Legal

Data Processing Agreement

Version 2026-10-14. Last updated: 14 October 2026. This agreement is provided in English and German. Where the two differ, the English version controls.

This agreement is concluded under Article 28(3) GDPR between your organisation (the controller) and us (the processor). It governs our processing of your end users' personal data — the people who call, chat with or email the agents you set up. It forms part of the Terms and takes effect when an organisation owner accepts it while creating the organisation.

It deliberately points at the privacy policy and Terms rather than repeating them. Where it links, the linked text is part of this agreement and is binding, not background reading.

Negotiated agreements. If your organisation signed a separate, negotiated data processing agreement with us, that one governs and this one does not apply to you. Partners who run the platform in their own cloud environment conclude their own agreements with their customers; we are not a party to those.

1. The parties

Your processor is visibleIT Inc., 12625 Caballo Ct, Estero, FL 33928, USA, which owns and operates the platform and contracts with customers in every country. Its representative in the European Union under Article 27 GDPR is visibleIT GmbH, Hunoldstr. 13, 34479 Breuna, Germany. Company details are in the privacy policy §1.

The controller is your organisation as named in your profile. When you accept, we record which company is your processor, the version you accepted and the date.

2. Scope

What we process and why is set out in Annex I. Processing lasts for the term of your subscription plus the retention windows described there.

This agreement covers your end users' data only. Data about you and your colleagues — account profiles, billing contacts, support email — is processed by us as controller under the privacy policy, not under this agreement.

3. We act on your instructions

We process your end users' personal data only on your documented instructions, including for international transfers, unless law requires otherwise — in which case we tell you first, unless that law forbids it.

Your instructions are this agreement, the Terms, and how you configure the platform: your agents' behaviour instructions, knowledge base, tables, tools, retention and channel settings. Using a documented feature is an instruction.

We will tell you if we think an instruction breaches data protection law.

We never use your end users' data for our own purposes, never sell it, never analyse it across customers and never use it to train AI models; our AI and speech providers are contractually bound not to train on it either. Our staff access conversation content only to provide the service, when you ask us for support, or to investigate abuse or a security incident or where the law requires it.

4. Confidentiality

Everyone we authorise to process this data is bound by confidentiality, by contract or statutory duty, and gets access only to what their role requires.

5. Security

We implement the Article 32 measures listed in Annex II. We may improve them as the platform develops; we will not reduce the level of protection.

6. Sub-processors

You give us general authorisation to use the sub-processors in Annex III. Each is engaged under a written contract no less protective than this agreement, and we stay fully liable to you for what they do.

Adding or replacing one triggers the 30 days' advance notice and objection right set out in the privacy policy §5, which applies as a term of this agreement.

Your own integrations are not sub-processors. When you connect your mailbox, calendar or another system, data flows there under your own contract with that provider.

7. How we help you meet your obligations

End-user rights requests. You answer them; we assist with the technical means — transcript export, per-agent retention controls, deletion. A request that reaches us directly is forwarded to you rather than answered by us.
Breaches. We notify you without undue delay after becoming aware of a breach affecting your end users' data, with what you need for your own duty under Articles 33 and 34. Our own authority-notification commitment is in the privacy policy §11.
Impact assessments. We give reasonable assistance with assessments and prior consultations under Articles 35 and 36, given the nature of the processing and what we know.

8. Deletion and return

You can export all of your data at any time while the subscription is active, as one file (Settings → Export your data). Export what you want to keep before closing your organisation — after that the timetable in the Terms §13 applies: soft delete, a 90-day window in which we restore it or send you a complete export on request, then permanent deletion.

Retention during the subscription follows the privacy policy §7. We keep data past these points only where law requires it, principally statutory invoice retention.

9. Information and audits

We make available what you need to demonstrate Article 28 compliance, and allow for and contribute to audits by you or an auditor you mandate. In the first instance we do this with our own documentation and our infrastructure providers' certifications (ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3), as noted in the Terms §15.

10. International transfers

We are established in the United States. Where you are established in the EEA, the United Kingdom or Switzerland, or the GDPR otherwise applies to this processing, the transfer of your end users' personal data to us is governed by the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated into this agreement by reference; this agreement supplies the details their annexes ask for. Within those clauses: the docking clause (Clause 7) and the optional redress clause (Clause 11) do not apply; sub-processors are authorised generally, with the notice set out in the privacy policy §5 (Clause 9(a), option 2); the competent supervisory authority is the one of the member state in which our EU representative is established, Germany (Clause 13); and the clauses are governed by German law, with disputes before the courts of Germany (Clauses 17 and 18). For transfers subject to UK data protection law, the International Data Transfer Addendum issued by the UK Information Commissioner applies as well; for transfers subject to Swiss law, the clauses apply with the adaptations the Swiss Federal Data Protection and Information Commissioner requires. Onward transfers to our sub-processors rely on the mechanisms in the privacy policy §6, which applies as a term of this agreement.

11. Precedence and liability

On a data protection matter this agreement prevails over the Terms; on everything else the Terms prevail. A signed, negotiated agreement prevails over both.

The liability provisions of the Terms apply here too. Nothing in this agreement limits a data subject's rights or either party's liability under Article 82 GDPR.

12. Term and changes

This agreement runs from your acceptance for as long as we process your end users' personal data.

We may update it for changes in law, in the platform, or in our sub-processors. Material changes are notified at least 30 days ahead, and we record which version your organisation accepted, so what was agreed and when is always clear.

13. US state privacy laws

Where US state privacy laws apply to your end users' personal information — for example the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable laws in other states — we act as your "service provider" or "processor" as those laws define it. We certify that we understand the following restrictions and will comply with them:

We process that personal information only for the business purposes of providing the platform to you, on your instructions under this agreement.
We do not sell or share it, as those laws define "sell" and "share".
We do not retain, use or disclose it for any other purpose, or outside the direct business relationship between you and us.
We do not combine it with personal information from other sources, except as those laws permit.
We comply with the obligations those laws place on us and provide the level of privacy protection they require. If we can no longer meet these obligations, we tell you.
You may take reasonable and appropriate steps to stop and remediate unauthorised use of that personal information.

Annex I — What we process

Subject matter: Running AI agents on your behalf that handle voice calls, web chat and email with your end users.
Nature and purpose: Receiving and transcribing conversations; generating replies; retrieving from your knowledge base; reading and writing your data tables; extracting structured fields such as an appointment time or a lead; sending follow-up email you configure; and analysing your inbound conversations.
Categories of data subjects: Your end users — callers to your voice agents, web-chat visitors, people who email your agents, and anyone whose details appear in a conversation or in data you upload.
Types of personal data: Caller phone number; call audio and transcript; chat transcript and visitor IP address; email address, message content and attachments; fields the agent extracts (a name, an appointment time, a lead score); and whatever else an end user chooses to say or write. Call audio is held only for as long as it takes to transcribe the call and is then deleted.
Special categories: Not processed deliberately. If an end user volunteers such data — health information, say — it is processed only as needed to deliver the service. Do not configure agents to solicit special-category data without your own legal basis.
Duration and retention: The term of your subscription, plus the retention windows in the privacy policy §7 (90 days by default for conversations, or the window you set per agent; a single conversation can be deleted at any time).
Frequency: Continuous, for as long as your agents are active.

Annex II — Technical and organisational measures

The measures we implement under Article 32 GDPR. This is the same list published as §11 of the privacy policy — one set of measures, stated there as a notice and here as a contractual commitment.

All traffic is encrypted in transit (TLS 1.2 or higher).
Data at rest is encrypted using our infrastructure provider's built-in encryption.
Sign-in supports passkeys (WebAuthn) and authenticator-app codes. Operator-level access requires a passkey.
Tenant isolation is enforced by the platform — one organisation cannot read or write another organisation's data.
Secrets (API keys, OAuth refresh tokens) are held in a dedicated secrets manager, not in the database.
Every state-changing action by our operators is logged with a reason and is auditable.
We never use customer conversations to train AI models or to analyse them across customers; each organisation's conversations serve that organisation only.
No voiceprints, no biometric identifiers. We do not extract, generate or store voiceprints, faceprints or any other biometric identifier from your end users' audio, and we do not use audio to recognise the same person across calls. Our underlying infrastructure providers inherit the same instruction.
Contact details are masked in stored transcripts by default — phone numbers, email addresses and long numbers are replaced with markers in the saved conversation. The after-call steps that need the real values run first, on a short-lived unmasked working copy that is then deleted and is never readable from the application.

We may improve these over time; we will not reduce the level of protection.

Annex III — Approved sub-processors

The sub-processors you authorise under section 6 — the same list published as §5 of the privacy policy, so the two can never disagree. Processing locations and transfer mechanisms are described there and in §6.

visibleIT GmbH: Our affiliated company in Germany. Operates the platform's cloud and telephony accounts (Google Cloud, Twilio) on our behalf, under a written agreement and on our instructions.
Hunoldstr. 13, 34479 Breuna, Germany
Google Ireland Limited / Google LLC: Cloud infrastructure — hosting, databases, authentication, file storage, scheduling, logging and mobile notification delivery — together with speech-to-text and the AI models behind our voice, email and analysis features. Processing takes place in the European Union; individual AI features may be served from the provider's global infrastructure. Certified under the EU-US Data Privacy Framework.
cloud.google.com/terms/cloud-privacy-notice · policies.google.com/privacy
Twilio Ireland Limited: Carrier and subcontractor for voice connectivity: telephone numbers and call connectivity for voice agents, provided as an integral part of the service. This applies to numbers we provide. Where you connect your own carrier account and bring your own numbers, that carrier is your processor under your own contract with them, not our sub-processor — the call audio still reaches our AI processing described above.
twilio.com/legal/privacy
ActiveCampaign, LLC (Postmark): Sending and receiving email for the platform and for agents' mailboxes. Certified under the EU-US Data Privacy Framework.
postmarkapp.com/eu-privacy · postmarkapp.com/privacy-policy
Cloudflare, Inc.: Protection and delivery of our public website. Only public marketing pages pass through it.
cloudflare.com/privacypolicy
Stripe, Inc.: Card payments and invoicing.
stripe.com/privacy