Data Processing Agreement

Controller, processor, personal data, processing, data subject, personal data breach and supervisory authority have the meanings given in the GDPR. Customer Data means personal data that the Customer or its users put into Opero, or that Opero receives on the Customer's behalf through connected channels.

• The Customer is the controller of Customer Data. If the Customer itself acts as a processor for another company, we act as its subprocessor on the same terms.
• We are the processor. We process Customer Data only on the Customer's documented instructions, unless the law requires otherwise; in that case we tell the Customer first, unless the law forbids it.
• The Customer's instructions are this DPA, the agreement for Opero and the settings the Customer chooses in Opero, such as AI employee permissions, approvals and connected channels. We tell the Customer if we believe an instruction breaks data protection law.

• We make sure everyone who can access Customer Data is bound by confidentiality, and our staff access it only to provide support and run the service.
• We apply the technical and organizational measures in section 10 (Article 32 GDPR).
• We do not use Customer Data for our own purposes, including training general AI models, and we never sell it.
• We help the Customer respond to data subject requests, taking into account the nature of the processing. If a data subject contacts us directly, we pass the request on to the Customer.
• We help the Customer meet its obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR), based on the information available to us.
• We make available the information needed to demonstrate compliance with Article 28 GDPR and allow audits as described in section 9.

The Customer gives us general authorization to use subprocessors. Their categories and locations are listed below. We impose data protection obligations on each subprocessor by contract, as Article 28(4) GDPR requires, and remain responsible to the Customer for their performance. The one exception is described in section 7.

We give at least 14 days' notice of any new subprocessor category or new country, in the app or by email. The Customer may object on reasonable data protection grounds. If we cannot resolve the objection, the Customer may end the affected service and get a refund of prepaid fees for the unused period.

We notify the Customer without undue delay, and no later than 24 hours after becoming aware of a personal data breach affecting Customer Data. We provide the information the Customer needs to notify the supervisory authority and data subjects (Articles 33 and 34 GDPR), update it as we learn more and take reasonable steps to contain the breach.

We are established in Russia, which has no EU adequacy decision. Where our processing involves a transfer of Customer Data from the EEA, the UK or Switzerland to us, or onward to our subprocessors, the following applies:

• The Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 are incorporated into this DPA by reference: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. The Customer is the data exporter and we are the data importer.
• Clause 7 (docking clause) applies. Under Clause 9, option 2 (general written authorization) applies, with the notice period in section 5. The optional wording in Clause 11 does not apply. Under Clauses 17 and 18, the law and courts of the EU Member State where the Customer is established apply, or those of Ireland if the Customer is not established in the EU.
• Annex I of the Clauses is completed by section 3 of this DPA together with the Customer's details from its Opero account, Annex II by section 10 and Annex III by section 5. The competent supervisory authority is determined under Clause 13.
• For transfers from the UK, the UK International Data Transfer Addendum to the Clauses applies. For transfers from Switzerland, references to the GDPR include the Swiss Federal Act on Data Protection, and the competent authority is the Federal Data Protection and Information Commissioner.
• For onward transfers to subprocessors outside the EEA, we rely on an adequacy decision, including the EU-U.S. Data Privacy Framework where the subprocessor is certified, or on the Clauses.
• We assess how the laws of the importing countries affect these safeguards and apply supplementary measures: encryption in transit, sending providers only the data each task needs, and limiting access to the staff who need it.

Exception: one of our text AI providers does not currently sign the Clauses or data processing terms. Before you process personal data of people in the EEA, the UK or Switzerland in Opero, contact us so we can agree how those requests are processed.

Customer Data is kept while the Customer's company exists in Opero, including while paused. When the agreement ends, or earlier at the Customer's request, we return a copy of Customer Data on request and delete it within 30 days. Backups are overwritten on a rolling basis within 90 days at most. We keep data longer only where the law requires it.

On request, we provide the information needed to demonstrate compliance with this DPA, including a description of our security measures. If that is not enough, the Customer may audit our compliance once a year at its own cost, with at least 30 days' notice, during business hours and without access to other customers' data. An independent auditor bound by confidentiality may carry out the audit on the Customer's behalf.

• Customer Data is stored in secure data centres; speech and video are processed on our own server.
• All connections are encrypted in transit with TLS. Our database provider encrypts stored data.
• Each company's data is logically separated, and access within a company is role-based.
• Each AI employee has its own permissions and limits; payments and other sensitive actions need a person's approval.
• Every AI employee action is recorded in an activity log the Customer can see.
• Password-free sign-in through Telegram, Yandex or Google; sign-in sessions expire.
• Backups and server monitoring with alerts.
• Staff access to Customer Data is limited to support and operations and is covered by confidentiality obligations.
• Email safeguards: unsubscribe links, suppression of unsubscribed and bouncing addresses, sending limits for new addresses.
• An incident response process that covers breach notification under section 6.

Each party's liability under this DPA is subject to the limits in the agreement for Opero, except where the law does not allow such limits. If this DPA conflicts with the agreement, this DPA prevails for the processing of Customer Data. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.

This DPA applies for as long as we process Customer Data and ends once Customer Data has been deleted or returned.