Legal
Botpoison Data Processing Agreement
Effective date: 17 October 2026
This Data Processing Agreement is the Article 28 contract between you and Trampoline Software SRL. It covers the personal data we process on your behalf when you use Challenge and Classify.
It forms part of our Terms of Service. It applies to every customer, at no extra cost, and needs no signature.
Parties and roles
You are the controller of the personal data of the visitors to your forms. We are the processor of it.
We are the controller of the data about you as our customer, such as your account and billing details. Our Privacy Policy covers that data, and this agreement does not.
We may use masked content sent to Classify to train and evaluate our spam detection models. For that use we are a controller, not your processor, and the section on model training below sets out what you authorise.
Subject matter, duration, nature and purpose
We process personal data to tell your forms' visitors apart from bots (Challenge) and to tell whether a submission is spam (Classify). We do this for as long as you use the Service, and until we delete the data as described below.
Categories of data subjects and personal data
The data subjects are the people who visit and fill in the forms you protect, and anyone they mention in what they write.
| Data | Product | Retention |
|---|---|---|
| IP address, user agent, referrer, page address, accepted languages and encodings | Challenge | Until you delete the configuration or the workspace |
| Approximate location and network from the IP address: country, region, time zone, network operator | Challenge | Until you delete the configuration or the workspace |
| Content of the submission or message you send, which can hold names, email addresses, phone numbers and free text | Classify | Not kept to answer the request. Content used for model training is held by us as controller, as set out below |
| Verdict, score, model and time of each classification | Classify | Until you delete the configuration or the workspace |
You must not use the Service to process special categories of personal data, children's personal data, health data or criminal history. Free text can carry such data whatever a form asks for, so do not send content from forms built to collect it to Classify.
Documented instructions
We process the data only on your documented instructions: the Terms of Service, this agreement, and the way you configure the Service.
We step outside them only where the law requires it. If that happens we tell you first, unless the law forbids us to.
If we think an instruction breaks the GDPR or other data protection law, we tell you.
Confidentiality
Everyone we allow to handle this data is bound to keep it confidential, by agreement or by law.
Security measures
We apply the technical and organisational measures in Annex II, taking into account the state of the art, the cost, and the risk of the processing.
Subprocessors
You give us general permission to use subprocessors. The current list is published on our subprocessors page and forms part of this agreement.
We add a new subprocessor to that page at least 30 days before it starts handling personal data. That gives you time to object.
We do not notify you individually. It is your responsibility to check that page for changes.
If you object and we cannot resolve it, you may stop using the Service.
We put the same data protection obligations on every subprocessor that this agreement puts on us. We stay liable to you for what they do.
International transfers
The personal data we process for you is stored in the European Economic Area, in Ireland.
Some subprocessors process personal data outside the European Economic Area. The subprocessors page lists where each one processes it and the transfer safeguard that applies to it.
Model training
Classify scores content with Botpoison's own model, on our own infrastructure, hosted by Amazon Web Services. Content sent to Classify may also be used to train and evaluate Botpoison's models. You authorise us to:
- keep content sent to Classify for that purpose, after replacing the part of each email address before the @, phone numbers and IP addresses;
- use it, as a controller, only to train and evaluate spam and abuse detection models, never for advertising or any other purpose.
You agree that your own privacy notice tells your visitors that a provider screens submissions for spam and may use them to improve its models. A data subject may object to this use by writing to support@botpoison.com.
Helping you answer data subject requests
If a data subject asks us directly to exercise a right over data we process for you, we pass the request to you rather than answer it ourselves. We help you answer requests as far as the nature of the processing allows.
Personal data breaches
If a breach affects the personal data we process for you, we tell you without undue delay after we find out. We say what happened, which categories of data and roughly how many records it touched, the likely consequences, and what we are doing about it. It is then your call whether to notify your supervisory authority or the people affected.
Helping you with impact assessments
We help you with data protection impact assessments, and with prior consultation of a supervisory authority, as far as the nature of the processing and the information we hold allow.
Deletion or return when we are done
When you delete a workspace, we delete its configurations and every record in them. Before you delete it, you may ask us for a copy of that data.
Audits and information
We give you the information you need to check that we meet our Article 28 obligations. We allow audits, including inspections, by you or an auditor you appoint.
Send audit requests to support@botpoison.com. Audits happen once per year, unless a supervisory authority asks for more. Give us reasonable notice, and do not disrupt the service for other customers.
Precedence
Where this agreement and the Terms of Service differ about personal data, this agreement prevails.
Governing law
The law of Belgium governs this agreement, and the courts of Belgium have exclusive jurisdiction, as in the Terms of Service.
Changes to this agreement
When a change matters to you, we post it on this page at least 30 days before it takes effect. We do not notify you individually. It is your responsibility to check this page for changes.
Annex I: details of the processing
- Controller: you, the customer named on the account.
- Processor: Trampoline Software SRL, Rue de Marsannay-la-Côte 16, 5032 Mazy, Belgium, enterprise number BE 0799.398.081, support@botpoison.com.
- Subject matter, nature, purpose, categories and retention: as set out above.
Annex II: technical and organisational measures
- Encryption in transit
- Access to production data limited to a small number of authorised people, who are required to keep it confidential
- Monitoring and alerting on the production service
Annex III: subprocessors
The subprocessors page is the authoritative list, with the location and safeguard for each. It is incorporated here by reference, so updating it does not require a new agreement.
Questions
Please get in touch by emailing us at support@botpoison.com, and we'll be happy to answer them.
Botpoison is operated by Trampoline Software SRL, Rue de Marsannay-la-Côte 16, 5032 Mazy, Belgium. Enterprise number BE 0799.398.081.