Data Processing Agreement

2. Subject Matter, Nature, Duration

• Subject matter: processing End-User personal data to deliver the AI Agents and workspace features the Controller has subscribed to.
• Nature of processing: collection, storage, transmission, AI generation of replies, summaries and drafts, AI reading of photos End Users send, AI sorting of email forwarded from the Controller's inbox, automated checks of conversations for signs of a scam (a warning to the Controller; conversations are not blocked), measurement of use against plan allowances, answering inbound calls, checking prospect email addresses with a verification service, and integration with Controller-connected systems (calendar, CRM, Google Business Profile).
• Duration: for the term of the Controller's subscription, plus the post-termination retention windows in §10.
• Categories of data subjects: leads, prospects, customers, and other individuals the Controller engages through the platform, and anyone who writes to an email address the Controller forwards to Velogics (which can include suppliers, job applicants and other non-customers).
• Categories of personal data: identifiers (name, email, phone, address), conversations (chat, call transcripts, SMS, email including email forwarded from the Controller's inbox, and photos or files attached to them), appointment data, CRM records (notes, quotes, jobs, invoices), messaging consent records, public reviews, AI-generated summaries of conversations, and any other information End Users provide to or about themselves through Controller-configured flows.

3. Controller Instructions

Velogics will process End-User personal data only on the documented instructions of the Controller, which are given by the Controller's configuration of the platform (knowledge-base content, agent settings, campaign settings, schedules) and by use of the platform's features. If Velogics is required by applicable law to process for another reason, we will notify the Controller unless that law prohibits the notice on important public-interest grounds. Velogics will tell the Controller if it believes an instruction breaks applicable data-protection law. Velogics does not sell End-User personal data or use it for its own purposes, other than to operate, secure and improve the platform.

5. Security Measures

Velogics maintains the technical and organisational measures described in Privacy Policy § 9, including encryption in transit and at rest, application-level encryption of credentials and message content, role-based access within each account, logging of administrative access, separation of each Operator's data, and authentication of incoming webhooks. These measures may be updated from time to time provided the level of security is not materially decreased.

6. Confidentiality of Personnel

Velogics limits access to End-User personal data to personnel and contractors who need it to provide support, security or operations, and requires them to keep it confidential.

7. Personal Data Breach Notification

If Velogics becomes aware of a personal data breach (including a breach of security safeguards under Canadian law) affecting End-User personal data, we will notify the affected Controllers without undue delay after confirming it. The notice will include the nature of the breach, categories and approximate number of data subjects and records affected (to the extent then known), likely consequences, and the measures taken or proposed to address it. Velogics will cooperate reasonably with the Controller's notification and investigation obligations.

8. Data Subject Requests

The Controller is responsible for responding to End-User requests to exercise rights under applicable data-protection law (access, rectification, erasure, portability, restriction, objection). Velogics will provide the Controller with the tools and reasonable assistance needed to fulfil such requests through the platform's export and deletion features, and will promptly forward to the Controller any data-subject request received directly by Velogics that relates to the Controller's End Users.

9. Audits and Assistance

Velogics will make available to the Controller, on reasonable request, the information necessary to demonstrate compliance with this DPA, typically satisfied by current security documentation, sub-processor information, and responses to a reasonable security questionnaire. For Controllers with audit-right obligations under applicable law, the parties will agree on the scope, timing, and confidentiality of the audit in good faith; audits are at the Controller's expense and limited to once per 12 months absent a documented breach or regulatory mandate. Velogics will also give the Controller the information it reasonably needs for its own privacy impact assessments, including assessments of transfers outside the Controller's province or country.

10. Return and Deletion

The Controller can export End-User personal data through the operator portal's export tools, or by request, at any time. On the Controller's written request, before or after the subscription ends, Velogics will permanently delete the Controller's account and the End-User personal data processed on its behalf, including stored photos and files, within 30 days, except where retention is required by applicable law. Deleted data drops out of the database provider's rolling restore history as it rolls over. Copies held by sub-processors are handled under their retention terms.

12. General

• This DPA forms part of the Terms of Service. In case of conflict between this DPA and the Terms regarding processing of End-User personal data, this DPA prevails.
• Liability under this DPA is subject to the limitation of liability in the Terms.
• This DPA is governed by the same law as the Terms (unless local law requires otherwise to give effect to data-subject protections).