Skip to content
Все документы / All documents

Article 28 GDPR

Data Processing Agreement

Last updated: 2 November 2026 · Version 1.0

AffiliateManagersAI Ltd is being incorporated in Cyprus. Until incorporation and opening of its bank account AMAI does not take any payments.

This document is written in English. The English version is the binding version.

Кратко на русском

This Data Processing Agreement (the "DPA") is made between AffiliateManagersAI Ltd, a private company being incorporated in the Republic of Cyprus, trading as AMAI, Limassol, Cyprus ("AMAI"), whose registration number and registered office will be added to this page on incorporation, and the business customer that accepts the AMAI Terms of Service or signs an Order Form that refers to them (the "Customer"), each a "Party".

It forms part of the AMAI Terms of Service and the Order Form between the Parties (together, the "Agreement") and is accepted electronically together with the Agreement. On request, AMAI will countersign a copy of this DPA once AffiliateManagersAI Ltd is incorporated.

1. Definitions and interpretation

1.1 In this DPA:

1.2 Capitalised terms not defined in this DPA have the meanings given in the Agreement.

1.3 Precedence: on matters relating to the Processing of Customer Personal Data, this DPA prevails over the Agreement. The SCCs, where they apply, prevail over this DPA.

2. Scope and roles

2.1 For Customer Personal Data, the Customer is the Controller (or a Processor acting for its own controller, in which case the Customer warrants that its controller has authorised this DPA) and AMAI is the Processor.

2.2 AMAI acts as an independent Controller, and this DPA does not apply, for the following:

That Processing is described in the AMAI Privacy Policy and the Partner Hub Privacy Policy.

2.3 Partner Catalog interface. When the Customer finds a Partner in the AMAI Partner Catalog and admits that Partner into its workspace, AMAI discloses the relevant catalog record to the Customer as Controller to Controller. From that point, the copy of the record in the Customer's workspace, and all further data the Customer adds about that Partner, are Customer Personal Data. The Customer is responsible for its own legal basis for contacting the Partner. AMAI does not use one customer's admissions, notes or CRM history to benefit another customer.

3. Customer obligations and instructions

3.1 The Customer determines the purposes and means of the Processing of Customer Personal Data and is responsible for its lawfulness, including:

3.2 Documented instructions. The Customer instructs AMAI to Process Customer Personal Data to provide the Service in accordance with the Agreement, this DPA, the Customer's configuration of the Service (including its Policy Settings) and the actions of its Customer Users in the Service. Additional instructions must be in writing, consistent with the Agreement and technically feasible; AMAI may charge for additional instructions that go beyond the standard Service.

3.3 Standing instructions. The Customer instructs AMAI to:

3.4 The Customer is responsible for the acts and omissions of its Customer Users and for keeping their credentials, devices and connected Telegram accounts secure.

4. AMAI obligations

4.1 AMAI shall Process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers, unless required to do so by Union or Member State law to which AMAI is subject; in that case AMAI shall inform the Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

4.2 AMAI shall immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. AMAI may suspend the execution of that instruction, including by refusing to transmit a message, until the Customer confirms or modifies it.

4.3 AMAI shall ensure that persons authorised to Process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.4 AMAI shall not sell Customer Personal Data, use it for advertising, or combine it with data of other customers, except as instructed by the Customer.

4.5 AMAI shall not use Customer Personal Data, or any data derived from it, to train, fine-tune or benchmark AI models, and Customer Personal Data is not used to train the models of the AI Sub-processor.

4.6 AMAI may create aggregated and de-identified statistics about the use and performance of the Service that do not contain message content and do not identify the Customer, any Customer User or any natural person, and use them to operate, secure and improve the Service. To the extent creating such statistics is Processing of Customer Personal Data, the Customer instructs AMAI to do so.

5. Security

5.1 AMAI shall implement and maintain the technical and organisational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 GDPR.

5.2 AMAI may update the measures in Annex 2, provided the overall level of protection is not reduced.

5.3 The Customer is responsible for the security settings it controls, including access rights of its Customer Users, enabling multi-factor authentication where the Service offers it, and the security of devices and Telegram accounts it connects.

6. Telegram Transmission

6.1 Telegram is not a Sub-processor. Telegram is a third-party communications service chosen by the Customer and used through Telegram accounts owned and controlled by the Customer or its Customer Users. Telegram acts as an independent controller towards its users under its own terms. AMAI does not engage Telegram to Process Customer Personal Data on its behalf.

6.2 Instruction to transmit. By connecting a Telegram account to the Service, the Customer instructs AMAI to:

6.3 Approval and limits. The Customer sets the autonomy level and policy for its Account. Approval of the first message to each new Partner by a Customer User is switched on by default. The Customer can stop all automation at once with the emergency stop. AMAI applies daily limits and may refuse or delay transmission where a recipient is on a suppression list, where a limit would be exceeded, or where AMAI reasonably believes the transmission would breach law, Telegram's terms or the Agreement.

6.4 Telegram correspondence and AI. AMAI shall not use the ordinary Telegram correspondence of connected Telegram accounts as input for AI models or to train AI models, and shall not use it for any purpose other than operating the conversation for the Customer.

6.5 First-message notice. The Customer shall give each Partner whose data the Customer did not obtain from the Partner the information required by Article 14 GDPR at the latest in the first message, including the Customer's identity as sender and controller, a link to its privacy information and a simple opt-out. Where the Service provides a notice line or link for this purpose, the Customer shall keep it in every such first message. AMAI's general Partner Notice supports, but does not replace, the Customer's own notice.

6.6 Platform risk. The Customer acknowledges that Telegram may restrict, freeze or ban accounts, bots or API access at its discretion. As set out in the Agreement, AMAI is not liable for such measures, nor for Telegram's own Processing.

6.7 Partner Hub. Deal Rooms run in a Telegram Mini App operated by AMAI. Data that Partners enter in a Deal Room is transmitted to AMAI's servers and is Customer Personal Data; Telegram delivers bot notifications and supplies identity data under its terms.

7. AI features

7.1 AMAI uses the AI Sub-processor listed in Annex 3 (OpenAI) to generate drafts and replies, translate and understand messages. AMAI sends to the AI Sub-processor only the data necessary for the task.

7.2 Deal Room AI. AI processing of a Partner's Deal Room messages takes place only where the Partner has given consent to the service in the Partner Hub for the Customer and programmes named on the consent screen, recorded by the Service. If consent is withdrawn, AI processing stops for every Deal Room it covers and those rooms return to handling by the Customer's team.

7.3 Autonomy. Within the Customer's Policy Settings, the AI assistant may reply to a Partner in a Deal Room without per-message approval. Commercial terms, registration approvals, payments and status changes are confirmed only through the Service's manager-confirmed workflows. The Customer is responsible for its choice of autonomy level and policy and for supervising the AI assistant.

7.4 Transparency. The Partner Hub tells Partners that replies may be written by an AI assistant. The Customer shall not configure or use the Service to conceal from a Partner that replies may be written by AI, or to make the AI assistant claim to be human.

8. Sub-processors

8.1 The Customer gives AMAI general written authorisation to engage Sub-processors. The Sub-processors listed in Annex 3 are approved.

8.2 AMAI shall inform the Customer of any intended addition or replacement of a Sub-processor at least 30 days in advance, by email to the Customer's account owner or privacy contact and by updating Annex 3 on this page.

8.3 The Customer may object to the change on reasonable data-protection grounds by written notice within those 30 days. The Parties shall discuss the objection in good faith. If AMAI cannot make available a commercially reasonable alternative, the Customer may terminate the affected part of the Service with effect from the date of the change by written notice, and AMAI shall refund prepaid fees for the remaining period of the affected Service.

8.4 In an emergency (for example the sudden unavailability of a Sub-processor or a security threat), AMAI may replace a Sub-processor with shorter notice, giving notice as soon as possible; the Customer's objection right under clause 8.3 then applies from the date of that notice.

8.5 AMAI shall impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, to the extent applicable to the services provided by that Sub-processor, and remains liable to the Customer for the performance of its Sub-processors' obligations in accordance with Article 28(4) GDPR.

9. International transfers

9.1 AMAI shall not make or permit a Restricted Transfer unless it complies with Chapter V GDPR. The location of Processing by each Sub-processor is stated in Annex 3.

9.2 Sub-processors outside the EEA. For Restricted Transfers to Sub-processors, AMAI shall enter into the SCCs (Module 3, processor to processor) with the Sub-processor or ensure the Sub-processor has entered into the SCCs with AMAI's direct sub-processor, and shall carry out and document a transfer impact assessment.

9.3 DPF. Where a transfer relies on the DPF, AMAI shall also ensure that the SCCs are in place with that recipient. If the DPF, or the recipient's certification, is invalidated, suspended or withdrawn, the SCCs shall apply from that moment. If no lawful transfer mechanism is available, AMAI shall suspend the transfer and inform the Customer.

9.4 Customer outside the EEA. Where the Customer is established in a third country without an adequacy decision, the Parties agree that the SCCs (Module 4, processor to controller), as completed in Annex 4, apply to the transfer of Customer Personal Data from AMAI to the Customer, to the extent such a transfer is a Restricted Transfer.

9.5 Remote access by personnel. Where AMAI's own personnel access Customer Personal Data from outside the EEA, AMAI shall ensure that the access is necessary, protected by the measures in Annex 2 and covered by an appropriate transfer mechanism where required.

9.6 UK. Where the UK GDPR applies to a transfer, the International Data Transfer Addendum issued by the UK Information Commissioner applies together with the SCCs.

10. Data Subject requests

10.1 Taking into account the nature of the Processing, AMAI shall assist the Customer by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from Data Subjects. The Service provides tools for export, erasure, pausing and stopping contact, and withdrawal of AI consent.

10.2 If AMAI receives a request from a Data Subject concerning Customer Personal Data, it shall forward the request to the Customer without undue delay and in any case within 5 business days, and shall not respond itself except to confirm receipt and redirect the Data Subject, unless the Customer authorises it or the law requires it. AMAI may, however, act on a Data Subject's request not to be contacted through the Service by any customer of AMAI.

11. Assistance with compliance

11.1 Taking into account the nature of the Processing and the information available to it, AMAI shall assist the Customer in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), including by providing information about the Service needed for the Customer's own impact assessment.

11.2 AMAI may charge reasonable costs for assistance that goes beyond the Service's standard documentation and self-service tools, except where the assistance is needed because of AMAI's breach of this DPA.

12. Personal Data Breach

12.1 AMAI shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

12.2 The notification shall describe, to the extent known: the nature of the breach, including the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point. Where information is not yet available, AMAI shall provide it in phases without undue further delay.

12.3 AMAI shall take reasonable steps to contain and investigate the breach and shall cooperate with the Customer in its notification to Supervisory Authorities and Data Subjects. AMAI shall not notify Supervisory Authorities or Data Subjects about a breach of Customer Personal Data on the Customer's behalf unless instructed or legally required.

12.4 AMAI's notification of a breach is not an acknowledgement of fault or liability.

13. Return and deletion

13.1 During the term of the Agreement, the Customer may export and delete Customer Personal Data using the Service's tools. After a deletion request, correspondence stays available for up to 30 days where it may lawfully be kept, and is then deleted.

13.2 On termination or expiry of the Agreement, the Customer's workspace is archived. AMAI shall make Customer Personal Data available for export during the Transition Period (where the Customer has requested switching) and the Retrieval Period (at least 30 days). Archived workspaces are kept for 90 days.

13.3 At the end of that period AMAI shall delete Customer Personal Data from its production systems and those of its Sub-processors. Copies in backups expire within 14 days in the ordinary backup cycle and shall not be restored except for disaster recovery, in which case deletions shall be re-applied before the data is used.

13.4 Clauses 13.2 and 13.3 do not apply to data that Union or Member State law requires AMAI to retain; AMAI shall keep such data confidential, restrict its Processing to the legally required purpose and delete it when the obligation ends.

13.5 On written request, AMAI shall confirm deletion in writing.

14. Audits and information

14.1 AMAI shall make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR.

14.2 Documents first. The Customer shall first request information in writing. AMAI shall respond within 30 days by providing: its current security documentation; answers to a reasonable security questionnaire; this DPA's Annex 2 with any updates; summaries of third-party assessments, where available; and its Sub-processor list.

14.3 If the information under clause 14.2 is not sufficient to demonstrate compliance, or a Supervisory Authority requires it, or after a Personal Data Breach affecting Customer Personal Data, the Customer (or an independent auditor it appoints that is not a competitor of AMAI and is bound by confidentiality) may conduct an audit, including an inspection:

14.4 Each Party bears its own costs of an audit. Where an audit requires a substantial amount of AMAI's personnel time, the Customer shall reimburse AMAI's reasonable costs at rates agreed in advance, unless the audit reveals a material breach of this DPA by AMAI.

14.5 Audits of Sub-processors take place by AMAI relying on the Sub-processors' own audit reports and certifications, which AMAI shall make available in summary on request where permitted.

15. Liability

15.1 Each Party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, which apply in aggregate to the Agreement and this DPA.

15.2 Nothing in this DPA or the Agreement limits or excludes liability: (a) for intent (wilful misconduct) or gross negligence; (b) for fraud; (c) to Data Subjects under Article 82 GDPR, to the extent such limitation is not permitted by law; or (d) any other liability that cannot be limited under applicable law.

15.3 Each Party is responsible for administrative fines imposed on it by a Supervisory Authority. Where both Parties are liable for the same damage to a Data Subject, they shall bear it in proportion to their respective responsibility, in accordance with Article 82(5) GDPR.

15.4 The Customer shall indemnify AMAI against claims, fines and losses arising from: (a) the Customer's instructions, including its Policy Settings, that infringe Applicable Data Protection Law; (b) the absence of a legal basis, consent or notice for which the Customer is responsible under clause 3.1; (c) messages sent through the Service in breach of direct-marketing rules; and (d) data imported by the Customer from unlawful sources, in each case except to the extent caused by AMAI's breach of this DPA.

16. Term and termination

16.1 This DPA takes effect on the date of the Agreement and continues as long as AMAI Processes Customer Personal Data.

16.2 Clauses 12, 13, 14, 15 and 17 survive termination as needed to give effect to them.

17. Governing law and jurisdiction

17.1 This DPA is governed by the laws of the Republic of Cyprus.

17.2 The competent courts of the Republic of Cyprus have exclusive jurisdiction over any dispute arising out of or in connection with this DPA, without prejudice to the rights of Data Subjects and Supervisory Authorities.

17.3 The SCCs, where they apply, are governed by the law and subject to the courts specified in Annex 4.

18. General

18.1 Notices under this DPA shall be sent by email to amai@amai.team (subject: Privacy) for AMAI and to the Customer's privacy contact named in the Order Form or, if none, to its Account administrator for the Customer.

18.2 AMAI may amend this DPA where required by changes in Applicable Data Protection Law or by a Supervisory Authority, on 30 days' notice; any other amendment requires the agreement of both Parties, except updates to Annex 3 under clause 8.

18.3 If any provision of this DPA is invalid, the remaining provisions remain in force.

18.4 This DPA is accepted electronically together with the Agreement and may also be executed in counterparts.

18.5 This DPA is made in English. The English version is the binding version.

Annex 1: Description of the Processing

Subject matter: provision of the AMAI Service to the Customer's affiliate team: partner relationship management, search, preparation and transmission of messages, AI replies within the Customer's policy, Deal Rooms, and related support.

Duration: the term of the Agreement plus the Transition Period (if any), the Retrieval Period and the deletion period in clause 13.

Nature of the Processing: collection (import, manual entry, Partner input in Deal Rooms), storage, organisation, structuring, retrieval, search and filtering, display, AI-assisted drafting, replies, translation and message understanding (only as described in clause 7), transmission through Telegram on instruction, notification, export, erasure, and support access.

Purposes: to enable the Customer to identify, contact, onboard and manage business partners for its affiliate programmes; to host Deal Rooms; to provide AI assistance where enabled; to keep the records the Customer needs; and to provide support and security for the Service.

Categories of Data Subjects:

Categories of Personal Data:

Special categories and criminal-offence data: none. The Customer must not provide them.

Frequency: continuous during the term.

Sub-processor Processing: as described in Annex 3, for the duration of the Agreement.

Retention: as configured by the Customer and as set out in clause 13, including: correspondence after a deletion request, up to 30 days where it may lawfully be kept; archived workspaces, 90 days; backups, 14 days.

Annex 2: Technical and organisational measures (Article 32 GDPR)

A. Encryption

B. Access control

C. Logging

D. Availability, backups and recovery

E. Secrets and configuration

F. Secure development

G. Data minimisation and AI controls

H. Incident response

I. Personnel

J. Physical security

K. Certifications

Annex 3: Sub-processors

Part A: Sub-processors that Process Customer Personal Data

Sub-processor and service Location of Processing Transfer safeguard
OpenAI: AI text generation, replies, translation and message understanding (only as described in clause 7) Processing by OpenAI and its affiliates, which may include the United States OpenAI's data processing terms: SCCs or an adequacy decision for transfers outside the EEA

Platform hosting and the full list. The hosting provider of the platform (application server, database, backups and file storage) and the full list of Sub-processors, with their locations and transfer safeguards, will be published in this Annex before the paid launch. The current list is available on request at amai@amai.team.

Part B: Other providers (for information; they do not receive Customer Personal Data from the Service)

AMAI uses these providers as controller for its own website.

Not a Sub-processor

Annex 4: Standard Contractual Clauses: elections

Where the SCCs apply under clause 9: