CostCare AI • MACH GROUP LLC, EDRPOU 45164108
This Data Processing Agreement (the “DPA” or the “Agreement”) governs the processing of personal data by LIMITED LIABILITY COMPANY “MACH GROUP”, Company Identification Code 45164108, registered address: Premises 1, 6/1 Stelmakha Street, Kyiv, 03040, Ukraine, operating under the CostCare AI trademark (the “Company” or the “Processor”), on behalf of a client that uses the CostCare AI software platform and acts as the controller of the relevant personal data (the “Client” or the “Controller”).
This Agreement forms an integral part of the contractual relationship between the Company and the Client governed by the Public Offer for Access to the CostCare AI Software Platform and Related Services (the “Public Offer”).
This Agreement applies to the extent that the Company processes personal data on behalf of the Client as a processor in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) and/or other applicable data protection laws.
1.1. The terms “personal data”, “processing”, “controller”, “processor”, “sub-processor”, “data subject”, “personal data breach” and other terms relating to the protection of personal data shall have the meanings assigned to them under the GDPR and other applicable laws.
1.2. For the purposes of the processing governed by this Agreement:
1.3. Where, in relation to a particular processing operation, the Company independently determines the purposes and essential means of processing personal data, the Company shall act as an independent controller in respect of such processing operation. Such processing shall be governed by the Company’s Privacy Policy and shall not constitute processing by the Processor on behalf of the Client under this Agreement.
2.1. The Company shall process personal data on behalf of the Client solely to the extent necessary to provide access to the CostCare AI software platform (the “Platform”), enable the operation of AI agents and integrations, and provide other related services in accordance with the Public Offer.
2.2. The subject matter, nature, purposes and duration of the processing, the categories of data subjects, the categories of personal data and the principal processing operations are specified in Annex No. 1 to this Agreement.
2.3. The Company shall process personal data solely on the basis of the Client’s documented instructions, including instructions concerning international transfers of personal data, unless such processing is required by law applicable to and binding upon the Company.
Where the Company is required by law to carry out such processing independently of the Client’s instructions, the Company shall, unless prohibited by law, inform the Client of the relevant legal requirement.
2.4. The Client’s documented instructions may include the Public Offer, this Agreement, the Platform settings, the Client’s selection of the relevant functionality and AI provider, commands and requests submitted through the Platform, as well as other written or electronic instructions agreed by the Parties.
2.5. If the Company considers that an instruction from the Client infringes the GDPR or other applicable data protection law, the Company shall inform the Client accordingly and may suspend the implementation of the relevant instruction until it is clarified or brought into compliance with applicable law.
2.6. The Client shall be responsible for:
3.1. The Company shall ensure that persons authorised to process personal data are subject to confidentiality obligations.
3.2. Access to personal data shall be granted only to authorised persons to the extent necessary for the performance of their functions.
3.3. The Company shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks associated with the processing, taking into account the nature, scope, context and purposes of the processing.
3.4. As of the date of this version, the Company, in particular:
3.5. The Company may modify and improve its technical and organisational measures, provided that such modifications do not result in a material reduction in the overall level of protection of personal data.
4.1. The Platform enables the Client to use artificial intelligence functionality through AI providers supported by the Company, including OpenAI, Anthropic, Google Gemini and DeepSeek.
4.2. The Client selects an available AI provider in accordance with the functionality and settings of the Platform.
4.3. For the purpose of generating an AI agent’s response, personal data and other information necessary to fulfil a particular request may be transmitted to the relevant AI provider via API, including the content of messages, relevant interaction history, context, as well as information from files, documents or other sources to which the Client has provided access, where such information is necessary to generate the response.
4.4. The Company does not use personal data processed on behalf of the Client to train or fine-tune its own artificial intelligence models.
When engaging third-party AI providers, the Company uses the relevant APIs and configurations under terms designed to process data without using such data to train or fine-tune publicly available models, to the extent provided for under the terms of the relevant provider.
4.5. The Company does not grant third-party AI providers any independent right to use the Client’s data for their own model training or fine-tuning purposes.
4.6. The processing and retention of information by the relevant third-party AI provider shall be governed by the terms applicable to the relevant API, the configurations used by the Company and applicable law.
5.1. The Client grants the Company general authorisation to engage sub-processors necessary for the provision of the Platform and related services.
5.2. The current list of sub-processors that the Company may engage to process personal data on behalf of the Client, their functions and other relevant information concerning such processing is set out in a separate Subprocessor List, which is maintained by the Company and made available to the Client electronically and/or on the Company’s website.
5.3. The Company shall notify the Client of any intended engagement of a new sub-processor or replacement of an existing sub-processor before such new sub-processor begins processing personal data by updating the current Subprocessor List on the Company’s website and/or by sending a notice to the Client’s email address. The Client may, within 10 calendar days from receipt or publication of such notice, raise reasoned objections relating to the protection of personal data. The Parties shall cooperate in good faith to resolve such objections.
5.4. Each sub-processor shall be subject to contractual data protection obligations ensuring an appropriate level of protection having regard to the nature of the services and the requirements of applicable law.
5.5. Where a sub-processor fails to fulfil its data protection obligations, the Company shall remain liable to the Client for the performance of the relevant obligations of the sub-processor to the extent required by applicable law.
5.6. PayPro Global is used in connection with the acceptance and processing of payments as the Merchant of Record. The Company does not receive or store payment card numbers, CVV/CVC codes, cardholder names or other complete payment credentials provided by the user directly to the relevant payment provider. The status of PayPro Global in relation to a particular processing activity shall be determined according to the nature of the relevant transaction and the applicable PayPro Global terms.
6.1. The primary server infrastructure used by the Company to operate the Platform is located in the AWS Frankfurt region, Germany, eu-central-1.
6.2. Backups of Client data are also stored on infrastructure located in Frankfurt, Germany.
6.3. The use of certain AI providers and other sub-processors may involve the processing or transfer of personal data outside the European Economic Area.
6.4. Where the GDPR requires a specific international data transfer mechanism for the relevant transfer, the Company shall ensure that an appropriate mechanism is implemented in accordance with Chapter V of the GDPR, including, as applicable, an adequacy decision, Standard Contractual Clauses (SCCs) approved by the European Commission and/or another mechanism permitted under applicable law.
6.5. Upon the Client’s reasonable request, the Company shall provide information regarding the applicable international data transfer mechanism to the extent necessary to demonstrate compliance with applicable law.
7.1. Taking into account the nature of the processing, the Company shall, insofar as possible, assist the Client in fulfilling its obligations relating to the exercise of data subject rights.
7.2. Where the Company receives a request from a data subject concerning personal data processed exclusively on behalf of the Client, the Company shall forward such request to the Client without undue delay, unless otherwise required by applicable law.
7.3. The Company shall not independently decide whether to grant or refuse such request, except where provided for by the Client’s documented instructions or required by law.
7.4. Taking into account the nature of the processing and the information available to the Company, the Company shall provide the Client with reasonable assistance in fulfilling its obligations under Articles 32-36 of the GDPR, including ensuring security, responding to personal data breaches, carrying out Data Protection Impact Assessments (DPIAs) and cooperating with competent supervisory authorities.
8.1. In the event of a personal data breach affecting personal data processed on behalf of the Client, the Company shall notify the Client without undue delay after becoming aware of such breach.
8.2. To the extent that the relevant information is available to the Company, the notification shall include, where possible:
8.3. Where it is not possible to identify precisely all data or all data subjects affected by the breach at the time of the initial notification, the Company shall provide the information available at that time and supplement it as additional information becomes available.
8.4. Notification of a breach shall not, in itself, constitute an admission of fault or liability by the Company.
9.1. The Company shall retain personal data for the period necessary to provide services to the Client, comply with the Client’s documented instructions and meet the requirements of applicable law.
9.2. Upon the Client’s valid request, the Company shall provide the technical capability to export the Client’s personal data within the available functionality and technical capabilities of the Platform.
9.3. Upon the Client’s valid request, personal data shall be deleted from the primary production database without undue delay following the implementation and technical processing of such request, unless further retention is required by law.
9.4. Backups are created daily and stored on infrastructure located in Frankfurt, Germany.
9.5. Following deletion of data from the primary production database, copies of such data may temporarily remain in backups until completion of the standard backup rotation cycle, but for no longer than 30 calendar days. During this period, data contained in backups shall not be used for ordinary operational activities and shall remain protected in accordance with this Agreement.
9.6. Following termination of the services and at the Client’s choice, the Company shall delete or return the personal data processed on behalf of the Client and delete existing copies, unless applicable law requires further retention. Data remaining in backups following deletion from the primary production database shall be deleted within the standard backup rotation cycle, which shall not exceed 30 calendar days, and shall not be used for ordinary operational activities during this period.
10.1. The Company shall provide the Client with information reasonably necessary to demonstrate compliance with the Processor’s obligations under Article 28 of the GDPR.
10.2. Where and to the extent required by applicable law, the Company shall allow audits to be conducted by the Client or an independent auditor authorised by the Client.
10.3. Any audit shall be conducted:
10.4. Where the required compliance can be demonstrated through documentation, descriptions of security measures, reports, certificates or other appropriate materials, such materials may be used instead of a separate on-site audit, provided that this does not restrict any mandatory rights of the Client.
11.1. Each Party shall be responsible for complying with the obligations imposed on it under the GDPR, other applicable laws and this Agreement.
11.2. The Client shall be responsible for the lawfulness of the personal data transferred to the Company, the existence of an appropriate legal basis for their processing and the lawfulness of the instructions provided to the Company.
11.3. Unless otherwise required by mandatory provisions of applicable law, the limitations of liability set out in the Public Offer shall also apply to claims arising out of or in connection with this Agreement.
11.4. Nothing in this Agreement shall exclude or limit liability where such exclusion or limitation is prohibited by applicable law.
12.1. This Agreement shall enter into force simultaneously with the Public Offer or when the Company first begins processing personal data on behalf of the Client, whichever occurs first.
12.2. This Agreement shall remain in effect for the entire period during which the Company processes personal data on behalf of the Client.
12.3. In the event of any conflict between this Agreement and the Public Offer in relation to the processing of personal data on behalf of the Client, this Agreement shall prevail. The Public Offer shall apply to all other matters.
12.4. This Agreement shall be governed by the laws of Ukraine, unless otherwise required by mandatory provisions of applicable law.
Where the GDPR or other mandatory data protection law applies to the relevant processing, this Agreement shall be interpreted and applied in a manner that ensures compliance with the relevant mandatory requirements.
12.5. The procedure for amendments, electronic communications, dispute resolution and other matters not regulated by this Agreement shall be governed by the Public Offer and applicable law.
12.6. If this Agreement is entered into or made available in multiple languages, the prevailing language version shall be determined in accordance with the Public Offer.
LIMITED LIABILITY COMPANY “MACH GROUP”
Company Identification Code: 45164108
Registered address: Premises 1, 6/1 Stelmakha Street, Kyiv, 03040, Ukraine
Trademark: CostCare AI
Email: wahtel@costcare.ai
Phone: +380 67 565 27 27
This Annex No. 1 forms an integral part of the DPA.
The processing by the Company of personal data on behalf of the Client in connection with providing access to the CostCare AI Platform, the creation and operation of AI agents, the use of integrations and the provision of related services.
The processing shall be carried out for the duration of the provision of services to the Client and for the period necessary to properly return or delete the data, complete the backup rotation cycle and comply with mandatory legal requirements.
The processing shall be carried out for the purposes of:
The processing may include collection, recording, organisation, structuring, storage, consultation, use, retrieval, analysis, transmission, provision of access, automated processing, processing using AI, export, restriction, deletion and destruction of data.
Depending on the Client’s use of the Platform, personal data may relate to:
Depending on the configuration and manner in which the Platform is used, the following personal data may be processed:
The Platform is not specifically designed for the processing of special categories of personal data referred to in Article 9 of the GDPR or personal data relating to criminal convictions and offences referred to in Article 10 of the GDPR.
The Client shall not provide such data through the Platform unless this is necessary for the agreed use of the Platform and the Client has ensured an appropriate legal basis, appropriate safeguards and compliance with other requirements of applicable law.
The primary server infrastructure and Client data are hosted in the AWS Frankfurt region, Germany, eu-central-1.
Backups are also stored on server infrastructure located in Frankfurt, Germany.
Data may be transferred to certain AI providers and other providers in accordance with the functionality selected by the Client and the terms of this Agreement.
The Company implements, in particular:
The Client may select a supported AI provider, including OpenAI, Anthropic, Google Gemini or DeepSeek.
Interaction with such providers is carried out via API.
For the purpose of generating a response, information necessary to fulfil a particular request may be transmitted, including relevant interaction history, messages, documents, files and other context to which the Client has provided access.
The Company does not use the Client’s data to train or fine-tune its own artificial intelligence models and does not grant third-party AI providers the right to use such data to train or fine-tune their publicly available models for their own purposes.
Upon the Client’s valid request, data shall be deleted from the primary production database without undue delay following the technical processing of the request.
Data remaining in backups shall be permanently deleted within the standard backup rotation cycle, which shall not exceed 30 calendar days.
Until permanently deleted, such data shall remain protected and shall not be used for ordinary operational activities.