Data Processing Agreement (DPA)
This English version is provided for convenience. In the event of any discrepancy, the French version prevails.
Roles
The Client acts as controller for the data of its prospects, customers and contacts processed via Xenaos. Xenaos acts as processor, on the documented instructions of the Client.
Purposes
- Answering inbound calls and voice conversations
- Outbound calls according to scenarios approved by the Client
- Qualification, appointment booking, reminders and notifications
- Transcription, summarisation and analysis by artificial intelligence
- Reporting and performance monitoring
- Support, maintenance, security
Data processed
- Identity and contact details
- Conversation content: transcripts and summaries (no audio recording of calls)
- Appointment and case file data
- Technical data and logs
Subject matter and duration
This agreement governs the processing carried out by Xenaos on behalf of the Client as part of the Services. It applies for the full term of the contract, then until the data is deleted or returned.
Data subjects
- Callers, customers and prospects of the Client
- Visitors to the Client’s website who write to Sophia
- Client staff using Cockpit and Pocket
Obligations of Xenaos
- Process the data only on documented instructions from the Client, including for transfers outside the European Union, and inform the Client if an instruction appears to infringe data protection law
- Ensure that persons authorised to process the data are bound by confidentiality
- Implement the security measures required by Article 32 GDPR: encryption in transit, access control, separation of data per client, logging and backups
- Assist the Client in responding to data subject requests and in meeting its obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessment)
- Notify the Client of any personal data breach without undue delay after becoming aware of it, with the information needed for its own notification
- Make available to the Client the information needed to demonstrate compliance with this agreement and allow audits, including inspections, by the Client or an auditor it appoints, with reasonable notice
- Not record call audio, not sell the Client’s data and not use it to train artificial intelligence models
Sub-processors
- Netlify (United States) — website hosting
- Supabase (European Union, Frankfurt) — Cockpit and Pocket database
- n8n / Elestio (Germany) — automations
- ElevenLabs (United States) — voice and conversational agents
- Anthropic (United States) — language model
- Google and Microsoft (United States) — calendars and e-mail connected by the Client
- Brevo (France) — confirmation e-mails and texts
- Telnyx (United States) — telephony
- smsmode (France) — text messages
- Twenty — CRM
- Stripe (United States) — payment
The Client gives general authorisation to use these sub-processors. Xenaos informs the Client by e-mail of any addition or replacement at least 30 days in advance; the Client may object on legitimate grounds and, failing agreement, terminate the contract at no cost. Xenaos imposes on each sub-processor obligations equivalent to those of this agreement.
End of contract
At the end of the contract, Xenaos returns the Client’s data in a common format if requested, then deletes it and any existing copies, unless retention is required by law.