If you are a business in the EU/EEA (or process personal data of EU residents), GDPR Article 28 requires a written Data Processing Agreement between you (the data controller) and any processor that handles personal data on your behalf.
Boei provides a comprehensive DPA included with every plan, at no extra cost.
The agreement documents:
Business-merge audit records contain the businesses involved, the operator, moved record IDs and totals. These records are retained for 90 days. Unconfirmed merge previews are removed after 24 hours.
You can review and sign Boei's standard DPA online at app.boei.help/dpa.
If you need the DPA signed under a specific framework (e.g. your own template), email support@boei.help with the subject "DPA request" and include your account email, your company's legal name, and the template. We will review and respond within a few business days.
Signing a DPA does not make your business GDPR-compliant on its own. The DPA documents the responsibilities and safeguards between you and Boei. It supports your compliance program, but it is not a compliance certificate. You are still responsible for your own data protection obligations as the data controller.
The same applies under other frameworks such as India's DPDP Act, where you are generally the Data Fiduciary and Boei is the Data Processor.
Sub-processors are third parties that process personal data on Boei's behalf to deliver the service (e.g. hosting providers, AI model providers). The current list is maintained in the DPA and is also available on request.
We notify customers of material changes to the sub-processor list with reasonable advance notice so you can object if needed.