# Aivagenta Data Processing Agreement

Updated November 6, 2026

This DPA becomes effective when authorized representatives of both parties agree it in writing, including the completed schedules. Publication or use of the website does not by itself constitute agreement.

## 1. Parties, scope and priority

This Data Processing Agreement (DPA), once executed, is between Aivagenta, Inc. (Aivagenta) and the customer identified in Schedule 1 (Customer). It supplements their agreement for the Aivagenta services (Service Agreement).

It applies to personal data Aivagenta processes on Customer’s behalf in providing the services (Customer Personal Data), where Regulation (EU) 2016/679 (GDPR) applies. Customer acts as controller or, where authorized by its controller, as processor appointing Aivagenta as a further processor. Each party remains responsible for the obligations applicable to its actual role.

For this processing, this DPA prevails over inconsistent Service Agreement terms. Mandatory data protection law and any separately executed transfer clauses prevail over inconsistent terms of this DPA. Processing by Aivagenta as an independent controller, such as its own account administration, is outside this DPA and remains subject to applicable law and the Privacy Policy.

## 2. Definitions and processing description

Personal data, processing, controller, processor, supervisory authority and personal data breach have the meanings in the GDPR. A Subprocessor is another processor engaged by Aivagenta to process Customer Personal Data on Customer’s behalf.

Schedule 1 defines the subject matter, duration, nature and purposes of processing, categories of data subjects and types of personal data. It also records the parties’ contacts, services, authorized instructions and retention choices. The parties must agree any material change to that description in writing before the changed processing begins.

## 3. Customer responsibilities

Customer determines and documents the purposes and lawful basis of its processing, supplies required notices, and obtains any necessary consent or other authorization. This includes its use of call recording, messaging, visitor tracking, marketing and connected services. Customer must ensure its instructions and data submissions comply with applicable law and respect data minimization.

Customer controls its users, permissions and configured workflows, and must provide secure access credentials and an authorized privacy contact. Customer must assess the suitability of the agreed safeguards for its processing. Where Customer is itself a processor, it must obtain the controller’s authorization and pass through relevant instructions and obligations before appointing Aivagenta.

## 4. Documented instructions and purpose limits

Aivagenta shall process Customer Personal Data only on Customer’s documented instructions, including instructions about transfers. The executed Service Agreement, completed schedules and authorized service configurations form the initial instructions. Additional instructions must be recorded in writing and supplied by Customer’s designated contact.

Widget GDPR or consent settings govern the configured consent workflow. Any agreed no-retention instruction must separately identify the covered data, storage locations, exceptions and verification arrangements in Schedule 1. The parties must assess personal data used or transmitted during an interaction as well as data retained afterwards.

Aivagenta shall not sell Customer Personal Data, use it for its own advertising, or use it to train general-purpose or shared AI models unless separately authorized by lawful, documented instructions and an express written agreement addressing that use. Customer’s selection of an AI feature does not itself authorize unrelated uses.

If EU or Member State law requires other processing, Aivagenta shall inform Customer of that requirement before processing, unless the law prohibits notice on important public-interest grounds. If Aivagenta considers an instruction to infringe applicable EU or Member State data protection law, it shall immediately inform Customer and suspend that instruction while the parties seek a lawful resolution. Unaffected lawful processing may continue.

## 5. Confidentiality and personnel

Aivagenta shall restrict access to persons who need Customer Personal Data to perform authorized duties. Persons authorized to process the data shall be bound by contractual confidentiality commitments or an appropriate statutory duty of confidentiality. These duties survive the end of their access or engagement.

## 6. Security of processing

Aivagenta shall implement appropriate technical and organizational measures under Article 32 GDPR, taking account of the state of the art, implementation costs, processing circumstances and risks to individuals. The actual measures and responsibilities must be documented in the completed Schedule 2 before execution.

The agreed measures shall address, as appropriate to those risks, encryption or pseudonymization, confidentiality and integrity, availability and resilience, recovery after an incident, and regular assessment of effectiveness. Aivagenta shall document material changes and shall not materially reduce the overall agreed level of protection during the processing term.

Customer remains responsible for safeguards assigned to it in Schedule 2, including user access, endpoint security and decisions about data supplied to the service. These allocations do not remove either party’s statutory duties.

## 7. Subprocessors

Customer’s general written authorization extends only to the Subprocessors identified and approved in the completed Schedule 3. No vendor is approved merely because its name appears in marketing material, a list of possible integrations or an incomplete schedule.

Aivagenta shall give Customer at least 30 calendar days’ written notice of an intended Subprocessor addition or replacement, identifying the entity, function and processing locations. Customer may object on reasonable data protection grounds during that period. The parties shall work in good faith on a suitable alternative. Until resolved, the proposed Subprocessor shall not process that Customer’s data. If no compliant solution is available, Customer may end the affected processing or services without an early-termination penalty for that affected portion; accrued charges remain payable.

Aivagenta shall impose written obligations on each Subprocessor that provide the same relevant data protection obligations as this DPA, including sufficient security guarantees and assistance obligations. Aivagenta remains responsible to Customer for the Subprocessor’s performance of those obligations. On request, it shall provide relevant information or a copy of the processing terms, with confidential commercial information redacted where appropriate without obscuring the protections.

## 8. International transfers and access

Customer Personal Data may be processed or remotely accessed only in the locations agreed in Schedule 3 and on documented instructions. Aivagenta shall ensure that transfers subject to Chapter V GDPR have an applicable, valid transfer mechanism before they occur, including onward transfers by Subprocessors.

Where the parties rely on the European Commission’s transfer Standard Contractual Clauses, they must separately execute or expressly incorporate the applicable clauses, select the correct module, complete their annexes and agree necessary supplementary measures and assessments. This DPA does not incorporate transfer clauses by linking to them, and it does not establish participation in an adequacy framework.

Each party shall promptly inform the other if it cannot meet the agreed transfer safeguards. Aivagenta shall suspend the affected transfer where required until a lawful arrangement is established. Any required EU representative, competent supervisory authority and transfer-specific governing law shall be recorded in the applicable transfer documents rather than presumed from the Service Agreement.

## 9. Individual rights requests

Taking account of the nature of processing, Aivagenta shall assist Customer through appropriate technical and organizational measures, insofar as possible, with requests under Chapter III GDPR, including access, correction, deletion, restriction, portability and objection.

If Aivagenta receives a request relating to Customer Personal Data, it shall promptly notify Customer and provide relevant information. It shall not decide the request or respond on Customer’s behalf except on documented instructions or as required by law. Customer is responsible for assessing and responding to the request within applicable deadlines. Assistance arrangements must enable those deadlines to be met.

## 10. Personal data breaches

Aivagenta shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notice shall go to the incident contact in Schedule 1 and shall not be delayed solely because the investigation is incomplete.

As information becomes available, Aivagenta shall provide the nature of the breach, affected data and individuals and approximate numbers where known, likely consequences, measures taken or proposed, and a contact for further information. Information may be provided in phases without undue further delay. It shall preserve relevant records, investigate and take reasonable steps to contain and remediate the breach.

Aivagenta shall assist Customer with applicable notification and mitigation duties. Customer determines its notifications to regulators and individuals, except where law directly requires Aivagenta to notify. Aivagenta shall coordinate any legally required notice where permitted. An incident notice is not, by itself, an admission of liability.

## 11. Assessments, consultation and cooperation

Taking account of the processing and information available to it, Aivagenta shall assist Customer in meeting its obligations under Articles 32–36 GDPR, including security, breach notification, data protection impact assessments and prior consultation. It shall supply relevant information about the agreed processing, systems and safeguards and cooperate with competent supervisory authorities as required by law.

## 12. Demonstrating compliance and audits

Aivagenta shall make available information necessary to demonstrate compliance with its Article 28 obligations and allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer.

The parties shall coordinate reasonable notice, scope, confidentiality and security arrangements. Relevant existing reports may be used to make an audit efficient, but do not replace required audit rights. Arrangements shall protect other customers’ data and must not prevent urgent investigation, statutory rights or regulator access. Each party shall address identified noncompliance within an appropriate, documented period having regard to risk.

## 13. Return, deletion and retention

At the end of processing, Aivagenta shall, at Customer’s choice, return or delete Customer Personal Data and delete existing copies, unless EU or Member State law requires further storage. The return format, active-system deletion deadline, backup deletion deadline and confirmation method must be agreed in Schedule 1. Customer may change its choice by timely written instruction before completion.

Pending scheduled deletion, retained backups shall remain protected and isolated from ordinary service use. If restored for recovery, the applicable deletion instruction shall be reapplied. Any legally required retention shall be limited to that requirement, with notice to Customer unless prohibited. Aivagenta shall confirm completion as agreed. These obligations survive termination for as long as relevant data remains in its possession or control.

## 14. Term, remedies and general terms

This DPA lasts while Aivagenta or its Subprocessors process Customer Personal Data under the Service Agreement. If Aivagenta cannot comply, it shall promptly tell Customer and take steps to remedy the issue. Customer may require suspension of affected processing and may terminate the affected services if the failure cannot be remedied or a competent authority requires termination. Return and deletion obligations continue to apply.

The Service Agreement’s liability, dispute and governing-law provisions apply only to the extent consistent with this DPA and mandatory law. Nothing restricts individuals’ GDPR rights, supervisory-authority powers or liability that cannot lawfully be limited. Mandatory provisions of separately executed transfer clauses take precedence. Changes to this DPA require written agreement by authorized representatives.

Operational privacy notices and requests go to privacy@furie.ai. Contract notices and execution enquiries go to legal@furie.ai. These addresses do not imply appointment of a statutory data protection officer or EU representative.

## Schedule 1. Processing particulars and execution

The following common service description is proposed for review. Both parties must confirm it and complete the customer-specific details and retention terms before execution.

- Provider: Aivagenta, Inc.; privacy contact privacy@furie.ai; contract contact legal@furie.ai. Confirm registered address and authorized signatory in the execution record.
- Customer: record the contracting legal name, registered address, controller or processor role, authorized signatory, privacy contact and incident-notification email.
- Services and subject matter: the subscribed and configured AI contact-center, live-conversation, phone and messaging, WaiPoint ServiceDeck ticketing, SkyBase CRM, knowledge and connected-workflow services specified in the Service Agreement. Record which modules and integrations are enabled.
- Nature and purpose: collecting, receiving, transmitting, storing, organizing, retrieving, analyzing and responding to customer communications; routing interactions; creating tickets and CRM records; supporting authorized agents; carrying out instructed workflows; and securing and supporting those functions. Processing is limited to Customer’s documented purposes.
- Data subjects: Customer’s prospects, customers, callers, website visitors, business contacts, authorized agents and other individuals whose information Customer lawfully supplies.
- Data types: names, contact details, online identifiers, communication content and metadata, recordings where enabled, transcripts, service requests, ticket and CRM fields, agent assignments, knowledge content and relevant activity or support logs. Confirm the actual enabled data types and exclude unnecessary fields.
- Sensitive data: special-category data under Article 9 and criminal-offence data under Article 10 are not authorized unless separately agreed in writing with the required instructions and additional safeguards.
- Confirmed hosting configuration: Hosting.com (formerly A2 Hosting) provides managed Linux servers in the Eastern United States for the application, marketing website, customer databases and uploads. This location statement concerns that hosting environment; other providers’ locations are addressed in Schedule 3.
- Frequency and duration: ongoing during the subscribed services and configured interactions, followed only by the agreed return, deletion and legally required retention periods.
- Instructions: record the authorized contact, configured purposes, permitted locations, integrations and any special restrictions. Material changes require written agreement.
- Return or deletion choice: Customer must select return followed by deletion, or deletion, and agree the export format and delivery method.
- Widget consent configuration: record whether the GDPR consent gate is enabled, the processing before and after a visitor’s choice, and the scope of browser storage, server records and provider processing. Document any separately agreed no-retention requirement and its verification.
- Retention completion required: Aivagenta has not yet confirmed the retention periods for conversations, recordings, logs or backups. Agree the active-system deletion deadline, maximum backup deletion period, relevant log retention, any lawful exceptions and written completion confirmation. No fixed period or zero-retention configuration is asserted by this DPA.
- Execution record required: both parties’ authorized names, titles, signatures or other recorded written acceptance, execution date and agreed schedule version. No signature or acceptance has been applied to this DPA.

## Schedule 2. Technical and organizational measures

Completion required before execution. This schedule must describe actual implemented measures and allocated responsibilities. The categories below are a completion checklist, not a representation that particular controls, certifications or hosting arrangements are already in place.

- Access management: describe account provisioning and removal, role-based permissions, privileged access, authentication and review frequency.
- Data protection: describe encryption in transit and at rest where applicable, key management, separation between customers, and pseudonymization where appropriate.
- Systems and operations: describe secure configuration, patching, vulnerability handling, change management, development safeguards and supplier oversight.
- Logging and detection: identify relevant logs, access to logs, review and alerting processes, and log retention.
- Availability and recovery: describe backup frequency and locations, restore testing, resilience, and agreed recovery arrangements.
- Incident handling: describe escalation contacts, monitoring, investigation, breach notification, evidence preservation and remediation.
- Personnel and premises: describe confidentiality, training, personnel access and relevant physical safeguards, including those provided by hosting vendors.
- Retention and disposal: document deletion from active systems and backups, media handling, return procedures and evidence of completion.
- Testing and accountability: record security review processes, available audit evidence, customer responsibilities and any verified certifications. Do not list unverified certifications.

## Schedule 3. Approved subprocessors, locations and transfers

Aivagenta identified the following service providers on November 6, 2026. The hosting scope and location below were supplied by Aivagenta. The provider service descriptions identify the functions to be covered; the exact products, data fields sent, account contracting entities, further processing locations and applicable supplier terms must be confirmed before execution. Customer’s authorization takes effect only through the executed DPA and completed schedules.

### Hosting.com (formerly A2 Hosting)

- Confirmed service: managed Linux hosting for the Aivagenta/Furie application, marketing website, customer databases and uploads.
- Confirmed primary hosting location: Eastern United States, United States of America.
- Details still to confirm: the account’s contracting legal entity, backup and recovery locations, remote-support access locations, approved onward providers, backup retention and applicable processing and transfer terms.
- Provider reference: [Hosting.com privacy policy](https://terms.hosting.com/privacy-policy). A privacy policy alone does not establish the processing agreement applicable to Aivagenta’s hosting account.

### OpenAI

- Service function: AI processing used by Aivagenta. Confirm the API products, endpoints and features enabled, and which conversation content, knowledge inputs or other Customer Personal Data are sent to them.
- Details still to confirm: contracting entity, organization/project data region, applicable processing terms, enabled retention controls, any stored files or application state, and relevant onward processors and transfer safeguards.
- Retention status: not confirmed for Aivagenta’s account. OpenAI documents retention by endpoint and account controls; approved Zero Data Retention has eligibility and feature limitations. This schedule does not assume that it is enabled.
- Provider reference: [OpenAI API data controls](https://developers.openai.com/api/docs/guides/your-data).

### Twilio

- Service function: telephony and messaging services used by Aivagenta. Confirm the enabled voice, SMS, WhatsApp or other products and the associated phone numbers, communication content, metadata and recordings, where applicable.
- Details still to confirm: contracting entity, configured service regions, recording and message retention, carrier or platform disclosures, onward processors and the processing and transfer terms applicable to the account. Roles may differ for particular regulated telecommunications data.
- Provider reference: [Twilio Data Protection Addendum](https://www.twilio.com/en-us/legal/data-protection-addendum).

### Pusher

- Service function: realtime event and message delivery. Confirm the Pusher products, channel types and event payloads actually used by the application.
- Details still to confirm: contracting entity and applicable processing annex, the application’s selected cluster, additional access locations, event/log retention, onward processors and transfer safeguards. The selected cluster must be recorded from the actual application configuration.
- Provider references: [Pusher security and legal information](https://pusher.com/security/) and [Pusher Channels cluster configuration](https://pusher.com/docs/channels/miscellaneous/clusters/).

### Mailgun

- Service function: email delivery. Confirm the sending/receiving products and the recipient addresses, email content, attachments and delivery events processed for the enabled workflows.
- Details still to confirm: contracting entity, sending-domain/account region, message and event retention, tracking configuration, onward processors and applicable processing and transfer terms.
- Provider references: [Mailgun terms](https://www.mailgun.com/legal/terms/), [Sinch Data Processing Agreement](https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-processing-agreement/) and [Mailgun regions](https://www.mailgun.com/about/regions/). Use the agreement that actually applies to the account.

### Completing and maintaining this inventory

Record each provider’s confirmed legal entity, actual processing scope and data categories, countries of storage and remote access, onward processors, applicable transfer mechanism and Customer’s authorization. Aivagenta’s Eastern U.S. hosting location does not establish the locations used by the other providers. Retention periods for conversations, recordings, logs and backups remain unconfirmed and must be resolved before execution.

Where applicable, complete the transfer assessments, supplementary measures and signed transfer clauses, including their annexes, before the affected transfer begins. Maintain a dated version of this schedule and the agreed notice address for changes. The inventory is for review and does not itself approve providers or constitute an executed transfer mechanism.

## Reference materials

These references support review of this DPA and are not incorporated contract terms or a certification of compliance.

- [Irish Data Protection Commission: processing agreements](https://www.dataprotection.ie/en/dpc-guidance/data-processing-agreements)
- [European Data Protection Board: controller and processor responsibilities](https://www.edpb.europa.eu/sme/learn-the-basics/data-controller-or-data-processor_en)
- [European Data Protection Board: Guidelines 07/2020](https://www.edpb.europa.eu/documents/guideline/guidelines-072020-on-the-concepts-of-controller-and-processor-in-the-gdpr_en)
- [European Commission: individual rights](https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en)
- [European Commission: Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/new-standard-contractual-clauses-questions-and-answers-overview_en)