1. Parties, roles and subject matter
This Agreement forms part of the SkyInbox contract between the customer company and SKILLS IT SOLUCOES EM TECNOLOGIA LTDA, trading as Skills IT, Brazilian company registration (CNPJ) 05.699.856/0001-10, Quadra ACSE 1, Rua SE 1, nº 38, sala 10, 2º andar, Plano Diretor Sul, Palmas–TO, CEP 77020-014, Brazil, provider of SkyInbox.
It applies to the personal data that Skills IT processes as processor, on behalf of the customer company, which is the controller: mainly the data of the company's own customers, which arrives through the channels connected to SkyInbox. If the customer company in turn acts as processor for another controller, it represents that it is authorised to engage Skills IT as sub-processor and to give valid instructions.
The processing that Skills IT carries out as controller, such as registration, billing, security and sales contact, is governed by the Privacy Policy.
2. Description of the processing
| Element | Scope |
|---|---|
| Purpose | Providing the contracted omnichannel customer service: receiving, organising and answering conversations, generating Sky's replies and suggestions, running pipelines, chatbots, reports and integrations |
| Operations | Receipt, storage, organisation, retrieval, transmission to the necessary channels and providers, generation of replies by artificial intelligence, vectorisation of the knowledge base, export and deletion |
| Data subjects | Customers and prospective customers of the customer company, people who get in touch through the connected channels and dashboard users |
| Data | Name, phone number, email, identifiers on the connected networks, message content, attachments, audio and images, labels, notes, data collected by chatbots and records associated with conversations |
| Duration | The term of the contract and the period needed for export, deletion or retention required by law |
The customer company decides what is collected and must avoid unnecessary data. Sensitive data and data of children and adolescents require their own legal basis and additional safeguards, which must be agreed with Skills IT before the processing takes place.
3. Documented instructions
Skills IT processes the data only on the documented instructions of the customer company: the contract, this Agreement, the settings made in the dashboard and requests sent by authorised representatives, including with regard to transfers. If the law requires different processing, Skills IT informs the customer company beforehand, unless the law prohibits such notice.
If it considers an instruction incompatible with the law, Skills IT informs the customer company and may suspend the affected flow until it is clarified. The customer company is responsible for the lawfulness of its instructions, for the information given to data subjects and for the access permissions it grants.
4. Authorised persons and security
Anyone at Skills IT who processes the data is bound by a duty of confidentiality, contractual or statutory, and has access appropriate to their role.
Skills IT maintains technical and organisational measures proportionate to the risk, reviewed while the service is provided. They currently include isolation of data and knowledge base by company, encryption in transit, passwords stored encrypted, login attempt limits, permission profiles, an audit trail from the Business plan upwards, key-only server access and daily backups with seven-day retention. The customer company may request information about these controls to assess whether they are adequate for its processing.
The customer company administers the users, credentials, channels and integrations it connects, and must keep them consistent with its own instructions.
5. Subprocessors and changes
The customer company gives general authorisation for the subprocessors needed for the features it uses, described in the list of subprocessors. Channel operators (such as Meta, for WhatsApp, Instagram and Messenger) and the services the customer company contracts itself and connects to SkyInbox are governed by the terms it accepts with them.
Before adding or replacing a subprocessor that processes the data covered, Skills IT notifies the customer company through the registered contact, with a reasonable period to raise a reasoned objection, sent to contato@skyinbox.com.br. The parties will seek a workable alternative. While the objection remains unresolved, the affected flow may be unavailable; if no solution is found, it may be terminated in accordance with the contract.
Skills IT requires its subprocessors to accept data protection obligations consistent with this Agreement and remains responsible to the customer company for the performance of the obligations it entrusts to them, to the extent provided by law.
6. Sky and the artificial intelligence providers
When Sky is active, the necessary excerpt of the conversation and the relevant knowledge base articles are sent to the language model provider at the time of the reply, and the knowledge base is converted into search vectors. This transmission serves exclusively to generate the reply or suggestion requested.
Skills IT and the model providers it selects and contracts do not use the customer company's data, including messages, knowledge base documents and generated replies, to train artificial intelligence models. Skills IT undertakes to maintain this condition when selecting and contracting those providers. One company's knowledge base and history are never used in the reply given to another company's customer.
7. Assistance to the customer company
Taking into account the nature of the processing and the information available, Skills IT assists the customer company in responding to data subject requests, with security, with impact assessments and with consultations with the ANPD (Brazil's data protection authority), where required.
A data subject request that reaches Skills IT directly about the customer company's data is forwarded to the company, and the response does not go beyond the company's instructions, unless the law requires otherwise. The dashboard allows the customer company to find, export and delete contacts and conversations without depending on Skills IT.
8. Personal data incidents
Skills IT notifies the customer company without undue delay after becoming aware of an incident affecting the data processed on its behalf. The first notification may be supplemented later; the investigation does not need to be complete before notice is given.
The notification states, where available, the nature of the event, the data and people affected, the likely consequences, the containment measures and a contact. Skills IT cooperates in the investigation and mitigation. It is for the customer company, as controller, to assess and make the notifications for which it is responsible, within the applicable deadlines.
9. Return and deletion
On termination, the customer company may export contacts, conversations and reports in an open format. The request must be made before the end of the contract or within 30 days after it. After that period, Skills IT deletes the data covered, unless retention is required by law.
Deletion includes the relevant derivatives, such as knowledge base indexes and vectors, notes and records containing conversation content. Backups disappear at the end of the seven-day cycle; if a restore takes place during that period, the deletion is applied again. Skills IT confirms in writing what was deleted and what was retained because of a legal obligation.
10. International transfers
Some subprocessors process data outside Brazil. Skills IT undertakes to adopt a valid mechanism for these transfers where the law requires it, taking into account the parties, the destination and the flow, including the standard contractual clauses approved by the ANPD where they are the applicable instrument.
The customer company may request information about each flow and the safeguards adopted. Any specific territorial restriction must be agreed before the corresponding processing.
11. Demonstration of compliance and audit
Skills IT makes available the information needed to demonstrate compliance with this Agreement and allows audits by the customer company or by an auditor it authorises. The parties agree on the scope, notice and protection of third-party information, without defeating the legal right to audit. Intrusive tests require written authorisation.
12. Precedence, languages and duration
This Agreement prevails over the Terms of Service in any conflict regarding the processing it covers. The Portuguese version governs any divergence in translation, unless the contract or the law provides otherwise.
The data protection obligations remain in force for as long as Skills IT holds data covered by this Agreement. Each version remains published at its own dated address, and a new publication does not retroactively change what was accepted before.
Contact: contato@skyinbox.com.br.