Data Processing Agreement (Article 28 GDPR)

Parties and acceptance

This agreement (the "DPA") is entered into between the customer company that subscribes to the Service or signs an agreement with AUDIOLIZ (hereinafter the "Customer") and:

AUDIOLIZ, a French simplified joint-stock company (SAS), 19 rue du Pont Colbert, 78000 Versailles, France, registered with the Versailles Trade and Companies Register under no. 940 631 799, EU VAT no. FR24 940 631 799, represented by Mr David Klajman, President (hereinafter "Audioliz").

The Customer accepts this DPA when subscribing to the Service, at the same time as the terms of use to which it is an annex. No handwritten signature is required: accepting the terms of use concludes this agreement within the meaning of Article 28 GDPR.

1. Purpose and scope

1.1 This agreement (the "DPA") sets out the conditions under which Audioliz processes personal data on behalf of the Customer in the course of providing the ScanBiz service (the "Service"), under the service agreement entered into between the Parties or the ScanBiz terms accepted by the Customer (the "Contract").

1.2 The DPA forms an integral part of the Contract. In case of conflict, the DPA prevails on all matters relating to the protection of personal data.

1.3 The terms "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given to them by the GDPR. Where the Customer is established in the United Kingdom or Switzerland, references to the GDPR also include the UK GDPR and the Data Protection Act 2018, or the Swiss Federal Act on Data Protection (FADP), as applicable.

2. Roles of the Parties

2.1 The Customer is the controller of the personal data it entrusts to the Service (content of the conversations of its staff and their counterparts, account data). It alone determines the purposes and means of the processing, and warrants that it has a lawful basis, has informed the data subjects and complies with the rules applicable to the recording of conversations.

2.2 Audioliz is a processor: it processes this data solely to provide the Service, on the Customer's documented instructions.

2.3 By default, this DPA is entered into directly between the Customer, as controller, and Audioliz, as processor. By way of exception, where the Customer itself acts as a processor on behalf of its own customers — which presupposes that it actually processes personal data on their behalf under a contract complying with Article 28 GDPR entered into with them — Audioliz acts as a sub-processor. The Customer then warrants that the controller has authorised the use of Audioliz, that the instructions passed on are those of the controller, and that the commitments in this DPA are at least equivalent to those it has itself undertaken.

2.4 A distributor that merely markets the Service, invoices it and provides first-level support, without processing personal data on behalf of its end customers, is not a processor within the meaning of Clause 2.3: this DPA is then entered into directly between the end customer, as controller, and Audioliz.

3. Customer's instructions

3.1 The Customer's documented instructions consist of the Contract, this DPA, the configuration of the Service chosen by the Customer (connected sources, languages, retention periods, users) and any subsequent written instruction compatible with the Service.

3.2 Audioliz processes the data only on those instructions, including with regard to transfers to a third country, unless required to do so by Union or French law; in that case, Audioliz informs the Customer before processing, unless the law prohibits it.

3.3 Audioliz immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

3.4 Audioliz does not use the Customer's data to train general-purpose artificial intelligence models, nor for its own purposes other than providing and securing the Service for the Customer. Improvement of the Service may rely only on aggregated data from which no data subject can be identified.

4. Confidentiality

Audioliz ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and have access only to the data necessary for their duties.

5. Security of processing

Audioliz implements the technical and organisational measures described in Annex 3, appropriate to the risk, in accordance with Article 32 GDPR, and keeps them up to date. Audioliz may update them, without reducing the overall level of protection.

6. Sub-processors

6.1 The Customer gives Audioliz general authorisation to engage the sub-processors listed in Annex 2 for the functions indicated there.

6.2 Audioliz informs the Customer, by e-mail to its administrator's address or by notification within the Service, of any intended addition or replacement of a sub-processor, at least thirty (30) days before it takes effect. The Customer may object in writing, on legitimate data-protection grounds, within that period. If no solution is agreed, the Customer may terminate the Contract for the part of the Service concerned, without charge or indemnity, before the change takes effect.

6.3 Audioliz imposes on each sub-processor, by contract, data protection obligations at least equivalent to those of this DPA, and remains fully liable to the Customer for the performance of its sub-processors' obligations.

7. Data subject rights

Taking into account the nature of the processing, Audioliz assists the Customer, through appropriate technical and organisational measures (export, search and deletion functions in the Service, support assistance), in responding to requests to exercise data subject rights (access, rectification, erasure, restriction, portability, objection). Audioliz forwards to the Customer, without undue delay, any request it receives directly and does not answer it itself, unless instructed by the Customer.

8. Personal data breaches

8.1 Audioliz notifies the Customer of any personal data breach affecting the Customer's data without undue delay and no later than forty-eight (48) hours after becoming aware of it, at the Customer administrator's e-mail address.

8.2 The notification describes, to the extent information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and the contact point. Information may be provided in phases.

8.3 Audioliz cooperates with the Customer and provides the reasonable assistance needed for the Customer's own notifications to the supervisory authority and to data subjects (Articles 33 and 34 GDPR).

9. Impact assessment and prior consultation

Audioliz provides the Customer, taking into account the nature of the processing and the information available to it, with the reasonable assistance needed to carry out a data protection impact assessment and, where applicable, a prior consultation of the supervisory authority (Articles 35 and 36 GDPR). Standard documentation of the Service is provided for that purpose; specific assistance may be charged at the applicable rate, after an accepted quote.

10. Data location and international transfers

10.1 Data is hosted in the European Union (application and database with Heroku, "eu" region; files with Amazon Web Services, Paris). Transcription (ElevenLabs), analysis (OpenAI) and technical monitoring (Sentry, Papertrail, SendGrid) are carried out in the United States, for the duration of the processing (Annex 2).

10.2 Heroku, Amazon Web Services, Recall.ai, Stripe and Redis are used in their European Union regions. The transfers to the United States described in Clause 10.1 rely on the EU-U.S. Data Privacy Framework where the provider is certified under it (Annex 2). Otherwise, any transfer to a third country without an adequacy decision is governed by the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914).

10.3 If the Data Privacy Framework ceases to apply to a sub-processor — withdrawal or non-renewal of its certification, or invalidation of the framework itself — the standard contractual clauses referred to in Clause 10.2 apply to that transfer by operation of this Clause, without further formality.

10.4 Customer established in the United Kingdom: the standard contractual clauses are supplemented by the ICO's UK International Data Transfer Addendum. Customer established in Switzerland: references to the supervisory authority and competent courts are to be read as the Federal Data Protection and Information Commissioner (FDPIC) and the Swiss courts.

11. Audits and documentation

11.1 Audioliz makes available to the Customer all information necessary to demonstrate compliance with its obligations: description of security measures, reports or certifications of its hosting providers, answers to a reasonable security questionnaire, at most once a year.

11.2 If this is not sufficient, the Customer, or an independent auditor appointed by it and bound by confidentiality, may carry out an on-site or remote audit, at most once in any twelve (12) month period, on thirty (30) days' written notice, during business hours, without disrupting the Service or accessing the data of Audioliz's other customers, and at the Customer's expense. Findings are shared with Audioliz, which has a reasonable period to remedy any gaps identified.

11.3 The frequency limitation in Clause 11.2 does not apply where an audit is required by a competent supervisory authority or follows a personal data breach affecting the Customer's data.

12. End of processing: return and deletion

12.1 At the end of the Contract, the Customer chooses between the return and the deletion of its data. It may export its data itself from the Service or ask Audioliz for a return in a structured, commonly used format, for thirty (30) days.

12.2 After that period, or upon the Customer's written request, Audioliz deletes the Customer's data and copies thereof within thirty (30) days, unless retention is required by law, and confirms this in writing on request. Continuous database protection allows point-in-time recovery over the last seven (7) days (Annex 3); no backup is retained beyond that window, so that deleted data disappears from all copies within the thirty (30) day period referred to above.

13. Liability

Each Party's liability under this DPA is subject to the limitations and exclusions set out in the Contract, except where they conflict with a mandatory provision of law. Each Party is liable for the administrative fines and damages attributable to it under Article 82 GDPR.

14. Term, governing law

14.1 The DPA applies for as long as Audioliz processes the Customer's data, including after the end of the Contract until the data is deleted.

14.2 The DPA is governed by the law applicable to the Contract. It is drawn up in French and English; where both versions are signed by the Parties, the French version prevails in case of discrepancy. The Parties may amend it by written mutual agreement to bring it into line with changes in regulation or supervisory authority guidance.

Annex 1 — Description of the processing

• Subject matter — Provision of the ScanBiz service: receipt, transcription, analysis and presentation of the Customer's business conversations (phone calls, e-mails, meetings), generation of alerts and summaries.
• Purposes — Monitoring the quality of the Customer's customer relationship, supervising its staff's exchanges, detecting alerts defined by the Customer, producing summaries. Audioliz pursues no purpose of its own.
• Nature of the processing — Collection through sources connected by the Customer (phone system, mailbox, calendar), recording, storage, automatic transcription, analysis by language models, display, export, deletion.
• Categories of data subjects — The Customer's staff (agents, supervisors, administrators); the Customer's counterparts (customers, prospects, suppliers, partners, any person taking part in a processed conversation).
• Categories of data — Identity and business contact details; account identifiers; conversation content (voice recordings, transcripts, e-mails, meeting notes), analysis outputs (scores, alerts, summaries); billing data (excluding card numbers, held by Stripe); technical logs (IP addresses, timestamps, actions).
• Special categories — None by design. If a counterpart spontaneously discloses sensitive data (health, opinions…) during a conversation, it is processed like the rest of the content, under the responsibility of the Customer, which ensures the lawfulness of the recording and may have it deleted.
• Duration of the processing — Term of the Contract, then return and deletion period (Clause 12).
• Retention periods — Account data: term of the Contract, then deletion or anonymisation within 12 months. Analysed content: period configured by the Customer in the Service, deletion on request. Technical logs: 12 months at most.
• Location — Hosting in the European Union (Heroku "eu" region, AWS Paris). Transcription, analysis and technical monitoring in the United States, for the duration of the processing (Clause 10, Annex 2).

Annex 2 — Authorised sub-processors (as at 10 October 2026)

Each entry gives the sub-processor, its function, the processing location and the safeguard covering the transfer.

• Salesforce, Inc. (Heroku) — application and database hosting — EU ("eu" region) — DPF + SCCs 2021/914.
• Amazon Web Services EMEA SARL — storage of audio files and documents — Paris, France (eu-west-3) — DPF + SCCs 2021/914.
• Recall.ai, Inc. — calendar sync and meeting assistant — EU (eu-central-1) — SCCs 2021/914.
• Stripe Payments Europe, Ltd. — online payment, invoicing, subscription management — Ireland (EU) — no transfer.
• Redis Ltd. (Redis Cloud) — processing cache and job queue — EU (hosting provider's "eu" region) — Israel: adequacy decision.
• ElevenLabs, Inc. — transcription of recordings — United States — DPF + SCCs 2021/914.
• OpenAI Ireland Ltd (and OpenAI affiliates) — conversation analysis (scorecards, summaries, alerts) — United States — SCCs 2021/914.
• Twilio Inc. (SendGrid) — sending of alert and notification e-mails — United States — DPF + SCCs 2021/914.
• Functional Software, Inc. (Sentry) — application error monitoring — United States — DPF + SCCs 2021/914.
• SolarWinds (Papertrail) — application logs — United States — SCCs 2021/914.

The current list is kept by Audioliz and provided to the Customer on request; any change follows the procedure in Clause 6.

Data Privacy Framework certification is assessed per legal entity. Absent a valid certification for the entity concerned, the transfer is governed by the standard contractual clauses (Clause 10.3).

Annex 3 — Technical and organisational measures

• Encryption of data in transit (HTTPS/TLS) and at rest (encrypted database, server-side encrypted file storage).
• Logical segregation of data per customer workspace; role-based access control within the application.
• Strong authentication (MFA) for administrator accounts of the application hosting provider; least privilege; access revoked when a staff member leaves.
• Logging of access and technical operations, retained for no more than twelve (12) months.
• Continuous database protection (point-in-time recovery over the last seven (7) days) and a high-availability replica, in the hosting provider's EU region.
• Hosting of the application, database and files with Heroku (Salesforce) and Amazon Web Services, certified ISO 27001 and SOC 2, in their European Union regions.
• Deletion of a customer workspace's data at the Customer's request and at the end of the contract, within thirty (30) days (Clause 12). Transient copies held by the transcription and analysis providers are deleted under their own policy (OpenAI: thirty (30) days at most).
• Staff confidentiality undertakings; security and data protection awareness.
• Security incident management procedure with notification to the Customer (Clause 8).