Data processing agreement

In short

• You decide why and how your customers’ personal information is used. We use it only to run Bona for you.
• The live page goes from your customer’s browser to your agent’s, end-to-end encrypted, and our servers never see it. Masked fields never leave your customer’s device.
• What we do store is kept for short, fixed periods (schedule 1), protected, and deleted automatically.
• We use a short list of providers (schedule 2) and tell you before we add one.
• If something goes wrong, we tell you quickly.

This summary is here to help you read the agreement. The numbered clauses are what apply.

1. How this agreement applies

This agreement is between Bona and the business that uses Bona (“you”). It forms part of our terms of service, and it applies whenever you use Bona to process personal information about your customers or your team. You don’t need to sign anything for it to apply.

POPIA (section 21) requires a written contract between a responsible party and its operator. This agreement is that contract. It also sets out the processor terms that UK GDPR and the EU GDPR (Article 28), Thailand’s PDPA (section 40) and Kenya’s Data Protection Act require, and the terms for entrusting personal information to us under Japan’s APPI.

Compliance add-on customers can get a copy signed by us, with their company’s details filled in. A signed copy has the same terms.

If this agreement and the terms disagree about personal information, this agreement wins.

2. Words we use

• Personal information means information about an identifiable person, as each data protection law defines it. UK GDPR, the EU GDPR, the PDPA and Kenya’s Act call it personal data.
• Data protection law means the laws that apply to the processing: POPIA, UK GDPR and the UK’s Data Protection Act 2018, the EU GDPR, Thailand’s Personal Data Protection Act B.E. 2562 (2019), Japan’s Act on the Protection of Personal Information, and Kenya’s Data Protection Act, 2019.
• Your customers means the people who use your website and chat with you, share their screen or leave their details through Bona.
• Your team means the people you give a Bona login, such as owners, admins and agents.
• Sub-processor means a provider we use that processes personal information for you as part of running Bona.
• Breach means a security compromise under POPIA (reasonable grounds to believe that personal information has been accessed or acquired by someone unauthorised) or a personal data breach under the other data protection laws (a breach of security that leads to personal information being accidentally or unlawfully destroyed, lost, changed, disclosed or accessed).

3. Who is responsible for what

You decide why and how your customers’ personal information is processed through Bona, and we process it on your behalf.

• POPIA: you are the responsible party, and we are your operator.
• UK GDPR, the EU GDPR, Thailand’s PDPA and Kenya’s Data Protection Act: you are the controller, and we are your processor.
• Japan’s APPI: you are the business handling the information, and you entrust us with handling it for you.

The same applies to your team’s details where we process them for you, for example to show who viewed a session. We are a responsible party (controller) in our own right for the information we need to run our own business, such as your account and billing details, and for keeping Bona secure, as our privacy policy explains. This agreement doesn’t cover that information.

4. Processing only on your instructions

• We process personal information only to provide Bona to you, as described in schedule 1, and only on your documented instructions. Your instructions are our terms, this agreement, and the choices you make in Bona, such as your dashboard settings, the fields you mark private and the services you connect.
• We don’t sell it or use it for advertising.
• We don’t use the personal information we process for you to train AI models, ours or anyone else’s. Cloudflare, which runs our built-in AI assistant (Workers AI), says it doesn’t use what Workers AI processes to train AI models either. If you choose your own AI provider, its terms cover what it does.
• We may use counts that identify nobody, such as how many sessions a site had, to run, bill for and improve Bona.
• If we think an instruction breaks data protection law, we’ll tell you, and we may hold off following it until it’s resolved.
• If a law requires us to process it in some other way, for example a court order, we’ll tell you first, unless that law forbids us to.

5. Our people

Only people who need access to run, support or secure Bona can reach personal information we process for you, and only as much as they need. Everyone who can access it is bound to keep it confidential, as POPIA (section 20) and Article 28 of UK GDPR and the EU GDPR require.

6. Security

We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access or processing, as POPIA (section 19) and Article 32 of UK GDPR and the EU GDPR require. Today they include:

• Masking on the device. Passwords, card numbers, one-time codes and any field you mark private are masked on your customer’s device before anything is sent, so they never reach your agents or our servers.
• No page on our servers. The page travels over an end-to-end encrypted, peer-to-peer connection, browser to browser. If a firewall blocks a direct link, it goes through an encrypted relay that can’t read it either. Our servers only connect the two sides.
• Consent in the product. Nothing on the page is captured until your customer clicks Allow. Remote control needs a second Allow, never types into protected fields, and stops when the customer says so.
• Encryption. Everything between browsers and our servers is encrypted in transit. Secrets you give us, such as your own AI provider’s API key or your Intercom connection, are encrypted at rest (AES-256-GCM) and never sent back to a browser.
• Less to store. Saved chat transcripts have card numbers removed before they’re stored, page addresses are kept without their query strings, and we don’t store your customers’ IP addresses.
• Access control. Your team has roles (owner, admin and agent), and an audit log records who viewed which session and when. Our own administrator accounts need a password and an authenticator code.
• Abuse protection. Sign-up is protected against bots, and sign-in, sessions and other public entry points are rate limited.
• Automatic deletion. What we store is deleted on the schedule in schedule 1, by a job that runs every day.

We review these measures as Bona changes. We may change them, but we won’t lower the overall level of protection.

7. Sub-processors

• You give us general permission to use the sub-processors listed in schedule 2.
• Our sub-processors are bound by written terms. Cloudflare’s terms with us include its data processing addendum, which applies to personal information of people in Europe, including the UK, and to personal information under California’s privacy law. For everything it hosts for us, wherever the people are, its terms require it to keep security procedures in place to protect it.
• We stay responsible to you for what our sub-processors do with your information.
• Before we add or replace a sub-processor, we’ll update schedule 2 and email your account’s owners at least 30 days before it starts processing your information.
• If you object on reasonable data protection grounds, tell us within those 30 days. We’ll try to find a solution. If we can’t, you may end the affected service, and we’ll refund any fees you paid in advance for the period after it ends, even where our refund policy says otherwise.

Some services only receive information because you connect them or choose them, such as Intercom, or an AI provider you use with your own API key. Those providers work for you, under your own agreement with them, and aren’t our sub-processors. Schedule 2 lists them too, with the services that help browsers connect, which see connection details only.

8. Helping you meet your obligations

• Your customers’ requests. You can find and delete much of what we store yourself: for example, you can delete a saved transcript or a whole site from the dashboard. If you need help to answer a request to see, correct or delete someone’s information, ask us and we’ll help.
• Requests that come to us. If one of your customers asks us directly, we’ll pass the request to you, and won’t answer it ourselves unless you ask us to or the law requires it.
• Assessments. We’ll give you the information about Bona you reasonably need for a data protection impact assessment, or to consult a regulator about one.
• Records. We keep a record of the processing we do for you, as data protection law requires of processors.

9. Breaches

• POPIA (section 21(2)) requires an operator to tell the responsible party immediately when there are reasonable grounds to believe that personal information has been accessed or acquired by someone unauthorised. So if we become aware of a breach affecting personal information we process for you, we’ll tell you without undue delay, and no later than 48 hours after we become aware of it, by email to your account’s owners.
• We’ll tell you what we know: what happened, what information and roughly how many people are affected, the likely consequences, what we’ve done about it, and who you can talk to at Bona. If we don’t know everything yet, we’ll tell you what we can and follow up as we learn more.
• We’ll take reasonable steps to contain the breach and limit the harm, and help you look into it.
• You decide whether to notify the regulator and the people affected, as POPIA (section 22) and the other data protection laws require. We won’t notify them about your customers’ information without your agreement, unless the law requires us to.
• Telling you about a breach doesn’t mean we accept that we were at fault.

10. Information and audits

• We’ll make available the information you reasonably need to show that we meet this agreement. We answer first through written information, answers to a reasonable security questionnaire, and the audit log you can see in the dashboard.
• An on-site or deeper audit is needed only if that isn’t enough, or after a breach. Then you, or an independent auditor you appoint who is bound to keep it confidential, may audit how we meet this agreement, once a year. Give us at least 30 days’ written notice. The audit is at your own cost, and must not disrupt the service or expose other customers’ information.
• A regulator’s audit isn’t limited to once a year.
• Under Japan’s APPI, a business that entrusts personal information must supervise the business it entrusts. This clause is how you can supervise us.

11. Sending information to other countries

• Bona is run from South Africa, and our sub-processors process information in other countries, as schedule 2 shows.
• POPIA: section 72 limits sending personal information outside South Africa. We send it only to the providers in schedule 2, on the terms described in clause 7, and protect it with the measures in clause 6.
• UK and EU: the UK and the EU haven’t assessed South Africa as giving adequate protection. If you send us personal information about people in the UK or the EU, we’ll sign the EU standard contractual clauses with you on request: Module 2 (controller to processor), or Module 3 where you are yourself a processor, with the UK International Data Transfer Addendum for the UK. For Cloudflare’s own transfers, its data processing addendum includes the EU standard contractual clauses and the UK addendum.
• Thailand, Japan and Kenya: we rely on the terms described in clause 7 and on the measures in clause 6. Our privacy policy describes the transfers for each country.

12. Deleting or returning information

• While you use Bona, most of what we store is deleted automatically on the schedule in schedule 1. When you delete a site, we delete its saved chat transcripts, “leave your details” messages and ratings of its AI replies straight away, and wipe its site knowledge.
• Within 30 days of the end of your contract, or of your written request, we’ll delete the personal information we hold for you. If you ask before then, we’ll send you a copy of your saved chat transcripts and “leave your details” messages before we delete them.
• Records with their own retention period, such as the audit log, are deleted when that period ends. We keep only what the law requires us to keep, and protect it while we do.

13. Your responsibilities

• Have a lawful basis for processing your customers’ information through Bona, and tell them about it in your privacy notice. Our acceptable use policy has sample wording.
• Set Bona up to collect only what you need: mark private any fields that hold sensitive information, list pages that should never be shared, and pass visitor details to Bona only when your agents need them.
• Follow our acceptable use policy, and make sure your team does too.
• Give us only lawful instructions, and make sure you may send us the information, including to South Africa and to the providers in schedule 2.
• Keep your team’s logins safe, and remove people who no longer need access.
• Answer your customers’ requests about their information, and notify regulators and the people affected when the law requires it.
• If you use Bona as a processor for another business, make sure that business has agreed to this agreement and to our sub-processors.

14. What we both do

Each of us will follow the data protection law that applies to us, and we’ll work together in good faith if a regulator, or one of your customers, asks about the processing.

15. Liability

The liability section of our terms applies to this agreement. Nothing in this agreement limits liability that the law doesn’t allow to be limited.

16. How long it lasts, and changes

This agreement lasts for as long as we process personal information for you, including after your subscription ends, until that information is deleted.

We may update this agreement, for example when the law changes or when we add a sub-processor. We’ll post the new version on this page, update the date at the top, and tell account holders about important changes before they take effect. A signed copy changes only when both of us agree in writing.

17. Law and disputes

This agreement is governed by the laws of the Republic of South Africa, like our terms. If we disagree about it, we’ll first try to settle it by talking. Where a data protection law, or the standard contractual clauses, require another country’s law or courts for a particular matter, that requirement applies to that matter. Nothing in this agreement stops anyone from complaining to a regulator.

18. Contact

For questions about this agreement, or to report a breach, email our information officer at [email protected]. Start your message with “Information officer” so it reaches the right person. For a signed copy with the Compliance add-on, talk to us.