration
- Subject matter
Provision of the Godia.ai platform: secure client portal, conversational agents available through a widget, link or QR code, automations (rules, service emails, request forms) and, upon activation by the Client, the Godia Pilot module connected to Gmail or Microsoft 365 mailboxes (reply drafts suggested, nothing sent without human validation).
- Duration
This agreement takes effect upon signature of the main contract and ends upon its expiry or termination, subject to the return and deletion obligations below.
Data, data subjects and purposes
- Categories of data
Agent conversations (messages, language, timestamp, random technical identifiers, truncated IP address, approximate country); requests and contact details, when the Client enables their collection; files sent by visitors, when the Client allows it; accounts and login records of the Client's users; SHA-256 hashes of API keys; for the Godia Pilot module: content of emails read on demand (not stored) and encrypted access tokens.
- Special categories of data
The platform is not designed to process special categories of data, and the Client does not configure its agents to collect them. If a visitor spontaneously provides such data, it is used only for the conversation and follows the retention period set by the Client. For a Client in the healthcare or public sector, Godia.ai applies a reinforced configuration: no collection of contact details, no file uploads, automatic deletion of conversations and AI disclosure enabled.
- Data subjects
Visitors and users of the Client's agents, the Client's prospects and customers, and the Client's internal users.
- Purposes
Provision of the service to the Client, support, security and abuse prevention. Godia.ai does not process the data for its own purposes and does not use it to train AI models.
- Impact assessment
The processing operations are described in the data protection impact assessment DPIA-GODIA-2026-001, version 1.2 (October 2026), available upon request at legal@godia.ai.
Instructions, confidentiality and support access
Godia.ai processes the data only on documented instructions from the Client (Articles 28 and 29 GDPR), including with regard to transfers, and immediately informs the Client if an instruction appears to infringe data protection law. Persons authorised to process the data are bound by confidentiality. Any access by Godia.ai support to the Client's data is logged (kept 90 days); these records are provided to the Client upon written request.
Security measures
- Authentication and access control
Session tokens signed with RS256 and key rotation, hashed passwords (bcrypt, 12 rounds), TOTP two-factor authentication enabled for Godia.ai administrator accounts and enforceable by the Client for all its accounts, three roles (Owner, Admin, Member) and eight granular permissions.
- Separation between clients
Client identifier on every table, checked by the authentication middleware on each call and by an ownership check on every endpoint (HTTP 403 refusal). Any attempt to breach this separation triggers a security alert.
- Encryption
Encrypted connections (HTTPS, HSTS). OAuth tokens, integration credentials, secrets and two-factor keys encrypted with AES-256-GCM at application level. Database encrypted at rest by the hosting provider.
- Data minimisation
Visitors' IP addresses truncated before storage; random visitor identifiers, with no browser fingerprinting; no third-party geolocation service; no third-party script loaded by the widget; automatic deletion of conversations configurable per agent.
- Backups and continuity
Daily encrypted backups in the European Union, point-in-time restore. Contractual recovery time: 4 hours. Maximum data loss: 24 hours.
- Traceability
Records that cannot be modified from the interface (logins and access: 90 days; portal activity: 30 days; alerts: 90 days), exportable in JSON or CSV from the portal, with a limit on the number of exports.
Hosting and sub-processors
The Client authorises Godia.ai to use the sub-processors below. Godia.ai imposes on them by contract data protection obligations equivalent to those of this agreement and remains liable for their performance (Article 28(4)). Any addition or replacement of a sub-processor is notified to the Client 30 days in advance, with a right to raise a reasoned objection.
| Sub-processor | Role | Data location | Contract |
|---|---|---|---|
| Railway Corporation | Hosting of the application and of the knowledge search engine | Netherlands (Amsterdam) | DPA |
| Neon (Databricks) | PostgreSQL database and backups | Germany (Frankfurt) | DPA |
| Mistral AI SAS | Language models, document reading, transcription. European endpoint; training on the data disabled; zero retention of conversation content. | European Union | DPA |
| Mailjet (Sinch) | Service emails and notifications | European Union | DPA |
| Google LLC | Sign-in with a Google account; Gmail (Godia Pilot module). Only upon activation by the Client. | United States (Standard Contractual Clauses) | DPA |
| Microsoft Corporation | Sign-in with a Microsoft account; Microsoft 365 (Godia Pilot module). Only upon activation by the Client. | EU and United States (Standard Contractual Clauses) | DPA |
Optional modules (voice agent, third-party messaging channels, calendar or CRM connectors): the sub-processors specific to these modules are disclosed to the Client before any activation and are used only with its written authorisation.
Transfers outside the European Union
Compute, database and language models are hosted and called in the European Union. Transfers outside the Union are limited to:
- Google LLC, if the Client activates Google sign-in or the Godia Pilot module with Gmail;
- Microsoft Corporation, if the Client activates Microsoft sign-in or the Godia Pilot module with Microsoft 365.
These transfers are governed by the European Commission's Standard Contractual Clauses.
Assistance to the Client
Godia.ai assists the Client, through appropriate technical and organisational measures, in responding to data subject requests (conversation export, deletion of a conversation and its copies, deletion by age, anonymisation of an agent), in ensuring the security of processing, in notifying personal data breaches and in carrying out its impact assessments and prior consultations (Articles 32 to 36 GDPR), in particular by providing the platform's impact assessment and a compliance file adapted to its activity. Contact: legal@godia.ai.
Personal data breaches
Godia.ai notifies the Client without undue delay after becoming aware of a personal data breach, and within 4 hours for a critical incident, with the information available: nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed. The Client, as controller, is responsible for notifying the competent supervisory authority within 72 hours where Article 33 GDPR requires it; Godia.ai provides the necessary information. Each incident is documented (timeline, impact, corrective measures) in the portal's post-incident report module.
Audits
Godia.ai makes available to the Client all information necessary to demonstrate compliance with this agreement and allows for and contributes to audits, including inspections, conducted by the Client or an auditor mandated by it and bound by confidentiality (Article 28(3)(h)). It first provides documentary evidence: security policy, impact assessment, register of providers, answers to security questionnaires. An on-site inspection is organised with reasonable notice, on a defined scope and without access to other clients' data; its costs are borne by the requesting party, unless a breach is found.
Retention
| Category | Retention period |
|---|---|
| Conversations and their technical copies | Period set by the Client for each agent, with daily automatic deletion; failing that, duration of the contract |
| Login and access records | 90 days |
| Portal activity records | 30 days |
| Security alert history | 90 days |
| Encrypted backups | Rolling window of the database provider |
Return and deletion at the end of the contract
At the end of the contract, at the Client's choice: complete data export provided upon written request within 30 days (JSON or CSV, standard PostgreSQL format), then permanent deletion of all the Client's data within 60 days after the end of the contract, unless a legal retention obligation applies. A certificate of deletion is provided within 15 days of the actual deletion, upon written request.
Governing law and jurisdiction
This agreement is governed by Luxembourg law. Any dispute relating to its formation, interpretation or performance falls within the exclusive jurisdiction of the courts of Luxembourg City, in accordance with the Terms of Service. Godia.ai's lead supervisory authority is the Luxembourg Commission nationale pour la protection des données (CNPD).
Contact and signed version
Data protection: legal@godia.ai. Support: support@godia.ai. To obtain a signed PDF version of this agreement, please email us.