Data Processing Agreement (DPA)

Last Updated: October 12, 2026 · Entity: YM PROPERTYPATH - SMC LTD

This Data Processing Agreement (“DPA”) forms part of the agreement between the customer (“Controller” or “you”) and YM PROPERTYPATH - SMC LTD (“Processor,” “Patriy,” “we”) for the Patriy Service. It applies when Patriy processes Personal Data on your behalf under applicable data protection law, including the GDPR.

1. Roles

• You (Customer): Controller of end-customer and contact data you connect to Patriy.
• Patriy: Processor for that customer data; Controller for account, billing, and platform telemetry as described in the Privacy Policy.

2. Subject Matter & Duration

Processing of Personal Data to provide AI messaging, inbox, CRM, analytics, and related features for the term of your subscription and any post-termination retention/deletion period.

3. Nature & Purpose of Processing

• Receive and store messages from connected channels
• Generate AI responses and automation workflows
• CRM contact, lead, and pipeline management
• Analytics, quality, abuse prevention, and support
• Backup, security monitoring, and service improvement (pseudonymized where feasible)

4. Types of Personal Data

May include names, contact details, message content, social handles, order/support metadata, device/IP technical data, and any other data you or end users submit through connected channels. You control what is collected via your integrations and knowledge base.

5. Categories of Data Subjects

Your customers, leads, employees/agents, and other individuals who interact with your channels.

6. Processor Obligations (GDPR Art. 28)

Patriy shall:

1. Process Personal Data only on documented instructions from you, including this DPA and product configuration
2. Ensure persons authorized to process data are bound by confidentiality
3. Implement appropriate technical and organizational security measures (see Security Center)
4. Engage sub-processors only under written terms offering equivalent protection, with notice as described in the Sub-processors policy
5. Assist you with data subject requests, DPIAs, and breach notifications, taking into account the nature of processing
6. Delete or return Personal Data after end of services, unless law requires retention
7. Make available information necessary to demonstrate compliance and allow reasonable audits (with notice, confidentiality, and scope limits)

7. Your Obligations

• Ensure a lawful basis for processing and for instructing Patriy
• Configure retention, access, and channel connections appropriately
• Not instruct Patriy to process data unlawfully
• Respond to data subject requests in the first instance where you are Controller

8. International Transfers

Where Personal Data is transferred outside the EEA/UK, Patriy uses appropriate safeguards such as Standard Contractual Clauses (SCCs) and supplementary measures as needed.

9. Security Incidents

Patriy will notify you without undue delay after becoming aware of a Personal Data breach affecting your data, with information reasonably available to assist your compliance obligations.

10. Sub-processors

Current list: sub-processors.html. Material changes will be published there; enterprise customers may receive additional notice per contract.

11. Liability & Precedence

Liability is subject to the Terms of Service and any enterprise order form. If this DPA conflicts with the Terms on data protection, this DPA controls for processing of Personal Data.

12. Enterprise Execution

Enterprise customers may request a signed DPA PDF via Contact Us or hello@patriy.com. Online acceptance of Terms + this DPA constitutes agreement for self-serve plans.