Last Updated: January 5, 2026
This Data Processing Agreement (DPA) is part of AIVA Connect's commitment to GDPR compliance for enterprise customers.
This DPA is automatically incorporated into your service agreement if you process personal data of EU/EEA residents through our platform. For custom DPAs or enterprise agreements, contact our legal team.
This Data Processing Agreement ("DPA") forms part of the Terms of Service between:
You (the "Customer") - The organization using AIVA Connect's services who determines the purposes and means of processing personal data.
AIVA Connect (the "Processor") - Processes personal data on behalf of the Customer in accordance with their instructions.
For the purposes of this DPA, the following terms have the meanings set forth below:
"Personal Data" means any information relating to an identified or identifiable natural person processed through the Services.
"Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
"Data Subject" means the individual to whom Personal Data relates (e.g., your customers, employees, or contacts).
"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.
"Sub-processor" means any third party appointed by AIVA Connect to process Personal Data on behalf of the Customer.
Provision of AI receptionist services, including call handling, transcription, and contact management.
The term of processing corresponds to the duration of your service agreement.
Processing is necessary to provide AI-powered call handling, voice transcription, contact management, and related services as described in the Terms of Service.
AIVA Connect shall process Personal Data only on documented instructions from the Customer, unless required to do so by applicable law. The Terms of Service, together with this DPA, constitute the Customer's complete instructions for processing.
AIVA Connect ensures that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
If AIVA Connect believes that a Customer instruction violates GDPR or other data protection laws, it will immediately inform the Customer and may suspend processing until the instruction is confirmed or modified.
AIVA Connect implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
The Customer authorizes AIVA Connect to engage the following sub-processors for processing Personal Data:
| Sub-processor | Service | Location |
|---|---|---|
| AWS (Amazon Web Services) | Cloud hosting and storage | United States |
| Supabase | Database and authentication | United States |
| Twilio | Phone number provisioning and routing | United States |
| Retell AI | AI voice processing and transcription | United States |
| Stripe | Payment processing | United States |
AIVA Connect will notify the Customer with at least 30 days' notice before adding or replacing sub-processors. The Customer may object to such changes by terminating the service agreement within 30 days of notification.
AIVA Connect will assist the Customer in responding to Data Subject requests, including:
The Customer is responsible for verifying the identity of Data Subjects and determining the appropriate response. AIVA Connect will provide necessary data within 7 business days of a valid request.
AIVA Connect will notify the Customer without undue delay and, where feasible, no later than 72 hours after becoming aware of a Personal Data breach.
Notifications will include:
AIVA Connect will cooperate with the Customer and regulatory authorities in investigating and mitigating any Personal Data breach.
Personal Data may be transferred to and processed in the United States and other countries where AIVA Connect or its sub-processors maintain facilities. AIVA Connect ensures appropriate safeguards for such transfers:
AIVA Connect has implemented Standard Contractual Clauses (SCCs) approved by the European Commission for transfers of Personal Data outside the EEA.
Where possible, AIVA Connect relies on adequacy decisions by the European Commission for specific countries or frameworks.
The Customer may audit AIVA Connect's compliance with this DPA, subject to the following conditions:
AIVA Connect will provide relevant documentation, including SOC 2 reports, security assessments, and compliance certifications, in lieu of on-site audits where appropriate.
This DPA remains in effect for the duration of the service agreement between AIVA Connect and the Customer.
Upon termination of the service agreement, AIVA Connect will:
AIVA Connect may retain Personal Data to the extent required by applicable law or for legitimate business purposes (e.g., tax records, dispute resolution).
Each party's liability under this DPA is subject to the limitation of liability provisions in the Terms of Service. The parties agree that:
Important: This limitation of liability is subject to applicable law and may not limit liability for gross negligence, willful misconduct, or violations of data protection laws.
For enterprise agreements, custom DPAs, or legal inquiries, contact our legal team.