Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the service agreement or signed proposal (the "Agreement") between Brioways (the "Processor") and the client named in the Agreement (the "Client"). It applies whenever we process personal data on the Client's behalf, for example when an AI voice agent answers the Client's calls, a WhatsApp chatbot replies to the Client's customers, or we move the Client's leads into a CRM.

If this DPA and the Agreement conflict on data protection, this DPA wins. A signed copy is available on request; write to the Grievance Officer named at the end of this page.

1. Definitions

Words such as "personal data", "processing", "Data Fiduciary", "Data Processor", "Data Principal" and "personal data breach" have the meanings given in the Digital Personal Data Protection Act, 2023 and its rules (together, the "DPDP Law").

"Client Personal Data" means personal data that we process for the Client under the Agreement, including call audio, call recordings, transcripts and summaries, WhatsApp and chat messages, names, phone numbers, email addresses, enquiry and order details, and CRM records.

2. Roles

1. The Client is the Data Fiduciary. It decides why and how Client Personal Data is processed.
2. Brioways is the Data Processor. We process Client Personal Data only to provide the services in the Agreement and only on the Client's documented instructions. The Agreement, the agreed system design (call scripts, chat flows, integrations) and the Client's written requests by email or in the shared project WhatsApp group are the Client's instructions.
3. If we believe an instruction breaks the DPDP Law, we will tell the Client and may pause that processing until it is resolved.

3. Consent and notices: who does what

The Client, as Data Fiduciary, is responsible for having a lawful basis for the processing and for giving notices to its customers. To make this practical, we:

• build a short notice into every voice agent greeting stating that the caller is speaking with a virtual assistant and that the call may be recorded, worded as the Client approves;
• build opt-in and opt-out handling into WhatsApp flows and use only Meta-approved message templates for business-initiated messages;
• provide a way for callers and chat users to reach a person at any time;
• give the Client a short description of the processing that it can add to its own privacy notice.

The Client remains responsible for the content of its notices, for consent it collects outside the systems we build (for example on its own forms), and for complying with TRAI telemarketing rules for any outbound calling or messaging.

4. Details of the processing

• Subject matter: providing the AI voice, WhatsApp, follow-up, CRM and related services in the Agreement.
• Duration: the term of the Agreement, plus the return and deletion period in section 10.
• Data Principals: the Client's customers, leads, callers and chat users, and the Client's staff who use the systems.
• Categories of data: contact details, call audio, recordings, transcripts and summaries, chat messages, enquiry, booking and order details, CRM records.
• Sensitive content: not intended. If the Client's business involves health or financial details (for example a clinic or lender), the Client must tell us so we can limit what is captured and stored.

5. Our obligations

We will:

1. process Client Personal Data only as set out in section 2;
2. make sure every person on our team with access is bound by confidentiality and has access only to what they need;
3. keep the security measures in section 6 in place;
4. help the Client respond to requests from Data Principals (access, correction, erasure, grievance) within 7 days of the Client asking, and pass on any request we receive directly within 2 business days without answering it ourselves;
5. help the Client meet its own DPDP Law obligations where they relate to our processing, including breach notifications;
6. not use Client Personal Data to train public or third-party AI models, and not sell or share it for anyone else's purposes.

6. Security measures

• Encryption in transit (TLS) for all data we send and receive, and encryption at rest where the provider supports it.
• Systems run in accounts the Client owns wherever possible (its WhatsApp Business account, CRM and Google Workspace), with access the Client can revoke at any time.
• Named user accounts, multi-factor authentication on admin access, and removal of access when a team member leaves.
• Recordings and transcripts kept only for the retention period the Client sets.
• Regular review of conversations and logs for errors and misuse.

7. Sub-processors

1. The Client authorises us to use the sub-processors listed in the Agreement or its annex for the services the Client buys, for example the telephony provider, the AI speech and language model provider, the Meta Business Solution Provider partner through which we provision the WhatsApp Business Platform, and the Client's chosen CRM.
2. We will give the Client at least 14 days' notice by email before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds; if we cannot resolve the objection, the Client may end the affected service without penalty.
3. We will put written terms in place with each sub-processor that protect Client Personal Data at least as well as this DPA, and we remain responsible to the Client for their work.

8. Transfers outside India

Some sub-processors store or process data outside India. We will tell the Client where each sub-processor stores data, and we will not transfer Client Personal Data to any country restricted by the Government of India under the DPDP Law.

9. Personal data breaches

If we become aware of a personal data breach affecting Client Personal Data, we will tell the Client without undue delay and in any case within 24 hours, with what we know about the nature of the breach, the data and people affected, the likely consequences and the steps taken. We will help the Client notify the Data Protection Board of India and affected Data Principals as the DPDP Law requires.

10. Return and deletion

When the Agreement ends, or earlier if the Client asks, we will, at the Client's choice, return Client Personal Data in a common format (for example CSV exports and audio files) and then delete it from our systems and our sub-processors' systems within 30 days, unless the law requires us to keep it. Data in accounts the Client owns stays with the Client.

11. Audits

We will give the Client the information it reasonably needs to show compliance with this DPA. Once a year, or after a breach, the Client may ask for a written description of our security measures and sub-processors, and may audit our compliance on reasonable notice, at its own cost, during business hours, and subject to confidentiality.

12. Liability and term

Each party's liability under this DPA is subject to the limits in the Agreement. This DPA lasts as long as we process Client Personal Data and survives the end of the Agreement for that period.

13. Governing law

This DPA is governed by the laws of India. The courts named in the Agreement have jurisdiction.