Data Processing Agreement, CallMerlin

This Data Processing Agreement ("DPA") forms an integral part of the General Terms and Conditions of CallMerlin and applies to the processing of personal data by CallMerlin (the "Processor") on behalf of the User (the "Controller"). This DPA is drawn up in accordance with Article 28(3) of Regulation (EU) 2016/679 (GDPR).

In this DPA, the following definitions apply: a) "Controller": the User who determines the purposes and means of the processing of personal data. b) "Processor": Small Guy B.V. (CallMerlin), which processes personal data on behalf of the Controller. c) "Data subject": the identified or identifiable natural person to whom the personal data relates. d) "Personal data": all data as referred to in Article 4(1) GDPR. e) "Processing": any operation as referred to in Article 4(2) GDPR. f) "Sub-processor": a third party engaged by the Processor to process personal data on behalf of the Controller. g) "Data breach": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

2.1. The Processor processes personal data solely in the context of providing the CallMerlin platform to the Controller. 2.2. The processing lasts for as long as the agreement between the parties is in force. After termination, personal data is deleted in accordance with Article 10 of this DPA.

The processing concerns: a) Handling inbound telephone calls and voice widget conversations via the AI voice assistant; b) Transcribing calls and generating summaries; c) Executing actions in Connected Services at the instruction of the Controller (such as creating appointments, tickets or records); d) Verifying PIN Users, including SMS-based two-factor authentication; e) Storing and displaying call logs and statistics; f) Sending notifications about calls and executed actions.

The following categories of personal data are processed: a) Contact data of Callers: name, telephone number, email address, insofar as shared during a call. b) Call data: transcripts, time, duration, outcome of the call. Audio is not retained. c) Appointment and request data: date, time, subject and other details shared by the Caller. d) PIN User data: name, PIN configuration, verification phone number. e) Data in Connected Services: data retrieved from or written to Connected Services at the instruction of the Controller. In principle, no special categories of personal data (Art. 9 GDPR) are processed. Callers may however spontaneously share such data during a call (for example health information when scheduling an appointment). The Controller is responsible for the lawfulness of that processing and for configuring the voice assistant accordingly.

The personal data relates to: a) Callers who interact with the Controller's voice assistant, by telephone or via the voice widget. b) Employees and PIN Users of the Controller. c) End Clients of the Controller (in the case of Agencies). d) Persons whose data is retrieved from or written to Connected Services at the instruction of the Controller.

6.1. The Processor processes personal data solely on the basis of written instructions from the Controller, unless required to do so by Union or Member State law. The configuration of the voice assistant and Connected Services by the Controller counts as such an instruction. 6.2. The Processor ensures that persons authorized to process personal data have committed themselves to confidentiality. 6.3. The Processor implements appropriate technical and organizational measures as referred to in Article 32 GDPR, including: a) Encryption: TLS 1.3 (transit), AES-256 (rest), including credentials of Connected Services; b) Access control: RBAC, least-privilege, 2FA; c) Data isolation: multi-tenant separation per account; d) Monitoring and logging; e) Daily encrypted backups; f) Incident response plan. 6.4. The Processor assists the Controller in fulfilling its obligations under Articles 32 to 36 GDPR (security, breach notification, DPIA, prior consultation). 6.5. The Processor assists with data subject requests under Chapter III GDPR (access, rectification, erasure, portability, objection). Costs for assistance that reasonably exceed normal cooperation may be charged to the Controller.

7.1. The Controller grants the Processor general written authorization to engage sub-processors. 7.2. The Processor uses the following categories of sub-processors: a) Google Cloud Platform (EU), hosting and storage b) Cloudflare, Inc. (EU configuration), CDN and DDoS protection c) Stripe, Inc. / Stripe Payments Europe, Ltd., payment processing d) Telecommunications carriers, telephone numbers, call routing and SMS delivery e) xAI, Inc. (Grok), speech recognition and execution of AI services f) Email providers, transactional email delivery 7.3. The Processor informs the Controller at least 30 days in advance of the intention to engage a new sub-processor or replace an existing one. 7.4. The Controller may object to a new sub-processor with reasons within 14 days of notification. If the objection is justified and the Processor cannot provide a reasonable alternative, the Controller has the right to terminate the agreement without charge. 7.5. The Processor imposes on each sub-processor by agreement the same obligations as set out in this DPA.

8.1. The Processor notifies the Controller without undue delay, and no later than 48 hours after discovery, of a Data breach. 8.2. The notification includes at least: a) the nature of the breach, including (approximately) the categories and numbers of data subjects and personal data records affected; b) the name and contact details of the Processor's point of contact; c) the likely consequences of the breach; d) the measures taken or proposed to address the breach and mitigate its adverse effects. 8.3. The Processor provides reasonable assistance to the Controller in fulfilling its notification obligations to the supervisory authority (Art. 33 GDPR) and data subjects (Art. 34 GDPR).

9.1. The Processor makes available all information necessary to demonstrate compliance with the obligations under Article 28 GDPR. 9.2. The Controller has the right to conduct (or have conducted) an audit a maximum of once per year. The audit is announced at least 30 days in advance and takes place during business hours. 9.3. The costs of the audit are borne by the Controller, unless the audit reveals a material shortcoming attributable to the Processor. 9.4. If multiple Controllers request the same audit, the Processor may propose engaging an independent third-party auditor whose report is shared with all relevant Controllers.

10.1. After termination of the agreement, the Processor provides the Controller with 30 days to export personal data (including call transcripts) via the Platform's export functionality. 10.2. After the export period, the Processor irrevocably deletes all personal data, including all copies, unless retention is required by Union or Member State law. 10.3. The Processor confirms deletion in writing upon request.

11.1. The Processor processes personal data in principle exclusively within the European Economic Area (EEA). 11.2. If transfer to a third country is necessary (e.g., for AI services or telephony routing), this is done exclusively on the basis of an adequacy decision, Standard Contractual Clauses, or the EU-US Data Privacy Framework, supplemented by appropriate technical measures. 11.3. The Processor informs the Controller in advance of intended transfers to third countries.

12.1. This DPA is governed by the laws of the Netherlands. 12.2. Disputes shall be submitted to the competent court in the district of Zeeland-West-Brabant. 12.3. In the event of conflict between this DPA and the General Terms, this DPA shall prevail with respect to the processing of personal data.