Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between OA Partners LLC ("Processor", "we") and the customer ("Controller", "you"). It applies where we process personal data on your behalf and that processing is subject to the EU or UK General Data Protection Regulation, the Swiss Federal Act on Data Protection, or a similar law that requires a contract of this kind ("Data Protection Law"). If this DPA and the Terms conflict, this DPA prevails for that processing.

1. Roles and scope

You are the controller (or a processor acting for your own client) of the personal data you and your end users put into the Service. We are your processor. For data we use for our own purposes, such as your account and billing data, we are a separate controller and our Privacy Policy applies.

2. Details of the processing

• Subject matter and duration: providing the Service for as long as your account exists.
• Nature and purpose: hosting AI agent conversations by voice, video and text; recording, transcribing and analyzing them; storing leads and bookings; sending messages on your behalf; analytics; and, where you switch it on, an in-app AI assistant that reads your account to answer your questions.
• Data subjects: your leads, visitors, customers and contacts, and your team members.
• Types of data: contact details, form answers, audio and video recordings, transcripts, AI-generated summaries and extracted answers, messages and their delivery status, bookings, widget activity, IP address and device data.
• Special categories: not intended. You must not submit them unless we have agreed in writing.

3. Your instructions

We process personal data only on your documented instructions, which are these: to provide the Service as described in the Terms and as you configure it, and as otherwise agreed in writing. We will tell you if we believe an instruction breaks Data Protection Law, or if a law requires us to process differently (unless that law forbids telling you).

You are responsible for the lawfulness of the processing you ask for, including having a legal basis, giving notices, obtaining consents (including for recording, AI interaction and marketing messages) and the accuracy of the data.

Connecting a third-party AI application to your account is an instruction to make your data available to that application, which then acts on your behalf. Its provider is not our sub-processor: it is a recipient you choose, and its terms govern the data it receives. You can disconnect it at any time.

4. Confidentiality

People we authorize to process the data are bound by confidentiality obligations.

5. Security

We maintain technical and organizational measures appropriate to the risk, including: encryption of data in transit; access controls and least-privilege access for staff; logical separation of each customer's data; encryption of stored integration credentials; protection against automated abuse; monitoring and logging; and vetting of sub-processors. We may update these measures as long as overall protection is not reduced.

6. Sub-processors

You give general authorization for us to use sub-processors. We bind each one to data protection obligations no less protective than this DPA and remain responsible for their performance. Current sub-processors that may process customer personal data:

We will update this page before adding or replacing a sub-processor. You may object on reasonable data protection grounds within 14 days of the update by writing to hello@gorocketapp.com; if we cannot resolve the objection, you may stop using the affected part of the Service or close your account.

7. Helping you

Taking into account the nature of the processing, we will help you, by appropriate technical and organizational means, to respond to requests from individuals to exercise their rights, and with data protection impact assessments and consultations with authorities where required. If an individual contacts us directly about data we process for you, we will refer them to you.

8. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and give you the information we have that you reasonably need to meet your own obligations.

9. Deletion and return

During the term you can access and export your data through the Service. After your account ends we delete your personal data within a reasonable period, except where the law requires us to keep it or it remains in backups that are overwritten in the ordinary course.

10. Audits

On reasonable written request, and no more than once a year unless a breach or an authority requires otherwise, we will give you the information needed to show our compliance with this DPA. Where that is not enough, you may carry out an audit at your own cost, on reasonable notice, during business hours, under confidentiality, and without disrupting our operations or exposing other customers' data.

11. International transfers

You authorize us and our sub-processors to process data outside the country where it was collected. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) are incorporated by reference: Module Two (controller to processor) where you are a controller and Module Three where you are a processor, with you as exporter and us as importer; Clause 7 (docking) applies; under Clause 9, general authorization with the notice period in section 6; the optional language in Clause 11 does not apply; Clauses 17 and 18 use the law and courts of Ireland. Annex I is sections 1 and 2 of this DPA, Annex II is section 5, and Annex III is section 6. For UK transfers the UK International Data Transfer Addendum applies, and for Swiss transfers the clauses are read to refer to Swiss law and the Swiss regulator.

12. General

Liability under this DPA is subject to the limits in the Terms, to the extent the law allows. This DPA ends when we no longer process your personal data.

13. Contact

OA Partners LLC, 8 The Green, Dover, DE 19901, USA. Email: hello@gorocketapp.com