DPA and GDPR: referring or reselling
Who the controller is, which data processing agreement applies and what your obligations are when referring, when reselling and when accessing customer accounts.
If nobody else does, your customer's data protection officer will ask for the data processing agreement (DPA). Whether bhomy's agreement applies or you conclude one yourself depends on who your customer's contracting party is.
Where to find the DPA and technical measures
bhomy's DPA is Annex 1 to the terms and conditions and is available at bhomy.ai/en/datenschutz#avv (opens in a new tab). It contains the technical and organisational measures and the list of sub-processors. It's available in German and is incorporated when the contract is concluded.
The two routes compared
| Referring | Reselling | |
|---|---|---|
| Controller | your customer | your customer |
| Processor | bhomy | you, and bhomy as a further processor |
| Data processing agreement | bhomy's DPA, directly between the customer and bhomy | your contract with the customer, such as Template A, and between you and bhomy the DPA with Annex 4 |
| Instructions | the customer gives them to bhomy, also through their settings | the customer gives them to you, and you pass them on to bhomy |
| Notifications of data breaches | to the customer | to you, and you inform the customer immediately. If we can't reach you, we may inform them directly |
| Changes to sub-processors | to the customer | to you, and you forward them to your customers and pass any objection back to us |
| Requests from data subjects and authorities | to the customer | we forward them to you where this is permitted |
| Audit rights | the customer has them towards bhomy | you have them, also for your customers. If you can't carry out an audit yourself, we enable the customer to do it |
When referring
Your customer concludes their contract with bhomy, and bhomy's DPA applies to them directly. You don't need to do anything else as long as you don't look into their account.
If you access the customer account
If the customer gives you access in the dashboard, you act for them in their account and are their processor to that extent. This doesn't create a processing relationship between you and bhomy.
- Conclude a data processing agreement with the customer beforehand. You can use Template A for this.
- If the customer is bound by professional secrecy, also give them a confidentiality undertaking, for example with Template B.
- The customer grants you access, with scope and duration. You only see conversation content if they explicitly release it.
Every access is logged, and the customer sees the log in the dashboard. How granting access works is described under Partner account and partner access.
When reselling
You're the provider for your customer. Before they use the platform, you agree the following with them:
| Agreement | What for | Template |
|---|---|---|
| Minimum terms | rules for using the platform, such as the AI notice and prohibited uses | Annex 5 |
| Data processing agreement under Art. 28 GDPR | names bhomy as a further processor, incorporates the sub-processors and grants the customer audit rights | Template A |
| Confidentiality undertaking | only for customers bound by professional secrecy | Template B |
In the partner area, you confirm that these agreements have been concluded. On request, you provide us with evidence of them, and you may redact details that aren't needed for this. Keep the evidence for the term of the agreement and for three years after it.
Customers bound by professional secrecy
If your resale customer is based in Germany and bound by professional secrecy, for example as a medical practice or law firm, bhomy contributes to their professional work as a further involved person. bhomy then undertakes to maintain confidentiality in their favour, according to the undertaking in Annex 2 to the terms and conditions, or Annex 3 if they're based in Austria. You give them your own undertaking with Template B and inform them of bhomy's undertaking.
Referral customers bound by professional secrecy receive the undertaking directly from bhomy, via datenschutz@bhomy.ai.
How to bring up the topic in the demonstration
Don't wait until the data protection officer asks. One sentence is enough: "You conclude the data processing agreement together with the contract, in German. I'm happy to show you where the data is processed and how long it's stored." The details are under Hosting and data. When reselling, you say that they conclude the contract with you.
Was this page helpful?