Effective date: 9 July 2026 · Version: 1.0
This Data Processing Agreement (“DPA”) forms part of the agreement for the use of the AhaFeed platform (the “Agreement”) between:
LUFTANALYTICS S.R.L., registered in Romania, Trade Registry no. J8/3253/2023, VAT RO49102453, registered office: Str. Tohanița nr. 83B, Zărnești, Brașov County, 505800, Romania, tel. +40 746 232 129 (the “Processor” or “AhaFeed”),
and the customer identified in the applicable Order Form or account registration (the “Controller” or “Customer”).
It reflects the parties’ agreement on the processing of personal data under Article 28 of Regulation (EU) 2016/679 (“GDPR”).
Terms such as “personal data”, “processing”, “data subject”, “controller”, “processor”, “supervisory authority” and “personal data breach” have the meanings given in the GDPR. “Customer Personal Data” means personal data contained in Customer Content processed by AhaFeed on behalf of the Customer in providing the Service.
| Subject matter | Provision of the AhaFeed platform: management of Google Business Profile locations, monitoring and responding to customer reviews, analytics and AI-assisted response generation |
| Duration | The term of the Agreement, plus the deletion period in Section 10 |
| Nature of processing | Collection (via Google APIs at Customer’s instruction), storage, organization, analysis, display, generation of draft responses, publication (at Customer’s instruction), deletion |
| Purpose | Delivering the Service to the Customer as described in the Agreement |
4.1. AhaFeed processes Customer Personal Data only on the Customer’s documented instructions — including the Agreement, feature configuration in the platform (e.g., enabling automated responses), and this DPA — unless required otherwise by EU or Member State law (in which case AhaFeed will inform the Customer before processing, unless prohibited). 4.2. AhaFeed will inform the Customer if, in its opinion, an instruction infringes the GDPR.
AhaFeed ensures that persons authorized to process Customer Personal Data are bound by confidentiality obligations (contractual or statutory).
AhaFeed implements and maintains appropriate technical and organizational measures, including at minimum those in Annex 1. AhaFeed may update these measures, provided the level of protection is not materially reduced.
7.1. The Customer grants a general authorization for the engagement of the sub-processors listed in Annex 2. 7.2. AhaFeed will notify the Customer (email or in-platform notice) at least 15 days before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds within that period; if no resolution is found, the Customer may terminate the affected part of the Service with pro-rata refund of prepaid fees. 7.3. AhaFeed imposes on sub-processors data-protection obligations essentially equivalent to this DPA and remains liable for their performance.
Taking into account the nature of processing, AhaFeed will assist the Customer, insofar as reasonably possible:
AhaFeed will notify the Customer without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data, providing the information reasonably required for the Customer’s obligations under Articles 33–34 GDPR, and will cooperate in the investigation and remediation.
Upon termination of the Agreement, AhaFeed will, at the Customer’s choice, delete or return all Customer Personal Data, and delete existing copies within 90 days (backup media purge on a rolling schedule of up to 30 additional days), unless EU or Member State law requires longer storage. Export functionality is available for 30 days after termination.
AhaFeed will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR (including relevant certifications — e.g., ISO/IEC 42001 for AI management — and summaries of security measures) and will allow and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to: reasonable prior notice (min. 30 days), maximum once per 12 months (except after a breach or at a supervisory authority’s request), business hours, confidentiality undertakings, and the Customer bearing its own costs.
AhaFeed processes Customer Personal Data primarily within the EU/EEA. Where a sub-processor processes personal data in a third country, AhaFeed ensures a valid transfer mechanism (adequacy decision or Standard Contractual Clauses, with supplementary measures where appropriate), as reflected in Annex 2.
Liability under this DPA is subject to the limitations of the Agreement, except where the GDPR provides otherwise. In case of conflict: this DPA prevails over the Agreement for data-protection matters.
This DPA is governed by Romanian law, without prejudice to mandatory provisions of the GDPR.
| Sub-processor | Purpose | Location / transfer mechanism |
|---|---|---|
| EU-based cloud infrastructure & database hosting (current provider details available on request) | Hosting, storage | EU/EEA |
| Anthropic, PBC | AI inference (draft responses, narratives) | USA — SCCs / EU-U.S. DPF; no training on submitted data |
| Google LLC | Google Business Profile API (data source and publication at Customer instruction) | USA — SCCs / EU-U.S. DPF |
| Functional Software, Inc. (Sentry) | Error monitoring | USA — SCCs / EU-U.S. DPF |
| Stripe, Inc. | Payment processing (billing data only) | USA — SCCs / EU-U.S. DPF |
| [Email delivery provider] | Transactional email | [confirm] |
Current list available on request: razvan@luftanalytics.ro
Signed for and on behalf of:
LUFTANALYTICS S.R.L. — Name: ______________ · Role: ______________ · Date: ______________ · Signature: ______________
Customer — Company: ______________ · Name: ______________ · Role: ______________ · Date: ______________ · Signature: ______________