Data Processing Agreement

1. Parties and roles

The customer is the controller and Bhoral (Bhoral LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States) is the processor. For purposes of the California Consumer Privacy Act, Bhoral acts as a “service provider” for customer data: we process it only for the business purposes in the agreement, do not sell or share it, do not retain, use or disclose it outside the direct business relationship, and do not combine it with other data except as the law permits. Where the customer is itself a processor for its own clients, Bhoral acts as subprocessor.

2. Subject matter, duration, nature and purpose

Subject matter: providing Bhoral BI, an AI-first analytics workspace. Duration: the term of the customer's subscription plus the deletion period below. Nature and purpose: hosting, connecting to the customer's databases and files, running read-only queries, generating charts and AI answers, and support, all strictly on the customer's documented instructions.

3. Data and data subjects

Types of data: whatever the customer connects, which may include business contact data, transaction data and other personal data in its databases, plus user account data. Data subjects: the customer's employees, customers, suppliers and other individuals in its data. Sensitive or special categories of data should be processed only where agreed in writing in advance.

4. Processor obligations

• Process personal data only on documented instructions from the customer, unless required by law.
• Ensure that everyone with access is bound by confidentiality.
• Assist the customer with data subject requests, security, breach notification, impact assessments and consultations with authorities.
• Not use customer data to train AI models.
• Tell the customer if we believe an instruction infringes data protection law.

5. Technical and organisational measures

Summary: encryption in transit and at rest, credentials held in an encrypted vault, access control by roles with least privilege, read-only SQL with row and time limits, column masking, audit logging, separation of customer data per company, and security testing. See Security for the current status, including what is still in preparation.

6. Subprocessors

The customer gives general authorisation for the subprocessors on our Subprocessors page. We impose the same data protection obligations on them, remain responsible for them, give at least 30 days' notice of changes, and the customer may object on reasonable grounds. If the objection cannot be resolved, the customer may terminate the affected service.

7. Where data is processed and international transfers

Customer data is processed in the United States (Google Cloud, us-central1). For personal data transferred from the EEA, the UK or Switzerland, the parties rely on the EU Standard Contractual Clauses (Module 2 controller to processor, and Module 3 where applicable) and the UK International Data Transfer Addendum, which are incorporated into the DPA, and on the EU-US Data Privacy Framework where a recipient participates, with supplementary measures where needed. Bhoral does not claim Data Privacy Framework certification.

8. Audit rights

We make available the information needed to show compliance and allow audits by the customer or an auditor it appoints, on reasonable notice, during business hours, no more than once a year unless a breach or a regulator requires otherwise, subject to confidentiality and without unreasonable disruption. We will normally first offer our security documentation and questionnaire answers.

9. Personal data breaches

We notify the customer without undue delay after becoming aware of a personal data breach affecting its data, and in any case within 72 hours, with the information we have to help the customer meet its own obligations.

10. Deletion and return

At the end of the service the customer can export its data for 30 days. We then delete it from live systems within 30 days and from backups within 90 days, unless law requires us to keep it, and confirm deletion on request.

11. How to sign

Email privacy@bhoral.com with your company name, address and signatory, and we will send the DPA, including the SCCs and annexes, for electronic signature. Customers on the Business plan receive it as part of onboarding.