Data processing agreement

The parties are Individual Entrepreneur Aleksandra Ilina (identification code 345855906), which operates Diallo (“we”, the processor), and the business that uses Diallo under our terms of service (“the customer”, the controller).

• For the data of the customer’s callers, the customer decides why and how it is processed and is the controller; we are the processor (in the terms of the Law of Georgia “On Personal Data Protection”, an authorised person).
• For the data of the customer’s own users of the dashboard and for billing, we are a separate controller; that processing is described in our Privacy policy.

We process callers’ data only to provide the service to the customer: to answer incoming calls with an AI voice agent, record and transcribe them, capture the details the agent is set up to ask for, create requests and appointments, produce an automatic summary of each call and deliver the results to the dashboard and to the channels the customer connects (for example Google Calendar, a CRM or Telegram).

Processing lasts for as long as the customer uses the service, and after that until the data is deleted under section 11.

Data subjects: people who call the customer and talk to its agent by phone or in the browser.

• the audio recording of the call and its transcript;
• for a phone call, the caller’s number;
• what the caller says, including the details the agent asks for: name, contact details, the service needed, preferred time;
• appointments and requests created from the call, and the automatic summary and mood of the call;
• technical data: date, duration, language, how the call ended.

Special categories of data (for example health data) are not needed for the service. A caller may still mention them, for example when calling a clinic. The customer decides whether the agent may ask about such data and must have a lawful basis for it; we protect it with the same measures as all call data.

We process callers’ data only on the customer’s documented instructions. The instructions are these terms and the agent’s settings in the dashboard: its greeting, instructions, knowledge, the details it asks for and the integrations it uses. Other instructions can be given in writing to envmotion@gmail.com.

If we believe an instruction breaks the law, we will tell the customer and may suspend carrying it out until it is confirmed or changed.

We do not use callers’ data for our own purposes: we do not sell it, do not use it for advertising and do not use recordings or transcripts to train AI models.

• keep the data confidential; anyone we authorise to access it is bound by confidentiality;
• apply the technical and organisational measures described in our Security overview;
• help the customer respond to callers who use their rights (section 10);
• help the customer meet its obligations on security, breach notification and, where needed, data protection impact assessment, taking into account the information available to us;
• give the customer the information needed to show that this agreement is complied with (section 10).

• have a lawful basis for processing its callers’ data and for recording calls;
• inform callers at the start of the call that they are talking to an AI agent and that the call is recorded (when we set up an agent, we put these notices in its greeting; see the AI and call recording notice);
• set the agent up so that it collects only the data needed for the purpose, and not card numbers, passwords or codes;
• keep access to its dashboard secure and decide who in the business may see call data.

The customer gives us general authorisation to engage sub-processors. The current list, with what each one does and where, is on the Sub-processors page.

• we bind each sub-processor by contract to data protection obligations equivalent to this agreement, and we remain responsible to the customer for its work;
• we tell customers about a new or replacement sub-processor at least 14 days in advance, by email or in the dashboard;
• the customer may object on reasonable data protection grounds within that period. We will then look for a solution together; if there is none, the customer may cancel the subscription before the change takes effect.

In an urgent case, for example when a provider stops working, we may replace a sub-processor sooner and will tell customers as soon as possible.

Our servers and database are in the European Union (Poland). Some sub-processors process data in other countries, including the United States. We transfer data abroad only where the Law of Georgia “On Personal Data Protection” allows it: to a country with an adequate level of protection, or with appropriate safeguards in the contract with the recipient.

If we become aware of a breach that affects the customer’s callers’ data, we will notify the customer without undue delay and no later than 48 hours after we become aware of it. The notice will describe what happened, what data and roughly how many people are affected, the likely consequences and what we have done and recommend. Information we do not yet have we will send as soon as we have it.

This lets the customer notify the Personal Data Protection Service of Georgia within the time the law sets and, where needed, its callers. We will help with the information we have.

If a caller contacts us directly about their data, we will pass the request to the customer without undue delay and will not answer it on the customer’s behalf without its instruction, except to tell the caller where to turn.

The customer can see, export and delete individual calls (including recordings and transcripts) in the dashboard. Where that is not enough to answer a request, we will help on request.

On request we will answer the customer’s reasonable questions and questionnaires about how we process its data and give the documents needed to show compliance. An on-site audit is possible by prior agreement, with reasonable notice, no more than once a year and at the customer’s expense, unless it follows a breach on our side.

Call recordings are deleted automatically 90 days after the call. Transcripts, requests and appointments are kept while the workspace exists, unless the customer deletes them earlier.

When the workspace is closed, the customer may ask within 30 days for an export of its data. After that we delete the customer’s data, except what the law requires us to keep. Backup copies are overwritten in the normal course, within 30 days.

Each party’s liability under this agreement is governed by the Terms of service. If this agreement and the terms conflict on the protection of callers’ data, this agreement prevails.

We may update this agreement as the law or the service changes; material changes are announced as described in the terms of service. It is governed by the law of Georgia.