Data Processing Agreement (DPA)

#Parties

#1. Definitions and interpretation

1.1 Capitalized terms not defined in this DPA have the meaning given to them in the Aurora Suite AI Terms or, failing that, under the GDPR.

1.2 For the purposes of this DPA:

• Customer Personal Data: personal data processed by Umanize as processor on behalf of the Customer in connection with the Service.
• Subprocessor: any third party appointed by Umanize to process Customer Personal Data on behalf of the Customer in connection with the Service.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise processed.
• Applicable Data Protection Laws: the GDPR, any applicable national implementing laws, and any other privacy or data protection laws applicable to the processing covered by this DPA.
• Standard Contractual Clauses or SCCs: the standard contractual clauses adopted by the European Commission or any other valid transfer mechanism under Articles 44 et seq. GDPR, as applicable.

1.3 Unless the context requires otherwise, references to the Customer as Controller shall also include the case where the Customer acts as processor on behalf of a third-party controller; in such case, Umanize shall act as subprocessor.

#2. Scope and roles of the parties

2.1 This DPA applies to the extent Umanize processes Customer Personal Data as processor on behalf of the Customer in connection with the provision of Aurora Suite AI.

2.2 The Customer acts as controller or, where applicable, as processor on behalf of a third-party controller.

2.3 Umanize acts as processor or, where the Customer acts on behalf of a third-party controller, as subprocessor.

2.4 The Customer is responsible for compliance with all obligations applicable to controllers, including, where necessary, notice obligations, identification of the legal basis, collection of any required consents, the lawfulness of the instructions provided, and fulfillment of data subject rights.

2.5 If the Customer acts on behalf of a third-party controller, the Customer represents that it has obtained all authorizations necessary to bind such third-party controller in relation to this DPA and shall remain Umanize's sole point of contact.

#3. Subject matter, nature, and purposes of processing

3.1 Umanize processes Customer Personal Data solely to provide the Service, ensure security, provide technical support, prevent abuse, and comply with contractual and legal obligations, in accordance with the Customer's documented instructions.

3.2 The categories of data, categories of data subjects, nature of processing, purposes, and duration are described in Annex I, which forms an integral part of this DPA.

3.3 Umanize does not process Customer Personal Data for its own incompatible purposes and, unless otherwise expressly agreed in writing, does not use Customer Personal Data to train general-purpose artificial intelligence models.

#4. Customer documented instructions

4.1 Umanize processes Customer Personal Data only on the Customer's documented instructions, as reflected in the Terms, the Customer's Service configuration, this DPA, and any further written instructions agreed between the parties.

4.2 The Customer warrants that all instructions provided to Umanize are lawful and compliant with Applicable Data Protection Laws.

4.3 If Umanize believes that an instruction from the Customer infringes applicable law, it shall inform the Customer without undue delay.

4.4 If Umanize is subject to a legal obligation requiring processing of Customer Personal Data contrary to the Customer's instructions, Umanize shall inform the Customer to the extent legally permitted.

#5. Authorized personnel and confidentiality

5.1 Umanize shall ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

5.2 Access to Customer Personal Data shall be limited to personnel who need such access for the performance of the Agreement.

#6. Technical and organizational measures

6.1 Taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risks to the rights and freedoms of natural persons, Umanize shall implement appropriate technical and organizational measures pursuant to Article 32 GDPR.

6.2 The main technical and organizational measures implemented by Umanize are described in Annex II to this DPA.

6.3 Umanize may update or modify such measures over time, provided that the overall level of protection is not materially reduced.

#7. Subprocessors

7.1 The Customer authorizes Umanize, pursuant to Article 28(2) GDPR, to appoint Subprocessors for the performance of the Service.

7.2 Umanize shall impose on Subprocessors data protection obligations that are substantially equivalent to those set out in this DPA, to the extent applicable to the delegated service.

7.3 The list of Subprocessors, with the service performed, the data processed, the processing location and transfer safeguards, is set out in Annex III and is also available on request at [email protected]. New appointments and replacements are notified in accordance with sections 7.4 and 7.5.

7.4 Umanize shall inform the Customer of new appointments or replacements of Subprocessors with reasonable prior notice, generally no less than 15 days, unless urgency arises due to security, continuity, or legal requirements.

7.5 The Customer may object on reasonable and documented data protection grounds within the notice period. The parties shall work in good faith to find a reasonable solution; failing that, the Customer may discontinue use of the specifically affected service, where applicable.

#8. Assistance to the Customer and data subject rights

8.1 Taking into account the nature of the processing and the information reasonably available to Umanize, Umanize shall provide reasonable assistance to enable the Customer to fulfill its obligations regarding data subject rights requests. The Service provides the Customer with tools to handle such requests, including the contact record and timeline, the register of legal bases and contact preferences, clearing contact memory, contact deletion, retention settings, exports and the API.

8.2 If Umanize receives directly a request from a data subject relating to Customer Personal Data, Umanize shall inform the Customer without undue delay and shall not respond to such request except as required by law or on the Customer's documented instructions, without prejudice to Umanize's ability to direct the individual to the Customer.

8.3 Umanize shall also provide reasonable assistance in relation to data protection impact assessments, prior consultations with competent authorities, and other privacy obligations to the extent they depend on processing carried out by Umanize on the Customer's behalf.

#9. Personal Data Breaches

9.1 Umanize shall notify the Customer, at the account administrator's email address, of any Personal Data Breach affecting Customer Personal Data without undue delay after becoming aware of it and in any event within 48 hours of confirming the breach.

9.2 Such notification shall include, to the extent reasonably available at the time, information on the nature of the breach, the categories of data involved, the categories of data subjects affected, known possible consequences, and measures taken or proposed to contain and mitigate the incident.

9.3 Where all information cannot be provided at once, Umanize may provide it in phases as it becomes available.

9.4 Umanize shall provide reasonable cooperation to enable the Customer to comply with any notification obligations toward supervisory authorities or data subjects, to the extent required by applicable law.

#10. International data transfers

10.1 Where processing of Customer Personal Data involves transfers to third countries not covered by an adequacy decision, Umanize shall ensure that such transfers are carried out in compliance with Articles 44 et seq. GDPR by means of SCCs or any other valid transfer mechanism under applicable law.

10.2 Where a Subprocessor processes Customer Personal Data in a third country without an adequacy decision, Umanize enters into the SCCs (Module 3, processor to processor) with that Subprocessor or relies on another valid mechanism, such as the Subprocessor's certification under the EU-U.S. Data Privacy Framework. Where the Customer is established outside the EEA, the parties apply, where required, Module 4 (processor to controller) of the SCCs, which are hereby incorporated by reference into this DPA.

10.3 The information relating to data categories, processing purposes, and security measures described in Annexes I and II shall also be deemed incorporated for the purposes of the SCCs, where applicable.

#11. Data residency and access from other jurisdictions

11.1 Customer Personal Data is stored primarily in the European Union: databases and files on DigitalOcean in Frankfurt (Germany); agent voice and conversations at ElevenLabs with EU data residency. This refers to the main infrastructure location of the data and does not exclude certain Subprocessors processing data, or access taking place, from other jurisdictions to the extent permitted by applicable law and with the safeguards of section 10.

11.2 In particular, access or processing from different jurisdictions may occur for technical support, security, incident management, Subprocessor activities, or other lawful operational needs, subject to appropriate transfer safeguards where required.

#12. Deletion, return, and retention of data

12.1 This DPA remains in effect for as long as Umanize processes Customer Personal Data on behalf of the Customer.

12.2 Until the termination date the Customer may export Customer Personal Data using the exports available in the dashboard and the API.

12.3 Within 30 days of termination of the Agreement, or of the Customer's written request to [email protected] if earlier, Umanize permanently deletes Customer Personal Data from its systems and asks its Subprocessors to delete it. Upon request, Umanize confirms the deletion in writing.

12.4 Copies in database backups are encrypted and are overwritten within 7 days after deletion.

12.5 Data that Umanize is required to retain by law may be kept for the required period and processed solely for that purpose.

12.6 During the Agreement, deleting a contact in the interface or via the API removes it from the Service; permanent deletion from the database is performed by Umanize at the Customer's request, in the same way as section 12.3.

#13. Audits and inspections

13.1 Upon reasonable request, Umanize shall make available information reasonably necessary to demonstrate compliance with this DPA, including any available reports, attestations, or summaries regarding security measures.

13.2 To the extent required by applicable law and not otherwise satisfied through the documentation made available, the Customer may request further audits or inspections, subject to reasonable prior notice, during business hours, within a reasonable scope, and without unreasonably interfering with Umanize's operations.

13.3 Any such audits shall be subject to appropriate confidentiality obligations, shall not grant access to data or information relating to other customers or third parties, and, unless they reveal a material breach of this DPA attributable to Umanize, shall be carried out at the Customer's expense.

#14. Liability

14.1 Umanize's liability under this DPA remains subject to the limitations and exclusions set out in the Terms, except to the extent otherwise required by mandatory law applicable to personal data protection.

14.2 The Customer remains fully responsible for the lawfulness of the data processed, the legal bases, notice and consent obligations, and the instructions provided to Umanize.

#15. Governing law, jurisdiction, and precedence

15.1 This DPA shall be governed by Italian law, without prejudice to any mandatory provisions of Applicable Data Protection Laws.

15.2 Any dispute arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the Court of Foggia, unless otherwise required by mandatory law.

15.3 In the event of conflict between this DPA and other contractual documents, this DPA shall prevail with respect to matters concerning the processing of personal data on behalf of the Customer.

#Annex I - Description of processing

Subject matter of processing: processing of Customer Personal Data necessary for the provision of Aurora Suite AI.

Nature of processing: collection, recording, organization, storage, consultation, use, transmission, combination, analysis, transcription, classification, deletion, and any other operation strictly necessary for the provision of the Service.

Purposes of processing: automated handling of conversations with the Customer's contacts by phone, WhatsApp, website chat, email and, where enabled, SMS, Instagram and Messenger; call recording and transcription; summaries, classification and analysis of conversations; contact memory; booking and managing appointments in connected calendars; automations enabled by the Customer (for example lead follow-up, reminders, recalls, abandoned-cart recovery); synchronisation with connected CRMs and e-commerce platforms; receipt of leads from forms and ads; measurement of the Customer's advertising conversions, where enabled; register of legal bases and contact preferences; reporting; technical support, security, and abuse prevention.

Categories of data subjects: the Customer's contacts, leads and customers; people who call, write to or use the website chat of the Customer; customers of connected online stores; people who fill in the Customer's forms or ads; the Customer's personnel involved in using the Service.

Categories of personal data: identification and contact data (name, phone, email, address); call audio and recordings; transcripts, messages, emails and summaries; information provided during conversations and facts saved in contact memory; appointments; orders, carts and customer data of connected stores; contacts and deals of connected CRMs; form answers and consents collected; legal bases and contact preferences; advertising and click identifiers (for example gclid, fbclid) and hashed email and phone sent to advertising platforms where the Customer enables measurement; communication metadata; technical data of website chat visitors (for example IP address); any personal data contained in Inputs uploaded by the Customer.

Special categories of data: the Service is not designed to process special categories of personal data under Article 9 GDPR, including data concerning health, and must not be used to process them. The Customer does not configure agents, documents or automations to collect them and instructs the agents to refer any related requests to a person. Incidental disclosures of such data by data subjects are handled in accordance with this DPA but are not a purpose of the Service.

Duration of processing: for the duration of the contractual relationship and for the additional period strictly necessary pursuant to Section 12 of this DPA.

Retention: by default call recordings are deleted after 6 months, including at the voice provider, and transcripts, summaries, messages and collected data on all channels after 24 months, keeping only the outcome and topic of the conversation; the Customer may change these periods from 1 to 120 months under Settings › Privacy and retention. Webhook delivery logs are kept for 30 days and database backups for 7 days. Other data is kept for the term of the Agreement and handled upon termination in accordance with Section 12.

#Annex II - Technical and organizational measures

• TLS encryption of traffic to the Service and to providers;
• databases encrypted at rest and database backups encrypted by the hosting provider;
• integration tokens, mailbox credentials and signing secrets encrypted in the database with an application key; customer API keys stored only as hashes;
• logical separation of data per account and role-based permissions (owner, administrator, operator);
• separate production and test environments, with automated tests run only on local databases with dummy data;
• daily database backups kept for 7 days, with point-in-time recovery, and a restore test at least every 6 months under internal policy;
• two-step verification and passkeys available to all users; two-step verification mandatory for Umanize staff under internal policy;
• logging of administrative actions, impersonation sessions and API key usage;
• least-privilege staff access, reviewed every six months and revoked by the day of departure, under internal policy;
• security incident management procedure, with initial assessment within 4 hours and customer notification under section 9;
• confidentiality commitments and need-to-know restrictions for authorized personnel;
• register of the Subprocessors involved in the processing;
• code and database migrations managed in a repository with a full change history.

#Annex III - Subprocessors

List updated on 6 November 2026. New appointments and replacements are notified in accordance with sections 7.4 and 7.5.

Other services that the Customer connects with its own account, for example HubSpot, Pipedrive, Shopify, WooCommerce, Meta Lead Ads, Instagram and Messenger, IMAP/SMTP mailboxes, Zapier, Make, n8n or MCP clients, are not Subprocessors chosen by Umanize: the Service exchanges data with them only on the Customer's instructions.