Data processing agreement (model)

The client is the controller. Digital Leadership SRL (GENERATIVA), tax ID 38585123, EUID ROONRC.J2017006715126, is the processor and processes data on behalf of the client, for the contracted service. Contact for data protection: dpo@generativa.ro.

The subject matter of this agreement is the operation of the client's virtual assistant on the channels set out in the contract (phone, chat and, when activated, WhatsApp): speech transcription, generating replies, taking requests, handing over to people, notifying the client's team and making conversations available to the client in the admin platform. The duration is that of the contract, plus the return and deletion period in point 10. We process the data only for this purpose and do not use it to train any model.

Data subjects: people who call, chat or write on WhatsApp to the client, and members of the client's team who receive handovers and notifications. Categories of data: identification and contact data (name, phone, including the caller's number, email); conversation content (the voice, processed in real time for transcription, without keeping the audio; the transcript, the summary, the request record); metadata (date, time, duration, channel, handover status). Special categories of data (Article 9 GDPR): for clinics, the client may ask the assistant to process health data. The client remains the controller of this data and is responsible for the legal basis of the processing; we process it only on the client's instructions, under the terms of the contract.

We process data only on the client's written instructions. The contract and this agreement constitute the initial instructions. If we consider that an instruction infringes the GDPR, we inform the client immediately.

We process data only within the limits of this agreement, including with regard to transfers. Persons with access to the data have committed themselves to confidentiality and have access only to the data they need. We apply the measures in point 8 and follow the rules in point 6 on sub-processors. We assist the client in responding to data subject requests and in meeting its obligations under Articles 32-36 GDPR. At the end, we delete or return the data, as the client chooses (point 10). We make available to the client the information needed to demonstrate compliance with Article 28 GDPR and allow the audits in point 11. We keep a record of the processing activities carried out on behalf of the client (Article 30(2) GDPR).

The client gives us a general authorisation to engage sub-processors. We have a written agreement with each sub-processor, with equivalent data protection obligations, and we remain liable to the client. The named list is included in the annex to the signed agreement, and the categories are public. Before we add or replace a sub-processor, we notify the client directly, by email, at least 30 days in advance. The client may object, on data protection grounds; if we find no solution, the client may terminate the contract without penalty, from the date on which the new provider would have started processing.

Processing takes place mainly in the EU. The exceptions, by category: speech recognition and synthesis (dedicated EU endpoint, US provider; safeguards: standard contractual clauses and a transfer impact assessment); WhatsApp messages, when the channel is activated (WhatsApp Business platform: standard contractual clauses; sending through the telephony provider, from the US: binding corporate rules and standard contractual clauses). The supporting documents are sent to the client on request.

Two-step sign-in is available for every account. An access log shows which member of our team opened a conversation and when; the log is kept for 12 months. Data is deleted automatically at the periods in point 10, through a daily check.

If a data subject contacts us directly, we refer them to the client and inform the client. At the client's request, we provide the data needed for a reply or carry out the rectification or erasure. We notify the client of any breach of the security of data processed on its behalf without undue delay and within 48 hours of becoming aware of it, providing the information required by Article 33(3) GDPR as it becomes available, so that the client can notify the supervisory authority within 72 hours.

Standard retention periods: call transcripts and summaries, 12 months from the call (the call record remains without content, for statistical purposes); the caller's number, 12 months; the transcript and personal data in written conversations, 12 months (anonymised); records left with the assistant (requests, call-back contacts), 24 months (deleted). The assistants do not keep call audio. The contract may set other periods. The client may request at any time the early deletion of a conversation or record. The platform export. The client's account includes an export function that downloads a JSON file with: the account details; the call log (for each call: the identifier, the caller's number, the summary, the outcome, the duration, the cost and the date), without the call transcripts; the appointments; the records left with the assistant; the written conversations (chat and WhatsApp), with their transcripts. The export covers up to 10,000 rows per category. When the contract ends, on request, we provide the client with the call transcripts separately, in a common format, and then delete the data processed on its behalf, including at sub-processors, except data the law requires us to keep. On request, we confirm the deletion in writing.

The client can verify compliance with this agreement on the basis of the documents we make available (description of the measures, the list of sub-processors and our agreements with them, provider reports and certifications). If the documents are not sufficient, the client may carry out an audit, itself or through an independent auditor bound by confidentiality, at most once a year, with 15 working days' prior notice and without affecting the security of other clients. The cost of the audit is borne by the party requesting it, unless the audit finds significant breaches on our part.

The client is responsible for the lawfulness of the processing: the legal basis, informing data subjects (its own privacy policy and the assistant's greeting), the record of processing activities, the instructions it gives us, its team's access to the platform and to notifications, and responses to data subject requests. We provide the client with the greeting text, which includes the disclosure that the assistant is powered by artificial intelligence.

The liability of the parties is governed by the service contract, without prejudice to liability towards data subjects under Article 82 GDPR. This agreement has effect for the duration of the contract and until the return and deletion in point 10 are complete. This agreement is governed by Romanian law.