This Data Processing Agreement ("DPA") forms part of the Terms of Service between
you ("Customer", the party operating a website that uses Oravio) and
Bulubaşa Doru-Lucian (LudoProgramming), Romania ("Processor", "we").
It applies where we process personal data of your website visitors on your behalf, under the GDPR
(Regulation (EU) 2016/679).
Contact / Data protection: contact@ludoprogramming.com
1. Roles of the parties
For the personal data of your visitors processed through Oravio, you are the Data Controller and we are the Data Processor. You determine why and how this data is processed; we process it only on your documented instructions, as set out in this DPA and the Terms of Service.
2. Subject, nature and purpose
- Purpose: providing the Oravio AI assistant — answering visitor questions based on your content, and any modules you enable (WooCommerce, Booking, Audio, Design).
- Nature: collection, storage, retrieval, transmission to AI sub-processors, and deletion.
- Duration: for as long as your license is active, plus the retention periods below.
3. Categories of data and data subjects
- Data subjects: visitors of your website who interact with the widget.
- Personal data: the text of questions/messages they type (which may contain personal data they choose to include); the email address if you enable lead capture; technical data such as IP address (used transiently for rate-limiting and security) and approximate language.
- We do not intentionally process special categories of data; visitors should not be invited to submit them.
4. Our obligations as Processor
- process personal data only on your documented instructions;
- ensure persons authorised to process the data are bound by confidentiality;
- implement appropriate technical and organisational security measures (Section 7);
- assist you, as far as possible, in responding to data-subject requests and in your obligations under Articles 32–36 GDPR;
- notify you without undue delay after becoming aware of a personal data breach;
- at your choice, delete or return the personal data at the end of the service, and delete existing copies unless storage is required by law.
5. Sub-processors
You authorise us to use the following sub-processors. We remain responsible for their compliance:
- Microsoft Azure — hosting, database (Cosmos DB), functions, authentication and (optional) speech, in the EU (North Europe / Ireland) region.
- OpenAI — generating AI answers from the question and your content (default AI provider).
- Azure OpenAI — alternative AI provider (EU regions), where selected.
- Netopia Payments — payment processing for paid plans (billing data of the Customer, not visitor data).
If you use BYOK (your own AI keys), answers are generated through your own AI provider account under your agreement with them. We will inform you of intended changes to sub-processors, giving you the opportunity to object.
6. International transfers
Data is primarily processed within the EU. Where a sub-processor (e.g. OpenAI) processes data outside the EEA, such transfers are governed by appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
7. Security measures
- encryption in transit (HTTPS/TLS) and at rest for stored data;
- access control and authentication for administrative access;
- tenant isolation per license; secrets and keys stored securely;
- logging and monitoring of the platform.
8. Retention and deletion
- conversation logs and analytics are retained to operate the service and are deleted when the license is deleted;
- semantic cache entries expire automatically based on your plan;
- on termination, data associated with your license is deleted on request or within a reasonable period.
9. Data-subject rights
As Controller, you handle requests from your visitors (access, rectification, erasure, etc.). We assist you with appropriate technical measures and will action deletion requests you pass on to us.
10. Acceptance
By using Oravio to process visitor data, you accept this DPA. If you require a countersigned copy for your records, contact contact@ludoprogramming.com.