Vavus Concierge Data Processing Agreement

This Data Processing Agreement ("DPA") is between DCI Brands LLC ("Vavus", "we", the processor), 312 W 2nd Street, Casper, WY 82601, United States, and the business operating a Vavus Concierge workspace (the tenant, the controller). It applies to visitor data that Vavus processes on the tenant's instruction through the Concierge service: the console, the website widget, hosted agent pages, phone and message channels, and bookings.

It is a supplement to the Vavus Concierge Terms of Service, which the tenant accepts together with this DPA. Where this DPA conflicts with the Concierge Terms on the processing of visitor data, this DPA controls. It is written to satisfy Article 28 of the GDPR and of the UK GDPR, Article 9 of the Swiss Federal Act on Data Protection (FADP), and comparable processor commitments elsewhere; where local law imposes stricter processor obligations, those prevail for processing in that jurisdiction. Annex IV applies in addition where a United States state privacy law governs the tenant's visitor data.

The tenant is the controller of visitor data: it decides what the assistant does, what knowledge it holds, which channels operate, and what is asked of visitors. Vavus is the processor: we act only on the tenant's instruction through the console and the service's normal operation, and process visitor data solely to provide Concierge.

We will immediately inform the tenant if, in our opinion, an instruction infringes applicable data protection law, and we will not act on a plainly unlawful instruction. If law requires processing outside the documented instructions, we will inform the tenant before that processing unless the law prohibits doing so. We do not process visitor data for our own purposes, and we do not use it to train our models or sell it.

This DPA, including the transfer terms in Sections 7 and 13 to 15, covers a tenant that is the controller of its visitor data. It does not cover a tenant that processes the data on behalf of another controller, because it does not offer Module Three (processor to processor) of the Clauses; such a business may not accept it for that data.

The tenant is responsible for the lawfulness of what it asks us to do. It confirms that it has a lawful basis for the processing, including under Articles 6, 9, and 10 of the GDPR where they apply; that it has given visitors the notices Articles 12 to 14 require and has obtained any consent the law requires, including for recording or translating a call; and that its instructions comply with data protection law. Unless the workspace is configured for healthcare, the tenant will not direct into the service visitor data that includes government identification numbers, payment card numbers, financial account credentials, passwords to other services, biometric data, data knowingly collected from children under 16, or special categories of data such as health, racial or ethnic origin, political opinions, religion, or sexual orientation, and it will remove any that arrives by accident. The tenant keeps its console credentials secure, decides who on its team has access, keeps its own copy of anything it cannot afford to lose, and confirms that it has reviewed the measures in Section 5 and Annex II and finds them adequate for the data it processes through Concierge.

Categories of visitor data, as the tenant's configuration collects them: identifiers the visitor provides (name, phone number, email address), conversation content (messages, voice audio, transcripts, and any recordings the tenant operates), contact and booking records the assistant creates on the visitor's actions, technical session data (timestamps, channel, language), and personal data contained in material the tenant uploads to the assistant's knowledge or in voice samples the tenant provides to create a custom voice.

Data subjects are the tenant's visitors, customers, prospective customers, and staff whose information is provided to the service. Processing includes collection, transmission, organisation, storage, retrieval, translation, generation of replies, disclosure to authorised staff and connected providers, and deletion. Purpose: providing Concierge on the tenant's instructions. Duration follows the applicable retention settings and Section 9, rather than automatically lasting for the entire life of the workspace.

Only personnel who need access to operate or secure the service have it, under confidentiality obligations, and access is logged for healthcare-configured workspaces. We do not place visitor content in analytics payloads, support chats, or public trackers.

The service runs on our own infrastructure under the measures described on our Security page: TLS in transit, encryption at rest, least-privilege access, audit logging, secure deletion for files past their retention, and hardened endpoints behind a web application firewall. Recordings are held in access-controlled object storage; console access is authenticated and role-scoped. We may update these measures as technology and threats change, provided the overall protection of visitor data does not materially decrease.

We engage subprocessors by function: cloud hosting and storage (Google Cloud); speech recognition, speech synthesis, translation, and AI models (Google, OpenAI, Anthropic, ElevenLabs, and AssemblyAI); semantic routing of conversation turns, where the workspace enables it (TypeSafe); telephony and text messages for phone numbers we supply to the tenant (Twilio); payments for the tenant's own plan and usage (Stripe); email delivery (Resend, plus our self-hosted Postal server on our own infrastructure); and - where the tenant connects telephony, messaging, payment, booking, or business systems - the tenant's own providers (such as its own Twilio account, WhatsApp's provider, its own Stripe account, its calendar, or its CRM), which the tenant engages directly under its own authority. Annex III names each subprocessor and its function.

The tenant gives general written authorisation for the subprocessors identified in the current list supplied for its service. We impose data protection obligations equivalent to those in this DPA on each subprocessor under a written agreement and remain responsible to the tenant for its performance. Visitor content must not be used for model training without a separate lawful instruction and contractual basis. The current named list is Annex III and is also available on request, and we give the tenant at least 30 days' notice in the console or by email before a new subprocessor handles visitor data, during which the tenant may object on reasonable data-protection grounds. We then work with the tenant in good faith to resolve the objection; if we cannot, the tenant may terminate the workspace before the new subprocessor handles its data, and that is the sole remedy for the objection. Fees already due stay payable, and any refund follows the Concierge Terms.

The service operates in the United States and, for lower latency, an edge in the European Union (Frankfurt). Visitor data may therefore be processed in either region as the session routing requires. Before a restricted international transfer takes place, the parties must establish the applicable lawful transfer mechanism and document the destinations and safeguards. Where Standard Contractual Clauses are used, the applicable clauses, module, options and completed annexes must form part of the transfer agreement.

For transfers of visitor data to us in the United States, this DPA is that transfer agreement, and the tenant relies on it without a separate signature: for transfers governed by the GDPR (from the European Economic Area), the Clauses as set out in Section 13 and its annexes; for transfers governed by UK data protection law, the Clauses together with the UK International Data Transfer Addendum as set out in Section 14; and for transfers governed by the Swiss FADP, the Clauses with the Swiss adaptations in Section 15. Each applies to every transfer that its law governs, whatever answer the tenant gave in the console about UK or Swiss data. Where more than one of these laws governs the same transfer, each set of terms applies to the extent of its own law, and none reduces the protection another gives.

Transfers governed by the transfer rules of any other country need the mechanism that law requires; contact us before enabling processing that requires one. We are not certified under the EU-US Data Privacy Framework, its UK Extension, or the Swiss-US Data Privacy Framework, and no transfer under this DPA relies on them.

Visitors are the tenant's customers: requests from a visitor about their data (access, correction, deletion, objection) go to the tenant as controller, and the tenant answers them using the console's per-contact deletion. Taking account of the nature of processing, we assist through appropriate technical and organisational measures with requests under Chapter III of the GDPR and the equivalent rights under the UK GDPR and the FADP. Taking account of the information available to us, we also assist with security, breach notifications, data protection impact assessments and prior consultation with supervisory authorities under Articles 32 to 36 of the GDPR and the equivalent provisions of the UK GDPR and the FADP. Assistance that goes beyond what the service already provides, such as compiling records for a data protection impact assessment, may be charged at our then-current professional services rates, quoted to the tenant in advance.

If we become aware of a security incident affecting visitor data in a workspace, we notify the tenant without undue delay after becoming aware of a personal data breach. We do not wait for a completed investigation or treat the controller's regulatory reporting deadline as our notification period. We provide the available details of the breach, affected data and people, likely consequences, contact point and mitigation, and provide further information in phases as it becomes available. The tenant handles any notification to its own visitors or to regulators, as controller.

Unsuccessful attempts that do not compromise visitor data, such as blocked sign-in attempts, scans, or pings, are not incidents and are not reported. A notice is not an admission of fault or liability. Where the law allows, the tenant tells us before it names Vavus in a notice about an incident to a regulator, to visitors, or to the public, and considers in good faith any correction we ask for about our part in it.

Workspace deletion removes the workspace's configuration and conversation material, including recordings from object storage, subject to encrypted backups aging out under our lifecycle policy and records the law requires us to keep (billing records for the statutory tax period). Per-contact deletion removes that contact's conversation material. At the tenant's choice on termination, we return its remaining personal data in a usable format or delete it, and delete existing copies unless applicable law requires retention. A return request must precede an irreversible deletion instruction. Retained backup copies remain protected, are not used for ordinary processing, and are deleted under the applicable documented lifecycle; if restored, deletion instructions must be reapplied.

If the tenant gives no instruction within 30 days after the workspace ends, we delete the remaining personal data. We confirm deletion in writing on request.

We make available the information necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by the tenant or an independent auditor it mandates. These rights are available to every tenant and are not conditional on an enterprise subscription.

Audits start with documents. On request we provide our security documentation, the measures in Annex II, and answers to a reasonable security questionnaire, and where a recent report by an independent auditor covers the controls in question we provide that report instead of a new audit of them. Where documents are genuinely insufficient, after a confirmed breach affecting the tenant's data, or where a supervisory authority requires it, the tenant may inspect: once in any 12 months unless a breach or a regulator requires more, on 30 days' written notice with a proposed scope, during business hours, under a confidentiality agreement, without access to other customers' data, and using an auditor who is not our competitor. Audits are at the tenant's cost, and the tenant shares its findings with us. None of this prevents an inspection that a regulator lawfully requires.

This DPA runs while the tenant's workspace exists and ends when the workspace is deleted, and its data protection obligations continue for as long as we or our subprocessors retain visitor personal data. The Concierge Terms' dispute, liability, and governing-law provisions apply only to the extent they do not restrict mandatory data protection rights, regulatory powers, or an applicable transfer agreement; that agreement prevails in a conflict.

Data protection matters, subprocessor lists, the Standard Contractual Clauses, the UK Addendum, and the Swiss adaptations: support@vavusai.com.

For transfers of visitor personal data from the European Economic Area to us in the United States, this DPA incorporates the standard contractual clauses for the transfer of personal data to third countries adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "Clauses"), Module Two (controller to processor), completed by the annexes that follow. For transfers governed by the GDPR the Clauses are incorporated without amendment; Sections 14 and 15 set out how the same Clauses apply to transfers governed by UK and Swiss law. They are executed through the tenant's recorded acceptance of the Concierge Terms together with this DPA: the version and timestamp the service records of that acceptance, together with our publication of this DPA at that version, constitute the parties' written agreement to the Clauses, so no separate signature is needed.

The Clauses' options are exercised as follows. The optional docking clause (Clause 7) is not used. Clause 9(a) operates under its general written authorisation option: Section 6's subprocessor regime is the agreed authorisation, and its 30 days' advance notice fills the clause's notice period. The optional independent dispute-resolution body in Clause 11(a) is not offered. The competent supervisory authority under Clause 13 is determined by the criteria of Clause 13(a), as set out in Annex I.C. Under Clause 17 the Clauses are governed by the law of the member state in which the tenant is established, or, where the tenant is not established in a member state or that law would not allow third-party beneficiary rights, the law of Ireland; under Clause 18(b) the courts of that member state, or in that case the courts of Ireland, have jurisdiction, and under Clause 18(c) a data subject may also bring proceedings in the member state of habitual residence. In the Clauses as they apply under this Section, member states include the states of the European Economic Area that are not members of the European Union.

Where the Clauses and this DPA conflict, the Clauses prevail to the extent of the conflict, consistent with Section 11. Under Clause 8.3 (Module Two) the tenant makes the Clauses, including these annexes, available to a data subject who asks; we supply the text on request to make that possible.

For transfers of visitor personal data to which UK data protection law applies (Restricted Transfers under the UK GDPR), this DPA incorporates the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018, version B1.0 in force 21 March 2022 (the "Addendum"), completed by the tables in this Section. It applies to every such transfer, whatever answer the tenant gave in the console about UK data. As Section 2 of the Addendum permits, the parties enter into it through the tenant's recorded acceptance of this DPA at this version and our publication of this DPA at this version, which make it legally binding on both parties and allow data subjects to enforce their rights under it; no separate signature is needed.

Table 1 - Parties. Start date: the date the console records the tenant's acceptance of this version. Exporter: the tenant, with the full legal name, trading name, main address, official registration number, and key contact (the accepting person's name and role, and the business privacy contact email) recorded with its acceptance in the console. Importer: DCI Brands LLC, trading as Vavus; main address 312 W 2nd Street, Casper, WY 82601, United States; official registration number: Wyoming Secretary of State filing ID 2017-000762309; key contact: Dragos Ignat, Owner and Founder, support@vavusai.com. Signature: not required, as set out above.

Table 2 - Selected SCCs, modules and selected clauses. The Approved EU SCCs, including the Appendix Information, with only the following modules, clauses, and optional provisions brought into effect for the purposes of the Addendum: Module 2 (controller to processor) is in operation, and Modules 1, 3, and 4 are not; Clause 7 (docking clause) is not used; the Clause 11 option (independent dispute resolution body) is not used; Clause 9(a) operates under general written authorisation, with a time period of 30 days' prior notice.

Table 3 - Appendix Information. Annex 1A (List of Parties): Annex I.A of this DPA. Annex 1B (Description of Transfer): Annex I.B of this DPA. Annex II (technical and organisational measures, including those to ensure the security of the data): Annex II of this DPA. Annex III (List of Sub processors): Annex III of this DPA.

Table 4 - Ending this Addendum when the Approved Addendum changes. Which parties may end this Addendum as set out in Section 19 of the Addendum: neither party. When the Information Commissioner issues a revised Approved Addendum under Section 18 of the Addendum, this Addendum is amended as the revision specifies from the start date it sets.

Mandatory Clauses: Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses. Under those Mandatory Clauses the Addendum is governed by the laws of England and Wales, disputes are resolved by the courts of England and Wales, a data subject may also bring proceedings against either party in the courts of any country in the UK, and the Information Commissioner is the supervisory authority. We supply the text of the Addendum on request.

UK transfer risk assessment. For the transfer to us in the United States, the tenant as exporter relies, for the assessment of United States law and practice on public-authority access to personal data and of the enforceability of the Addendum, on the UK Government's analysis of the relevant United States laws and practices prepared by the Department for Science, Innovation and Technology, as the Information Commissioner's guidance on completing a transfer risk assessment for transfers to the United States permits, including for a recipient that is not certified under the UK Extension to the EU-US Data Privacy Framework. On that analysis, the protection for the transferred data, with the Addendum in place, is not materially lower than under UK data protection law. We are not certified under that framework, and this assessment does not rely on certification. The transfer it covers is the one described in Annex I.B, with the onward transfers in Annex III and the safeguards in Annex II and the transfer impact assessment summary. We will tell the tenant without undue delay if the UK Government withdraws or materially changes that analysis or if we can no longer comply with the Addendum, and the parties will then review this assessment.

For transfers of visitor personal data to which the Swiss Federal Act on Data Protection of 25 September 2020 (FADP) applies, the Clauses as incorporated in Section 13 apply as standard data protection clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) under Article 16(2)(d) FADP, with the adaptations below. They apply to every such transfer, whatever answer the tenant gave in the console about Swiss data. Where a transfer is governed by both the FADP and the GDPR, the parties keep separate arrangements: these adaptations apply only to the extent the FADP governs the transfer, and Section 13 continues to apply without amendment to the extent the GDPR governs it.

• References to Regulation (EU) 2016/679 are to be understood as references to the FADP, insofar as the transfer is subject to the FADP.
• The FDPIC is the competent supervisory authority under Clause 13 and Annex I.C for transfers governed by the FADP; where the GDPR also governs a transfer, the authority determined under Clause 13(a) remains competent for that part, in parallel.
• For transfers governed only by the FADP, the Clauses are governed by Swiss law under Clause 17, and disputes between the parties under Clause 18(b) are resolved by the courts of Switzerland at the tenant's registered office.
• The term "member state" in the Clauses must not be interpreted in a way that excludes data subjects in Switzerland from bringing claims for their rights in their place of habitual residence, Switzerland, under Clause 18(c).
• The transfer impact assessment summary applies to these transfers, read with reference to the FADP. We are not certified under the Swiss-US Data Privacy Framework, so the Federal Council's recognition of the United States for certified companies does not cover transfers to us. The FADP does not require the use of these clauses to be notified to the FDPIC.

Data exporter: the tenant, the controller of the visitor data, established in the country recorded for the workspace in the console, which may be a member state of the European Economic Area, the United Kingdom, Switzerland, or another country; where a tenant established elsewhere is subject to the GDPR, UK data protection law, or the FADP for its processing of visitor data, it is the data exporter for the transfers that law governs. Its activities relevant to the transfer are operating its business and directing the Concierge workspace through the console. Its full legal name, trading name, address, registration number, privacy contact email, and the name and role of the person who accepted for it are those recorded with its acceptance in the console. Role: controller.

Data importer: DCI Brands LLC ("Vavus", the processor), 312 W 2nd Street, Casper, WY 82601, United States (Wyoming Secretary of State filing ID 2017-000762309); activities relevant to the transfer: providing the Concierge service under this DPA; contact for data protection matters: support@vavusai.com. Role: processor.

Signature and date: for the data exporter, its acceptance of this DPA recorded in the console (version, date and time, and the accepting person); for the data importer, our publication of this DPA at this version, as Section 13 provides.

Categories of data subjects: the tenant's visitors, customers, prospective customers, and staff whose information is provided to the service.

Categories of personal data: identifiers the visitor provides (name, phone number, email address), conversation content (messages, voice audio, transcripts, and any recordings the tenant operates), contact and booking records the assistant creates on the visitor's actions, technical session data (timestamps, channel, language), and personal data contained in material the tenant uploads to the assistant's knowledge or in voice samples the tenant provides to create a custom voice.

Sensitive data: the service does not collect special-category data as a matter of course. Where a tenant's configuration makes health information foreseeable (healthcare-configured workspaces), access is restricted to personnel who need it and logged, and the tenant remains responsible for ensuring its collection rests on the tenant's own lawful basis and instructions.

Frequency and duration: continuous, for the life of the workspace, as sessions, bookings, and console use occur; retention follows Sections 3 and 9. Nature and purpose: collection, transmission, organisation, storage, retrieval, translation, generation of replies, disclosure to authorised staff and to the sub-processors in Annex III, and deletion, to provide Concierge on the tenant's instructions. Onward transfers are limited to Clause 9, Section 6, and the list in Annex III.

For transfers governed by the GDPR, the competent supervisory authority is determined by Clause 13(a): where the tenant (as data exporter) is established in a member state, the supervisory authority responsible for ensuring the tenant's compliance with the GDPR as regards the transfer; where the tenant is not established in a member state but falls within Article 3(2) of the GDPR and has appointed a representative under Article 27(1), the supervisory authority of the member state in which that representative is established; and where the tenant is not established in a member state, falls within Article 3(2), and is not required to appoint a representative under Article 27(2), the supervisory authority of one of the member states in which the data subjects whose personal data is transferred in relation to the offering of goods or services to them, or whose behaviour is monitored, are located.

For transfers governed by UK data protection law, the Information Commissioner, as Section 14 provides. For transfers governed by the FADP, the Federal Data Protection and Information Commissioner, as Section 15 provides, in parallel with the authority above where the GDPR also governs the transfer.

The measures the data importer applies to safeguard the data, as described in Sections 4, 5, 8, and 9 of this DPA:

• TLS for data in transit and encryption at rest across the service
• Least-privilege, role-scoped access through the authenticated console; personnel bound by confidentiality obligations
• Access logging for healthcare-configured workspaces and audit logging of administrative actions
• Recordings held in access-controlled object storage
• Secure deletion of files past their retention; encrypted backups under a documented lifecycle
• Encrypted hourly backups, with restore checks, for continuity and recovery
• Monitoring of the service's software and dependencies for vulnerabilities, with patching
• Changes shipped through version control and a scripted deploy with health checks and rollback
• Passwords stored only as salted hashes; accounts locked after repeated failed sign-ins
• Physical security of the data centres provided by Google Cloud under its certifications
• Hardened endpoints behind a web application firewall with rate limiting
• Notification of personal data breaches to the tenant without undue delay after becoming aware, with details and follow-up in phases
• Assistance with data subject requests and with the tenant's obligations under Articles 32 to 36 of the GDPR and the equivalent provisions of the UK GDPR and the FADP
• Written sub-processor contracts carrying, in substance, the same data protection obligations as this DPA

The sub-processors authorised under Clause 9(a) (general written authorisation) and Section 6, by function. Changes follow Section 6's notice and objection terms.

Providers the tenant connects itself - its own telephony or messaging accounts (such as its own Twilio account or WhatsApp's provider), its own Stripe account for payments it takes from its customers, and the calendar, CRM, ticketing, or store systems it connects - are engaged by the tenant directly under its own authority and are not our sub-processors.

• Google Cloud - cloud hosting and storage (United States primary region, EU edge in Frankfurt)
• Google - speech recognition, speech synthesis, translation, and AI models
• OpenAI - AI models, speech recognition, and speech synthesis
• Anthropic - AI models
• ElevenLabs - speech recognition, speech synthesis, and custom voices (not used for healthcare-configured workspaces)
• AssemblyAI - speech recognition, where the workspace's speech setting uses it
• TypeSafe - semantic routing of conversation turns, where the workspace's assistant settings enable it
• Twilio - telephony and text messages for phone numbers we supply to the tenant
• Stripe - payments for the tenant's own Concierge plan and usage
• Resend - email delivery
• Self-hosted Postal on our own infrastructure - email delivery

Where the California Consumer Privacy Act or another United States state privacy law applies to visitor data, the tenant is the business or controller and Vavus is its service provider, contractor, or processor, and the words in this Annex have the meanings those laws give them. The tenant discloses visitor data to us only for the limited and specified purpose of providing Concierge as this DPA and the Concierge Terms describe.

We will: process visitor data only for that purpose and on the tenant's instructions, and never sell or share it; not retain, use, or disclose it for any other purpose, including any commercial purpose, or outside our direct business relationship with the tenant; not combine it with personal information we receive from anyone else or collect ourselves, except as those laws permit in order to provide the service; comply with the obligations those laws place on service providers and give visitor data the same level of privacy protection they require; tell the tenant in writing if we decide we can no longer meet those obligations; allow the tenant to take reasonable and appropriate steps to check that we use visitor data consistently with its own obligations, including through Section 10, and to stop and remedy any unauthorized use; and give the tenant notice of new subprocessors under Section 6, which satisfies the notice those laws require. We certify that we understand these restrictions and will comply with them.

Requests from visitors under those laws go to the tenant, and we assist as Section 8 describes.

United States law permits public authorities to compel disclosure of personal data held by service providers in defined circumstances (notably Section 702 of FISA and Executive Order 12333). Before agreeing to these Clauses we assessed the transfer against those laws and practices as Clause 14 requires, taking into account the specific circumstances of the transfer: business-support data (identifiers, conversation content, booking records, technical session data), a short processing chain (the tenant, us, and the sub-processors in Annex III), our assessment that in providing Concierge we do not act as an electronic communication service provider for this traffic, and the contractual, technical, and organisational safeguards in place. We keep that assessment under review, document it, and make it available to the competent supervisory authority on request.

Supplementary measures: the technical and organisational measures in Annex II, minimisation through tenant-configured collection, the audit rights in Section 10, and the obligations we accept under Clauses 14 and 15 - to notify the tenant of a legally binding disclosure request where the law permits, to seek a waiver of any notification prohibition and provide aggregate information at regular intervals, to review the legality of a request and challenge it where there are reasonable grounds to consider it unlawful, and to disclose the minimum information permissible. If we conclude we can no longer comply with the Clauses, we will notify the tenant promptly, and the tenant may suspend the transfer as the Clauses provide. If an adequacy decision comes to cover a transfer (for example, if we become certified under the EU-US Data Privacy Framework), the Clauses apply to that transfer only to the extent the adequacy decision does not.

For transfers from the United Kingdom, the transfer risk assessment in Section 14 applies. For transfers from Switzerland, this assessment applies read with reference to the FADP, as Section 15 provides.