Data Processing Addendum (DPA)

For the purposes of this Addendum:

• Personal Data: means any information relating to an identified or identifiable individual processed by AiDispatch on behalf of the Client in connection with the Service.
• Processing, Data Controller, and Data Processor: shall have the meanings given in the GDPR.
• Sub-Processor: means a third party engaged by AiDispatch to assist in Processing Personal Data on behalf of the Client.
• Applicable Data Protection Laws: include the GDPR, CCPA, and other relevant privacy laws or regulations applicable to the Client and AiDispatch.

AiDispatch provides AI-powered answering, dispatching, and client communication services. In providing the Service, AiDispatch may Process Client Personal Data such as:

• Names, phone numbers, email addresses
• Customer service notes, call/chat transcripts
• Scheduling details and geographic identifiers
• Metadata such as timestamps, duration, or user engagement patterns

The nature and purpose of the Processing is to deliver and support the functionality of the Service under the Agreement. The duration of Processing shall be for the term of the Agreement, unless otherwise required by law.

The parties acknowledge that, for the purposes of Applicable Data Protection Laws:

• The Client is the Data Controller of Personal Data it submits to the Service.
• AiDispatch is the Data Processor, acting solely on behalf of the Client and only in accordance with the Client's documented instructions.

AiDispatch shall not Process Personal Data for its own purposes or for any third party without written consent, unless required to do so by law.

AiDispatch agrees to:

• Process Personal Data only as instructed by the Client or as necessary to provide the Service;
• Ensure all personnel with access to Personal Data are bound by confidentiality obligations;
• Implement appropriate technical and organizational measures to ensure data security, including access control, encryption, and incident response procedures;
• Notify the Client without undue delay in the event of a confirmed Personal Data breach;
• Assist the Client, to the extent reasonably possible, with requests from data subjects and regulatory authorities, including deletion, access, and portability requests;
• Make available documentation or audits (upon reasonable request) to demonstrate compliance with this Addendum and allow for Data Protection Impact Assessments (DPIAs) where applicable.

AiDispatch may engage Sub-Processors to fulfill specific functions such as cloud hosting, analytics, or support services. These Sub-Processors are contractually bound to meet or exceed the data protection obligations set forth in this Addendum. Current Sub-Processors may include:

• Amazon Web Services (AWS) – cloud infrastructure
• OpenAI / Anthropic – AI model processing
• Stripe – payment processing
• Google Cloud / Firebase – analytics, notifications
• Intercom / Zendesk – support communications

AiDispatch shall provide prior notice of any intended changes to Sub-Processors. Clients may object in writing within ten (10) days of receiving notice if there are legitimate data protection concerns.

Personal Data may be transferred to or processed in countries outside of the Client's jurisdiction, including the United States. AiDispatch will ensure that such transfers are made in compliance with Applicable Data Protection Laws, including the use of:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Additional safeguards such as encryption and access restriction policies

AiDispatch will, to the extent legally permitted, assist the Client in responding to data subject requests, including:

• Right of access, correction, or deletion
• Right to restrict or object to Processing
• Right to data portability
• Right to withdraw consent (if applicable)

The Client is responsible for verifying the identity of requestors and for fulfilling the legal basis of such requests.

Upon termination or expiration of the Agreement, AiDispatch will, at the Client's choice, either:

• Return all Personal Data to the Client in a structured, commonly used format, or
• Securely delete or anonymize all Personal Data from its systems, unless retention is required by law.

Deletion shall be completed within 30 days of written request or termination confirmation.