Data Processing Agreement

1. Parties, acceptance and term

The customer identified in the account, proposal or service order is the controller. Telvia Comunicaciones S.L., tax ID B22615314, Calle Rosselló 42, 08328 Alella, Barcelona, Spain, is the processor.

This agreement is accepted with the Terms on registration or an incorporating proposal. It applies while Telvia processes on the customer’s behalf and continues for data requiring retention or deletion after termination.

2. Subject matter and instructions

Telvia processes only to provide, protect, maintain and support activated Atendy functions under this agreement, the Terms, account settings, actions in the platform and lawful written instructions. Instructions include transfers to third countries or international organisations needed for those functions, subject to section 8.

Telvia informs the customer of instructions it considers contrary to data protection law and may suspend execution pending clarification or amendment. If law requires processing outside instructions, Telvia informs the customer beforehand unless legally prohibited.

3. Processing details

Purpose and nature: configure and run voice agents and connected channels; place and transfer calls, including recipient summaries and processing their response when confirmation is enabled; generate responses; record when enabled; transcribe, summarise and display results; execute integrations and send configured notifications; provide support, security and maintenance.

Duration: service provision and then the time needed to return/delete data, complete technical backup cycles and meet legal duties. Data subjects: customer users, staff and collaborators, contacts, customers, prospects, suppliers and others communicating with agents or included in customer uploads.

Data: identification and contact details, phone numbers, call/message content and metadata, enabled audio and recordings, transcripts, summaries, results, appointments, instructions, documents, variables and integration data. Operations: collection, transmission, consultation, organisation, storage, result generation, disclosure to subprocessors, export, restriction and erasure.

Special-category data are not required by default. The customer must not introduce them unless necessary, legally justified and protected by appropriate configured safeguards.

4. Telvia’s obligations

Process only on documented instructions for the service. Ensure authorised persons are bound by confidentiality and access data only as necessary. Apply risk-appropriate technical and organisational measures under GDPR article 32. Assist the customer in meeting data protection duties considering the processing and available information, and retain information needed to demonstrate compliance.

5. Customer obligations

Establish a valid legal basis for data, calls, messages, recordings and other configured processing. Inform affected people, handle their rights and comply with commercial communications, consumer, telecommunications and suppression-list rules. Configure proportionate instructions, access, retention and recording; test before production. Do not instruct unlawful processing or upload unauthorised data. Clearly identify AI interaction from the outset and do not conceal or remove that identification.

6. Security

As applicable, Atendy uses authentication, access control and logical account separation; secure encrypted communications; private recordings with temporary links following account checks; separate credentials/secrets management, least privilege and administrative controls; technical logs, error monitoring and abuse prevention; and risk-appropriate updates and vulnerability management.

For infrastructure administered by Telvia, Telvia manages access, configuration, updates and service logs without prejudice to the infrastructure providers’ duties. Third-party services do not release Telvia from security obligations. Measures may evolve without materially reducing overall protection during the service term.

7. Subprocessors

The customer gives general authorisation for subprocessors necessary to provide Atendy. The provider and subprocessor register, functions and available transfer information are accessible to customers at provider and subprocessor register after signing in. Telvia imposes substantially equivalent data protection obligations and remains responsible to the customer for their fulfilment.

Telvia proactively provides and updates identifying information for subprocessors involved in the customer’s processing, including the subcontracting chain: entity, address, contact and function, with applicable processing locations and international-transfer information. This complements the categories in the public policy and is supplied on contracting and on changes; it may also be requested at info@atendy.es.

Telvia gives reasonable advance notice of additions or replacements by account email or a notification directed to the customer, identifying the provider, function, location, planned date and objection procedure. Merely editing the public documentation is insufficient. The customer may object on reasonable data protection grounds before the change. The parties seek a good-faith solution; absent a reasonable alternative, the customer may stop the affected function or terminate under the Terms.

8. International transfers

Telvia will not transfer data internationally on the customer’s behalf without a valid basis. For processing outside the EEA it uses an applicable mechanism such as an adequacy decision, the EU–US Data Privacy Framework for participating entities, or European Commission standard contractual clauses with supplementary measures where required.

9. Data subject rights

Telvia forwards requests concerning customer-controlled data to the identifiable customer and does not respond independently unless legally required. Considering the nature of processing, it provides available functions and reasonable assistance for handling rights requests.

10. Personal data breaches

Telvia notifies the customer without undue delay after becoming aware of a breach affecting data processed on their behalf, providing available information needed to assess and, where required, report it. Notification does not acknowledge liability.

11. Assessments and consultation

Telvia provides reasonably available information to assist with impact assessments and prior consultation concerning the specific use of Atendy. The customer determines whether its campaign, sector, scale, data or decisions require assessments or additional safeguards.

12. Return and erasure

During service, the customer can access, export or delete through available functions. On termination, at the customer’s written choice, Telvia returns or deletes personal data processed on their behalf unless law requires retention.

Residual backups may remain until overwritten under the applicable technical cycle. They remain protected, are not used for ordinary purposes and, if restored after an incident, are again subject to the deletion request. Records strictly needed for billing, security, fraud prevention or suppression lists may be kept without conversational content for applicable periods.

13. Information and audits

On reasonable request Telvia provides information demonstrating GDPR article 28 compliance. If insufficient, the customer may request a proportionate, pre-coordinated confidential audit that does not compromise security or other customers’ data. Unless Telvia’s breach is established, extraordinary audit costs are borne by the customer.

14. Precedence and contact

For processing on the customer’s behalf, this agreement overrides conflicting Terms. Specific mutually accepted conditions prevail where they expressly identify the amended clause. Contact: info@atendy.es.