Data Processing Agreement

This is a courtesy translation. In case of any discrepancy the Hungarian version prevails: Adatfeldolgozási megállapodás.

This agreement forms part of the Terms of Service (the “Terms”) and is concluded by accepting the Terms, between the business using the service (hereinafter the “Controller”) and Syntech Ventures Kft. (registered seat: 1136 Budapest, Hegedűs Gyula utca 32. 4. em. 9. ajtó; company registration number: 01-09-437271; hereinafter the “Processor”), under Article 28 of the GDPR.

1. Subject matter, duration, nature and purpose of the processing

• Subject matter: providing the Bevétel.ai service: SMS replies to missed calls, answering callers’ questions, taking and forwarding appointment requests.
• Duration: the term of the contract under the Terms, and the deletion period that follows it (Section 8).
• Nature: collection, recording, storage, generating the responses with artificial intelligence, transmission to the Controller, deletion.
• Purpose: solely providing the service to the Controller.

2. Data subjects and categories of data

• Data subjects: the persons who call the Controller by phone (callers).
• Data: phone number; the text of the SMS messages exchanged; if the caller provides them: name, the requested service, a suitable time; the time of the call and of the messages.
• Special categories of data: the service does not ask for any, and refers professional questions to the Controller. If the caller nevertheless shares such data (for example health data), the Processor stores it solely as part of the conversation and forwards it to the Controller.

3. Instructions of the Controller

The Processor processes personal data solely on the documented instructions of the Controller. The Terms, this agreement and the settings made by the Controller on the dashboard qualify as instructions. If the Processor considers that an instruction infringes the law, it informs the Controller without delay. The Controller is responsible for having an appropriate legal basis for contacting the callers.

4. Confidentiality and security

Only those members of the Processor’s staff who need it to provide the service have access to the data, and they are bound by a duty of confidentiality. The Processor applies appropriate technical and organisational measures, in particular: encrypted data transmission (TLS) and encrypted storage; a database in an EU region; role-based access control and strong authentication; authentication of webhook requests; logging; anti-abuse message sending limits.

5. Sub-processors

The Controller gives general authorisation for the engagement of sub-processors. The current list of sub-processors is in Section 5 of the Privacy Policy. The Processor notifies the Controller by e-mail at least 15 days before engaging a new sub-processor; the Controller may object, and in the event of an objection may terminate the contract free of charge. The Processor imposes the same data protection obligations on its sub-processors and is responsible for their performance.

Partners.If the Controller uses the service through a partner (for example booking software, a marketplace or a reseller), the partner is not a sub-processor: it has no access to the callers’ personal data. The partner receives only aggregated statistics containing no personal data (for example the number of accounts it referred, of conversations and of appointment requests taken, and response time). Individual conversations or caller data may reach the partner only with the Controller’s express consent recorded on the dashboard, in which case the partner acts as the Controller’s own processor.

6. International data transfers

The Processor stores the data in the European Union. Certain sub-processors (artificial intelligence, call detection, e-mail sending) operate in the United States; the transfer is based on the adequacy decision under the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses (SCC).

7. Assistance and incidents

• The Processor assists the Controller in fulfilling data subject requests (access, erasure, etc.); requests it receives are forwarded to the Controller.
• It assists the Controller in fulfilling its obligations regarding data security, incident handling and, where necessary, data protection impact assessments.
• It notifies the Controller of a personal data breach without undue delay, and at the latest within 48 hours of becoming aware of it, with the information available.

8. Termination of the contract

Within 90 days after the contract ends, the Processor deletes the callers’ data, unless the law requires its retention. Before termination, the Controller may request an export of the conversations.

9. Audits

The Processor makes available to the Controller all information necessary to demonstrate compliance with this agreement, and allows for reasonable audits agreed in advance. The cost of an on-site audit is borne by the Controller.

10. Miscellaneous

In the event of a conflict, this agreement takes precedence over the Terms in data protection matters. Contact: hello@bevetel.ai.