Parties
This Data Processing Agreement ("DPA") is between the workspace owner who uses AgentsCreator ("Controller") and NTechnologies.AE ("Processor"), operator of AgentsCreator. It forms part of the Terms and the Privacy Policy and applies when the Processor processes personal data on the Controller's behalf.
Roles and instructions
The Controller decides the purposes of visitor enquiries, leads, appointment holds, and any notices shown on the Controller's own website. The Processor hosts the studio, crawls the public URL the Controller submits, runs the published desk, stores inbox records, and sends alerts the Controller enables.
The Processor will process personal data only on documented instructions from the Controller - including those given through the product (publish, retention setting, calendar connect, plan choice) - unless UK or other applicable law requires otherwise, in which case the Processor will tell the Controller if legally allowed.
Subject matter, duration, and nature
Subject matter: provision of AgentsCreator, including website crawl, distilled knowledge, public chat desk, leads inbox, Night Desk email, and Google Calendar holds.
Duration: for as long as the Controller has an active workspace, plus a limited period afterwards for backups, invoices, and legal obligations.
Nature: hosting, storage, transmission, generation of replies by model providers, and deletion according to the retention setting.
Types of personal data and data subjects
Data subjects are the Controller's staff (account holders) and visitors who use a published desk.
- Account data: name, email, hashed password, session data, workspace role.
- Visitor enquiry data: name, phone, email, message, requested time, chat content needed to operate the desk.
- Technical data: IP address, browser type, timestamps, and error logs.
- Calendar tokens if the Controller connects Google Calendar.
Processor obligations
The Processor shall:
- Process personal data only as described in this DPA and the product settings.
- Ensure people who handle the data are under a duty of confidence.
- Take appropriate technical and organisational measures, including hashed passwords, session controls, workspace roles, and TLS in transit.
- Respect the Controller's lead retention setting (30, 60, or 90 days) and delete those lead records when the window ends.
- Help the Controller respond to data-subject requests that cannot be completed in the studio, taking into account the nature of the processing.
- Notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data.
- Delete or return personal data when the Controller deletes a workspace or this DPA ends, except where the Processor must keep a copy by law.
Sub-processors
The Controller authorises the Processor to use the following categories of sub-processors as needed to run the service. The Processor will impose data-protection terms no less protective than this DPA.
- Hosting and content delivery for the production site (including Cloudflare at the edge).
- Lemon Squeezy - checkout, invoices, and subscription status for paid plans.
- Google - Calendar OAuth if the Controller connects a calendar.
- Transactional email (for example Resend) when Night Desk or account mail is configured.
- AI model providers configured for the workspace (for example Groq, Google Gemini, OpenAI, or others the Controller enables) to generate replies and extraction.
International transfers
NTechnologies.AE is established in the United Arab Emirates. AgentsCreator is offered to UK and other customers. We do not claim that all personal data stays in the United Kingdom.
Where the Processor or a sub-processor processes UK personal data outside the UK, the Processor relies on a UK adequacy regulation or the UK International Data Transfer Agreement / Standard Contractual Clauses (and any required addendum), plus appropriate safeguards.
UK GDPR and assistance
When the Controller is subject to the UK GDPR, this DPA is intended to meet Article 28. The Processor will make available information reasonably needed to demonstrate compliance and will allow audits at reasonable intervals, on reasonable notice, and in a way that does not compromise other customers' security.
Nothing in this DPA reduces rights that cannot be limited under UK data-protection law.
Liability and order of documents
Liability between the parties for this DPA follows the limitation of liability in the AgentsCreator Terms, except where applicable data-protection law requires a different result. If this DPA conflicts with the Terms on data-protection obligations, this DPA prevails.
Contact
Questions about this DPA: NTechnologies.AE at https://ntechnologies.ae. The Privacy Policy lists how to request access, correction, or deletion.
Where your data is processed
Operator: NTechnologies.AE.
Registered address: not yet published.
UK correspondence address: not yet published.
Hosting region: not yet published. Database region: not yet published.
Conversation text may be sent to model providers: not yet published.
Conversation and lead records are deleted after the workspace retention window (default 90 days).
Data protection contact: not yet published.