Data processing agreement

This is a translation for information purposes. If there is any discrepancy, the Spanish version prevails.

Parties

• The Controller: the Client that accepts this agreement, identified by the company name, tax ID and address of its NexareIA account, through the person with write permission who accepts it on its behalf and declares that they are authorised to do so.
• The Processor: ENE UVE Corp SL, trading as NexareIA, with tax ID (NIF) B19849959 and address at Pasaje Terracota, Edificio GYESA Isla 2, no. 8, 41703 Dos Hermanas (Seville), Spain, represented by Mr Juan Ignacio Vázquez Lara, director.

Both parties enter into this data processing agreement, which forms part of the NexareIA service contract signed between them («the Main Contract»).

1. Purpose

The Processor will process on behalf of the Controller the personal data necessary to provide the artificial intelligence voice assistant service described in the Main Contract («the Service»).

2. Term

This agreement lasts as long as the Main Contract. The obligations of confidentiality, return and deletion remain in force afterwards for as long as necessary to fulfil them.

3. Nature and purpose of the processing

The processing consists of: receiving and making calls on behalf of the Controller; converting speech into text; generating answers with language models and turning them into speech; checking and recording appointments in the Controller's calendar; transferring calls; generating summaries and transcripts; keeping them in the Service dashboard; sending them to the Controller; keeping in the dashboard the Controller's contact book and opportunities (leads), with the data left by the calls or provided by the Controller; and making the outbound call campaigns that the Controller sets up, with its contact lists, the outcome of each call and its exclusion list («Do not call»).

The operations are: collection, recording, structuring, storage, consultation, communication to the Controller, erasure and destruction.

4. Data and data subjects

Data subjects: customers and prospective customers of the Controller who call or receive calls from the Assistant, and members of its team to whom calls are transferred.

Types of data:

• Identification and contact data: name, phone number, email address and postal address.
• Call content: transcript, summary and, if the Controller enables it, audio recording.
• Data about the request: reason for the call, appointment, service or order.
• Metadata: date, time, duration and outcome of the call.
• Contact book and opportunities: contacts (name, phone number, email address, company and the data the Controller decides to keep), whether the data subject has given permission to receive calls and how, and the opportunities (leads) with their status and summary.
• Outbound campaigns: contact lists, the legal basis of each contact, the outcome of each call and the exclusion list («Do not call»).

Special categories: not processed. The Assistant is configured not to ask for health data or other special categories. Health data will only be processed if the parties sign Annex IV.

5. Processor's obligations

The Processor undertakes to:

1. Process the data only to provide the Service and following the Controller's documented instructions, which are those of this agreement, the Main Contract and the Assistant configuration approved by the Controller. If it considers that an instruction infringes the law, it will inform the Controller immediately.
2. Not use the data for its own purposes or to train artificial intelligence models, and require the same of its sub-processors.
3. Ensure that persons authorised to process the data have committed themselves to confidentiality.
4. Apply the security measures in Annex II, appropriate to the risk in accordance with article 32 GDPR.
5. Configure the Assistant to tell each data subject, at the start of the call, that they are speaking with an artificial intelligence assistant, with the wording provided or approved by the Controller.
6. Help the Controller respond to data subjects' rights. If a data subject exercises their rights before the Processor, it will forward the request to the Controller within 5 working days at most.
7. Help the Controller comply with its obligations regarding security, breach notification, impact assessment and prior consultation, with the information available to it.
8. Keep the record of processing activities as processor (art. 30.2 GDPR).
9. Make available to the Controller the information necessary to demonstrate compliance with this agreement and allow audits, with at least 15 days' notice and without affecting the security of other clients.

6. Security breaches

The Processor will notify the Controller of any personal data breach without undue delay and, at the latest, within 48 hours of becoming aware of it. The notification will include, as far as known: what happened, the data and approximate data subjects affected, the likely consequences, the measures taken or proposed, and a contact.

Notifying the supervisory authority and the data subjects is the Controller's responsibility.

7. Sub-processors

The Controller authorises the Processor to use the sub-processors in Annex I. The Processor will notify by email at least 15 days in advance of any addition or replacement. The Controller may object on reasonable data protection grounds within that period; if no solution is found, it may terminate the Main Contract without penalty.

The Processor will impose on each sub-processor, by contract, the same data protection obligations it assumes in this agreement, and will be liable to the Controller for their compliance.

8. International transfers

The Processor will only transfer data outside the European Economic Area to the sub-processors in Annex I and with a valid safeguard under Chapter V GDPR: an adequacy decision, such as the EU-US Data Privacy Framework for certified entities, or the European Commission's standard contractual clauses. Whenever the provider allows it, it will choose processing in the EU.

9. Controller's obligations

The Controller undertakes to:

1. Have a legal basis for the processing and for each outbound call.
2. Inform data subjects in accordance with articles 13 and 14 GDPR, in its privacy policy and in the Assistant's opening message.
3. Provide the Processor only with the necessary data and give instructions that comply with the law.
4. Carry out, where appropriate, the impact assessment and supervise the processing.

10. End of the processing

When the Main Contract ends, the Processor will make the data available to the Controller for download for 30 days. It will then delete it, including at its sub-processors, and certify this in writing on request. Backups will be deleted in their ordinary cycle, within 90 days at most. It will only keep blocked data where a law requires it.

11. Liability

Each party is liable for its breaches in accordance with article 82 GDPR. If the Processor processes the data for its own purposes or breaches the instructions, it will be considered a controller of that processing (art. 28.10 GDPR). Otherwise, the liability regime of the Main Contract applies.

12. Applicable law

This agreement is governed by the GDPR, the LOPDGDD and other Spanish law, and by the dispute resolution clauses of the Main Contract.

Acceptance

This agreement is accepted electronically from the NexareIA dashboard. The Processor keeps the record of the acceptance: version and fingerprint of the text, client, person who accepts it, date and time, IP address and browser. At the Controller's request, the Processor will send it a signed copy.

Annex I. Authorised sub-processors

The telephony, voice and language model providers are sub-processors of the voice agent platform, which imposes the same data protection obligations on them. The Processor will give the Controller, on request, the up-to-date list with the name, location and safeguard of each one, and will notify it of any change in accordance with section 7.

Annex II. Security measures

• Encryption: encrypted connections (TLS) on all services and encryption of stored data.
• Access: access only for staff who need it, with personal accounts, two-factor authentication and access logs.
• Separation: each client's data is logically separated and only visible in its dashboard.
• Minimisation: the Assistant only asks for the data necessary for the request and does not ask for special categories unless Annex IV is signed.
• Retention: automatic deletion according to the periods in Annex III.
• Providers: only providers with a processing agreement, proven security measures and the option to use data for training disabled.
• Backups and continuity: encrypted backups and a recovery procedure.
• Incidents: breach management and notification procedure.
• Review: review of the measures at least once a year and whenever the Service changes.

Annex III. Default retention periods

The Controller may ask for shorter periods. Longer periods require its written instruction.

The voice platform stores each call's recording, transcript and summary together, and they are deleted at the same time. Deletion takes place in the days after the period ends, once the usage of the call's month has been closed.

Annex IV. Health data (only for clinics and healthcare centres)

This annex only applies if both parties sign it.

1. The Controller authorises the Processor to process the health data strictly necessary to manage appointments: the type of consultation or treatment the patient requests, expressed in general terms. The Assistant does not ask about symptoms, diagnoses, medical history or medication.
2. The Controller declares that it has a legal basis for that processing (art. 9.2.h GDPR), that it has assessed the risk and, where appropriate, has carried out the impact assessment and has a data protection officer.
3. Additional measures: audio recording is disabled; calls (transcript and summary) are deleted after 30 days; dashboard access is limited to the persons designated by the Controller; and data is processed in the EU whenever the providers allow it.
4. If, during a call, the data subject gives more health information than necessary, the summary will only include what is strictly necessary for the appointment.
5. The contact book and the opportunities only keep the patient's name, phone number and email address; the opportunity is recorded as «Appointment request», without data or summary.

Annex IV is not accepted from the dashboard: it requires the signature of both parties separately.