This Data Processing Agreement ("DPA") forms part of the Terms of Service between LiquiDeXim Tech ("Processor", "we", "us") and the customer ("Controller", "you") who signs up for the Lisa services.
Parties & Definitions
Under this agreement, you act as the Data Controller (who determines the purpose of processing), and we act as the Data Processor (who processes data on your behalf).
- "GDPR" means the General Data Protection Regulation (EU) 2016/679 and UK GDPR.
- "Personal Data" means any information relating to an identified or identifiable natural person processed by us on your behalf.
- "Sub-processor" means any third party engaged by us to process Personal Data.
Scope of Processing
We process Personal Data solely to provide the Lisa AI communication services as outlined in our Terms of Service.
| Processing Details | Description |
|---|---|
| Data Subjects | Your customers, prospects, leads, or employees who interact with our AI via phone calls or SMS. |
| Categories of Data | Names, phone numbers, email addresses, call audio recordings, text transcripts, SMS contents, and appointment booking details. |
| Nature & Purpose | Answering inbound/outbound calls, sending SMS messages, transcribing audio to text, and scheduling appointments via AI. |
| Duration | For the duration of your active subscription, plus any retention period specified in our Data Retention Policy. |
Our Obligations as a Processor
As your Data Processor, LiquiDeXim Tech agrees to:
- Process Personal Data only on your documented instructions (which includes providing the Service).
- Ensure that all personnel authorized to process Personal Data are bound by strict obligations of confidentiality.
- Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
- Not use the Personal Data for any other purposes, including training public AI models without anonymization and explicit consent.
Sub-processors
You grant us general authorization to engage Sub-processors to deliver our services (e.g., cloud hosting, telecommunication carriers, AI language model APIs). We ensure that:
- We enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than this DPA.
- We remain fully liable to you for the performance of the Sub-processor's obligations.
If we add or replace a Sub-processor, we will provide notice (e.g., via email or dashboard) giving you the opportunity to object within 14 days.
International Transfers
If we process or transfer Personal Data outside the European Economic Area (EEA) or the UK to a country not recognized as providing an adequate level of protection, we will rely on valid transfer mechanisms, such as the Standard Contractual Clauses (SCCs) approved by the European Commission or UK ICO.
Security & Data Breaches
We maintain robust security measures. In the event of a confirmed Personal Data breach affecting your data, we will:
- Notify you without undue delay after becoming aware of the breach.
- Provide you with sufficient information to allow you to meet any obligations to report the breach to authorities or individuals.
- Take prompt steps to mitigate the effects and minimize any damage resulting from the breach.
Data Subject Requests
As the Controller, you are responsible for responding to requests from individuals exercising their GDPR rights (e.g., right to access, delete, or restrict). We will assist you by:
- Providing technical tools within the dashboard to export or delete conversation records.
- Promptly notifying you if a data subject contacts us directly regarding their data handled on your behalf.
Deletion or Return of Data
Upon termination of your account or expiration of the service agreement, we will, at your choice, either delete or return all Personal Data processed on your behalf, unless applicable laws require us to retain it (such as for tax or accounting purposes).
Call recordings and transcripts are typically automatically permanently deleted after your selected retention period (e.g., 90 days) expires.
Audit Rights
Upon written request, we will make available all information necessary to demonstrate compliance with this DPA. You may conduct an audit (or hire an independent auditor) no more than once per year, provided that you give us at least 30 days prior written notice, and the audit is conducted during regular business hours without disrupting our operations.
Contact & Legal Execution
By using the Lisa services, you automatically accept the terms of this DPA. If your organization requires a physically signed copy of this agreement, please contact us.
LiquiDeXim Tech
Data Protection Officer
Email: privacy@liquidexim.tech