Data Processing Agreement

1. Roles

The Customer is the controller of End User personal data and decides why and how it is processed. Maica is the processor and processes that data only to provide the Services. Where the Customer is itself a processor for another controller, Maica acts as its sub-processor.

2. Details of processing

3. Maica's obligations

Maica will:

1. process personal data only on the Customer's documented instructions, including those given through the Terms, Agent Configuration and the dashboard, and tell the Customer if it believes an instruction breaks the law;
2. ensure that staff with access to personal data are bound by confidentiality;
3. apply the security measures in Annex A;
4. help the Customer, as far as reasonably possible, to respond to data subject requests, carry out impact assessments and consult regulators;
5. use personal data to train or improve only the Customer's own Agents, language understanding models and workflows, as part of the Services and on the Customer's instructions; not use it for Maica's own purposes or to train general or shared AI models without the Customer's written agreement; and never use one customer's data to train or improve Agents or models for another customer; and
6. not sell personal data.

4. Customer's obligations

The Customer confirms that it has a lawful basis for, and has given all required notices about, the personal data it instructs Maica to process, including consent to call and record, AI disclosure, and consent for sensitive data. The Customer is responsible for the accuracy and lawfulness of that data and of its instructions in every country where its End Users are located. Maica may refuse or suspend any instruction it reasonably believes is unlawful.

5. Sub-processors

The Customer gives general authorisation for Maica to use sub-processors to provide the Services. Maica will give at least 15 days' notice of any new sub-processor that will process Customer personal data. The Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees for them. Maica will bind each sub-processor to written terms with protections at least as strong as this DPA and remains responsible for them as the law requires. For AI model providers, whose data practices also depend on their own terms, Maica will use available settings that prevent training on Customer data and limit retention.

6. International transfers

Maica and its sub-processors may process personal data outside the country where it was collected. Where a transfer needs a legal mechanism, the parties incorporate the EU Standard Contractual Clauses (Module 2 or Module 3, as applicable), the UK International Data Transfer Addendum, and any equivalent terms required by other applicable laws, completed with the details in this DPA.

7. Personal data breaches

Maica will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will describe what happened, the data involved, the likely consequences and the steps taken. As controller, the Customer is responsible for notifying regulators and individuals where the law requires.

8. Audits

Maica will make available the information reasonably needed to show compliance with this DPA, such as a summary of its security measures. The Customer may carry out one audit a year on 30 days' notice, during business hours, at its own cost, under confidentiality, and without access to other customers' data.

9. Healthcare, education and other sensitive use cases

Maica does not process US protected health information unless the parties have signed a Business Associate Agreement. Customers processing health data, children's data or other sensitive categories must agree additional safeguards with Maica in writing before doing so. Education customers are responsible for obtaining any parental or guardian consent required before students' data is processed.

10. Return and deletion

The Customer may export its data for 30 days after the Services end. Maica will then delete Customer personal data within 60 days, unless the law requires it to be kept, in which case Maica will keep it protected and use it only for that legal purpose. During the term, recordings and transcripts are deleted according to the retention schedule the Customer configures. On request, Maica will confirm deletion in writing.

11. Liability

Each party's liability under this DPA is subject to the limitations in the Terms, to the extent the law allows.

Annex A: Security measures

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
• Role-based access, multi-factor authentication for staff, least-privilege access and access logging.
• Logical separation of each customer's data.
• Configurable retention and deletion of recordings and transcripts.
• Vulnerability scanning, patching and secure development practices.
• Backups and business continuity arrangements.
• A documented incident response procedure.
• Security reviews of sub-processors.
• Staff confidentiality agreements and security training.

Annex B: Sub-processors

Maica uses carefully selected sub-processors in the following categories: cloud hosting and storage; AI language models; speech-to-text and text-to-speech; telephony and messaging; payments; email and customer support; and website analytics. Each is bound by written data protection terms. For AI model providers, Maica keeps a record of whether each one may use API data for training under its own terms.

The current list, with each sub-processor's purpose and location, is available on request at [email protected]. To receive notice of new sub-processors under Section 5, email [email protected] with the subject "Sub-processor updates".