Data processing agreement (DPA)

1. Subject and duration

The Processor answers the Controller's calls with a voice agent, records orders, appointments and bookings, and passes them to the Controller.

The agreement lasts as long as the subscription, then until the data is deleted as set out below.

2. Data and data subjects

Data subjects: the customers and prospects who call the Controller.

Data: phone number, name, the content of the order or appointment, call transcript and summary, delivery address where relevant. No audio recording is kept. The agent does not ask for sensitive data or card details.

3. The Processor's commitments

Process the data only on the Controller's documented instructions; these terms and the settings of its account are those instructions.

Keep the data confidential: only people who need it have access, and they are bound to secrecy.

Apply the security measures described in the privacy policy: encryption in transit, hashed passwords, data separated per business, secrets kept out of the code.

Help the Controller answer data subject requests, impact assessments and consultations with the supervisory authority.

Notify the Controller of any personal data breach within 48 hours of becoming aware of it, with the information available.

Provide the information needed to show compliance with this agreement and allow reasonable audits, with 30 days' notice.

4. Sub-processors

The Controller authorises the sub-processors listed on the Sub-processors page. The Processor binds them to equivalent data protection obligations and remains liable for them.

Any addition or replacement is announced at least 30 days in advance by email or on that page. The Controller may object on reasonable grounds and, if no solution is found, terminate without charge.

5. Transfers outside the European Union

Some sub-processors are in the United States. Transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses.

In Canada, the Processor protects personal information transferred outside Quebec and Canada in line with PIPEDA and Law 25.

6. End of the contract

When the subscription ends, the Controller can export its data from its dashboard. The Processor deletes it within 90 days, unless the law requires it to be kept.