Data Processing Agreement (DPA)

Effective as of December 18, 2024 | Last Updated: December 18, 2024

1. Definitions

For the purposes of this DPA, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person as defined in Article 4(1) of the GDPR.
• "Processing" means any operation performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.
• "Data Controller" means the natural or legal person who determines the purposes and means of the processing of Personal Data (the Customer).
• "Data Processor" means the natural or legal person who processes Personal Data on behalf of the Data Controller (VECTOR WIZARDS LLC).
• "Sub-processor" means any third party engaged by the Data Processor to process Personal Data on behalf of the Data Controller.
• "Data Subject" means an identified or identifiable natural person whose Personal Data is processed.
• "GDPR" means the General Data Protection Regulation (EU) 2016/679.
• "Services" means the Convocore platform, including AI chatbot services, voice AI services, conversation analytics, and related features provided by VECTOR WIZARDS LLC.

2. Subject Matter of Processing

The subject matter of the data processing under this DPA is the provision of the Convocore platform and related AI-powered communication services. Specifically, the processing relates to:

• AI Chatbot Services: Processing of text-based conversations between the Data Controller's end-users (Data Subjects) and AI-powered chatbots deployed on the Data Controller's websites, applications, or platforms.
• Voice AI Services: Processing of voice calls and audio data from conversations between Data Subjects and AI-powered voice agents, including real-time speech-to-text transcription and voice synthesis.
• Conversation Analytics: Processing of conversation data to provide analytics, insights, and reporting to the Data Controller regarding chatbot and voice agent performance.
• Integration Services: Processing of data necessary to connect the Convocore platform with third-party services authorized by the Data Controller (e.g., CRM systems, calendar integrations, email services).
• Account Management: Processing of the Data Controller's account information, team member data, and billing information.

3. Duration of Processing

The duration of data processing under this DPA is as follows:

• Active Processing Period: Processing begins upon the Data Controller's registration for the Services and continues for the duration of the service agreement between the parties.
• Conversation Data Retention: Chat logs and call recordings are retained for a maximum of 90 days (3 months) from the date of the conversation, after which they are automatically and permanently deleted from our systems.
• Analytics Data Retention: Aggregated analytics data (non-personally identifiable) may be retained for up to 12 months to provide historical reporting to the Data Controller.
• Account Data Retention: Account information is retained for the duration of the service agreement plus 30 days following termination to allow for data export.
• Inactive Account Deletion: Accounts inactive for more than 12 months will receive an email notice, and if no action is taken within 30 days, all associated data will be permanently deleted.
• Post-Termination: Upon termination of the service agreement, all Personal Data will be deleted within 30 days, unless longer retention is required by law or requested by the Data Controller for data export purposes.

4. Nature and Purpose of Processing

4.1 Nature of Processing

The nature of processing includes the following operations:

• Collection: Receiving Personal Data from Data Subjects through chat interfaces and voice calls
• Recording: Logging conversations for service provision and quality assurance
• Storage: Temporarily storing conversation data on secure servers
• Retrieval: Accessing stored data to provide conversation history to Data Controllers
• Use: Processing data through AI models to generate responses and insights
• Transmission: Transferring data to authorized third-party integrations as configured by the Data Controller
• Erasure: Automatic deletion of data according to retention schedules

4.2 Purpose of Processing

Personal Data is processed exclusively for the following purposes:

• Service Delivery: To enable the Data Controller's AI chatbots and voice agents to communicate with Data Subjects, answer queries, and perform automated tasks.
• Conversation Continuity: To maintain conversation history so that ongoing interactions have context and Data Subjects do not need to repeat information.
• Analytics and Reporting: To provide the Data Controller with insights into chatbot/voice agent performance, conversation volumes, and user satisfaction.
• Quality Improvement: To analyze conversation patterns to improve AI response quality for the Data Controller's specific use case.
• Integration Fulfillment: To execute actions in third-party systems (e.g., booking appointments, sending emails) as configured by the Data Controller.
• Technical Support: To diagnose and resolve technical issues reported by the Data Controller.

We explicitly confirm that Personal Data is NOT used for: training generalized AI/ML models, advertising, profiling, or any purpose other than providing the contracted Services.

5. Types of Personal Data Processed

The following categories of Personal Data may be processed in the course of providing the Services:

5.1 Data Controller Account Data

• Account holder name and business name
• Email addresses of account administrators and team members
• Phone numbers (for account verification and support)
• Billing information (processed by third-party payment providers)
• IP addresses and login activity
• Account preferences and settings

5.2 End-User (Data Subject) Conversation Data

Data voluntarily provided by Data Subjects during conversations:

• Names and contact information (if provided in conversation)
• Email addresses (if provided in conversation)
• Phone numbers (if provided in conversation or for voice calls)
• Conversation content and messages
• Voice recordings and transcriptions (for voice AI services)
• Any other information voluntarily shared during conversations

5.3 Technical and Usage Data

• IP addresses of Data Subjects (for security and fraud prevention)
• Browser type and device information
• Conversation timestamps and session identifiers
• Page URLs where chatbot was accessed
• Geolocation data (country/region level, derived from IP)

5.4 Integration Data

Data processed through authorized integrations may include:

• Calendar event data (titles, dates, times, attendees) for scheduling integrations
• CRM contact data (as authorized by Data Controller)
• Email metadata (for email integrations)

5.5 Special Categories of Data

Important: The Services are not designed to process special categories of data (Article 9 GDPR) such as health data, biometric data, or data revealing racial or ethnic origin. If Data Subjects voluntarily provide such data during conversations, it is the Data Controller's responsibility to ensure appropriate legal basis and safeguards are in place.

6. Categories of Data Subjects

The following categories of Data Subjects may have their Personal Data processed:

• Data Controller's Employees and Representatives:Individuals who are account administrators, team members, or authorized users of the Convocore platform.
• Data Controller's Customers:End-users who interact with AI chatbots or voice agents deployed by the Data Controller on their websites, applications, or communication channels.
• Data Controller's Prospects:Potential customers or leads who engage with the Data Controller's AI-powered communication tools.
• Website Visitors:Individuals who visit the Data Controller's website and interact with deployed chatbots.
• Callers:Individuals who call phone numbers connected to the Data Controller's voice AI agents.
• Support Contacts:Individuals seeking customer support or assistance through the Data Controller's AI channels.

7. Obligations of the Data Processor

VECTOR WIZARDS LLC, as the Data Processor, undertakes to:

• Process Personal Data only on documented instructions from the Data Controller, unless required by EU or Member State law to which the Processor is subject.
• Ensure that persons authorized to process Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
  • Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256)
  • Role-based access controls and authentication
  • Regular security assessments and penetration testing
  • Secure data centers with physical access controls
  • Employee security training and background checks
• Not engage another processor (sub-processor) without prior specific or general written authorization of the Data Controller.
• Assist the Data Controller in ensuring compliance with Articles 32-36 GDPR (security, breach notification, data protection impact assessments, and prior consultation).
• At the choice of the Data Controller, delete or return all Personal Data after the end of the provision of services, and delete existing copies unless EU or Member State law requires storage.
• Make available to the Data Controller all information necessary to demonstrate compliance with Article 28 GDPR obligations and allow for and contribute to audits.
• Immediately inform the Data Controller if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions.

8. Obligations of the Data Controller

The Data Controller undertakes to:

• Ensure that all processing instructions given to the Data Processor comply with applicable data protection laws.
• Provide appropriate notice to Data Subjects regarding the processing of their Personal Data through AI chatbots and voice agents.
• Obtain any necessary consents from Data Subjects where required by applicable law.
• Respond to Data Subject requests (access, rectification, erasure, etc.) with assistance from the Data Processor as needed.
• Ensure that special categories of data are not collected through the Services without appropriate legal basis and safeguards.

9. Sub-processors

The Data Controller provides general authorization for the Data Processor to engage sub-processors for the provision of the Services. The current list of sub-processors includes:

The Data Processor will inform the Data Controller of any intended changes concerning the addition or replacement of sub-processors, thereby giving the Data Controller the opportunity to object to such changes. The Data Controller may subscribe to sub-processor update notifications by contactingmoe@vectorwizards.com or moe@convocore.app.

10. International Data Transfers

For Data Controllers using the EU region (Frankfurt, Germany):

• Primary data storage and processing occurs within the European Union.
• Where transfers to sub-processors outside the EU are necessary (e.g., AI model providers), appropriate safeguards are in place, including:
  • EU-U.S. Data Privacy Framework (for certified US companies)
  • Standard Contractual Clauses (SCCs) adopted by the European Commission
  • Supplementary measures as required by the Schrems II decision

11. Data Breach Notification

In the event of a Personal Data breach, the Data Processor will:

• Notify the Data Controller without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data breach.
• Provide the Data Controller with sufficient information to allow the Data Controller to meet any obligations to report or inform Data Subjects of the breach.
• Cooperate with the Data Controller and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of each Personal Data breach.

12. Data Subject Rights

The Data Processor will assist the Data Controller in responding to requests from Data Subjects to exercise their rights under the GDPR, including:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)

Data Subjects may also use our self-service GDPR portal at /legal/gdpr to request deletion of their data.

13. Audits and Compliance Verification

The Data Processor will make available to the Data Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR. This includes:

• Providing documentation of security measures and data protection policies upon request.
• Allowing for and contributing to audits, including inspections, conducted by the Data Controller or another auditor mandated by the Data Controller (subject to reasonable advance notice and confidentiality requirements).
• Providing copies of relevant third-party audit reports or certifications upon request.

14. Termination and Data Return

Upon termination of the Services:

• The Data Controller may request export of their data in a commonly used, machine-readable format within 30 days of termination.
• Following the 30-day period (or immediately upon request), the Data Processor will delete all Personal Data unless retention is required by applicable law.
• The Data Processor will provide written confirmation of data deletion upon request.

15. Contact Information

For questions regarding this DPA or to exercise any rights hereunder, please contact:

© 2024 VECTOR WIZARDS LLC. All rights reserved.