DATA PROCESSING AGREEMENT

This DPA forms an integral part of the Terms of Use available at https://enthu.ai/terms (the “Terms”) and is applicable where the Company (hereafter referred to as Enthu.AI) is the Processor of the Customer’s Personal Data. In the event of a conflict between this DPA and the Terms, this DPA shall prevail.

The Controller and the Processor shall also be referred to collectively as the “Parties” and individually as “Party”.

1.Definitions

Terms not specifically defined herein shall have the meaning ascribed thereto in the Terms of Use.

• In this DPA, the following terms shall have the following meanings:
• “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
• “Customer Content” shall mean Personal Data submitted by the Customer to the Services or stored on Customer’s behalf through Customer’s account in connection with Customer’s use of the Services which includes electronic data, email bodies, email recipients, text, voice, video, images, sound or communication logs.
• “Customer Subscription Data” means Personal Data that relates to Customer’s interactions and association with Enthu.AI. This shall be inclusive of the names and/or contact details of individuals authorized by the Customer to access Customer’s account, along with billing information of individuals that Customer has associated with its account. Customer Subscription Data shall also include any data Enthu.AI may require to collect for the purpose of identity verification, amongst other legal obligations.
• “Customer Usage Data” means data relating to the Customer’s account activity processed by Enthu.AI for the purposes of passing on Customer Content to the intended recipient. This shall include data used to identify the source and destination of Customer Content, such as (a) individual data subjects’ telephone numbers, the date, time, duration and the call transcription, etc.; and (b) communication logs used to identify the source of service requests, improve and prevent system abuse
• “Data Protection Laws” means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country.
• “Data Subject” means any identified or identifiable natural person.
• “GDPR” shall mean the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
• “Model Clauses” means the standard contractual clauses for Processors as approved by the European Commission (Decision C(2010)593) and available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02010D0087-20161217 (as amended or updated from time to time).
• “Personal Data” shall mean any information relating to a Data Subject that is Processed by Processor as part of providing the services to Controller.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.
• “Privacy Policy” means Enthu.AI’s privacy policy at https://enthu.ai/privacy-policy/
• “Process” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• “Processor” means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
• “Sensitive Data” means Personal Data consisting of a Data Subject’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation. It also includes information about an individual’s criminal offences or convictions, as well as any other information deemed sensitive under applicable data protection laws.
• “Services” means call transcription, monitoring, evaluation and analytics services provided by Enthu.AI that the Customer has subscribed to under the Terms.

 

2. Scope, Duration and Responsibilities

1. This DPA applies to processing of Customer Content.

2. Enthu.AI shall process Customer Content for the term of this DPA and only in accordance with this DPA, especially as mentioned in the respective Appendix.

3. Within the scope of the Terms, each Party shall be responsible for complying with its respective obligations as Controller and Processor under Data Protection Laws.

3. Relationship of the Parties

1. Enthu.AI as a Processor: The Parties acknowledge and agree that with regard to the Processing of Customer Content, Customer may act either as a Controller or Processor and Enthu.AI is a Processor.

2. Enthu.AI as a Controller of Customer Subscription Data: The Parties acknowledge that, with regard to the Processing of Customer Subscription Data, Customer is a Controller and Enthu.Ai is an independent Controller, not a joint Controller with Customer. Customer Subscription Data shall be Processed in accordance with Enthu.AI’s Privacy Policy.

3. Enthu.AI as a Controller of Customer Usage Data: The Parties acknowledge that, with regard to the Processing of Customer Usage Data, Customer may act either as a Controller or Processor and Enthu.AI is an independent Controller, not a joint Controller with Customer. Customer Usage Data shall be Processed in accordance with Enthu.AI’s Privacy Policy.

4. Term and Termination

1. This DPA becomes effective upon signature. It shall continue to be in full force and effect as long as Enthu.AI is Processing Customer Content pursuant to the Terms and shall terminate automatically thereafter.

2. Where amendments are required to ensure compliance of this DPA or an Appendix with Data Protection Laws, the Parties shall make reasonable efforts to agree on such amendments upon request of the Controller. Where the Parties are unable to agree upon such amendments, either Party may terminate Customer’s use of the Services with thirty (30) days written notice to the other Party.

5. Processing Instructions for Customer Content

1. Enthu.AI will Process Customer Content in accordance with the Customer’s instructions. This DPA contains Customer’s initial instructions to Enthu.Ai with respect to the Customer Content. The Parties agree that the Customer may communicate any change in its initial instructions to Enthu.AI by way of amendment to this DPA.

2. For the avoidance of doubt, any instructions that would lead to Processing outside the scope of this DPA (e.g. because a new Processing purpose is introduced) will require a prior agreement between the Parties and, where applicable, shall be subject to the contract change procedure hereunder.

3. Enthu.AI shall without undue delay inform the Controller in writing if, in Enthu.AI’s opinion, an instruction infringes Data Protection Laws, and provide a detailed explanation of the reasons for its opinion in writing.

6. Processor Personnel

Enthu.AI will restrict its personnel from Processing Customer Content without authorization. Enthu.AI will impose appropriate contractual obligations upon its personnel, including relevant obligations regarding confidentiality, data protection and data security.

7. Disclosure to Third Parties; Data Subjects Rights

1. Enthu.AI will not disclose Customer Content to any government agency, court, or law enforcement except with written consent from Controller or as necessary to comply with applicable mandatory laws. If Enthu.AI is obliged to disclose Customer Content to a law enforcement agency Enthu.AI agrees to give Controller reasonable notice of the access request prior to granting such access, to allow Controller to seek a protective order or other appropriate remedy. If such notice is legally prohibited, Enthu.AI will take reasonable measures to protect the Customer Content from undue disclosure as if it were Enthu.AI’s own confidential information being requested and shall inform Controller promptly as soon as possible if and when such legal prohibition ceases to apply.

2. In case Controller receives any request or communication from Data Subjects which relates to the Processing of Customer Content (“Request“), Enthu.AI shall reasonably provide the Controller with full cooperation, information and assistance (“Assistance“) in relation to any such Request where instructed by Controller.

3. Where Enthu.AI receives a Request, Enthu.AI shall (i) not directly respond to such Request, (ii) forward the request to Controller within ten (10) business days of identifying the Request as being related to the Controller and (iii) provide Assistance according to further instructions from Controller.

8. Technical and Organizational Measures

1. Enthu.AI shall implement and maintain appropriate technical and organizational security measures to ensure that Customer Content is Processed according to this DPA, to provide assistance and to protect Customer Content against a Personal Data Breach (“TOMs“). Such measures shall include the measures set out in Appendix 2.

9. Assistance with Data Protection Impact Assessment

1. Where a Data Protection Impact Assessment (“DPIA“) is required under applicable Data Protection Laws for the Processing of Customer Content, Enthu.AI shall provide upon request to Customer any information and assistance reasonably required for the DPIA and assistance for any communication with data protection authorities, where required, unless the requested information or assistance is not pertaining to Enthu.AI’s obligations under this DPA.

2. The Customer shall pay Enthu.AI reasonable charges for providing the assistance in this clause 9 to the extent that such assistance is not reasonably able to be accommodated within the normal provision of the Services.

10. Information Rights and Audit

1. Enthu.AI shall, in accordance with Data Protection Laws, make available to Customer on request in a timely manner such information as is necessary to demonstrate compliance by Enthu.AI with its obligations under Data Protection Laws.

2. Enthu.AI shall, upon reasonable notice, allow for and contribute to audits of the Enthu.AI’s Processing of Customer Content, as well as the TOMs (including data Processing systems, policies, procedures and records), during regular business hours and with minimal interruption to Enthu.AI’s business operations. Such audits shall be conducted by the Customer, its affiliates or an independent third party on Customer’s behalf (which will not be a competitor of the Processor) that is subject to reasonable confidentiality obligations.

3. Customer shall pay Enthu.AI reasonable costs of allowing or contributing to audits or inspections in accordance with clause 10 (2) where Customer wishes to conduct more than one audit or inspection every 12 months. Enthu.AI will immediately refer to Customer any requests received from national data protection authorities that relate to the Enthu.AI’s Processing of Customer Content.

4. Enthu.AI undertakes to cooperate with Controller in its dealings with national data protection authorities and with any audit requests received from national data protection authorities.

11. Personal Data Breach Notification

In respect of a Personal Data Breach (actual or reasonably suspected), Enthu.AI shall:

1. 1. notify Customer of a Personal Data Breach involving Enthu.AI or a subcontractor without undue delay and it shall be the responsibility of the Controller to inform the Supervisory Authority of such breach within 72 hours of notice by Enthu.AI;
   2. provide reasonable information, cooperation and assistance to Customer in relation to any action to be taken in response to a Personal Data Breach under Data Protection Laws, including regarding any communication of the Personal Data Breach to Data Subjects and national data protection authorities.

12. Subcontracting

1. Customer consents to Enthu.AI engaging third-party sub-processors as indicated in Appendix 1 to Process Customer Content to fulfil its obligations under the Agreement.

2. Where Enthu.AI, with Customer’s consent, subcontracts its obligations and rights under this DPA it shall do so only by way of a binding written contract with the sub-processor which imposes essentially the same obligations according to Art. 28 GDPR especially with regard to instructions and TOMs on the sub-processor as are imposed on  Enthu.AI under this DPA.

3. Where the sub-processor fails to fulfil its data protection obligations under the subcontracting agreement, Enthu.AI shall remain fully liable to Customer for the fulfilment of its obligations under this DPA and for the performance of the sub-processor ‘s obligations.

13. International Data Transfers

Enthu.AI shall at all times provide an adequate level of protection for the Customer Content, wherever Processed, in accordance with the requirements of Data Protection Laws. Where Enthu.AI Processes Customer Content  under this Agreement that originates from the EEA (including the United Kingdom) and/or Switzerland, any such processing shall be conditional on Enthu.AI complying with (and procuring any sub-processor comply with) the Model Clauses, which are incorporated by reference and form an integral part of this Agreement. This Agreement hereby incorporates by reference the standard contractual clauses for data Controller to data Processor transfers approved by the European Commission in decision 2010/87/EU. The Parties further agree that the standard contractual clauses will apply to Customer Content that is transferred via the Services from the European Economic Area, the United Kingdom, and/or Switzerland to outside the European Economic Area, the United Kingdom, and Switzerland, either directly or via onward transfer. Purely for the purposes of the descriptions in the Model Clauses and only as between Enthu.AI and the Customer, Enthu.AI agrees that it is a “data importer” and Customer is the “data exporter” under the Model Clauses (notwithstanding that Controller is located outside the EEA).

Further, Appendices 1 and 2 of this Agreement will take the place of Appendices 1 and 2 of the Model Clauses respectively.

14. Deletion or Return of Personal Data

Upon expiry of the Terms, Enthu.AI shall delete all Customer Content, including Personal Data within two (2) years. Within such retention period, Customer may export the Customer Content by writing to Enthu.AI at legal@localhost.   This requirement shall not apply to the extent that Enthu.AI as a Processor is required by applicable law to retain some or all of the Personal Data, in which event Enthu.AI shall isolate and protect the Personal Data from any further Processing except to the extent required by such law.

15. CCPA undertaking

Customer acknowledges and agrees that Customer is the Business and Enthu.AI the Service Provider with respect to any Personal Information of Consumers (as those terms are understood under the CCPA) forming part of Customer Content. Enthu.AI will not sell, retain, use, or disclose Personal Information of Consumers that Enthu.AI Processes on behalf of the Customer when providing the Services under the Terms for any purpose other than for the specific purpose of providing the Services in accordance with the Terms and as part of the direct relationship between Enthu.AI and the Customer. Enthu.AI certifies that it understands the restrictions in this clause 15 and will comply with such restrictions.

16. Usage of Customer Content for Analytics

Customer acknowledges and grants to Enthu.AI the right of usage of Customer Content to collect, use, copy, store, and transmit said Customer Content, in each case solely to the extent necessary to carry out the purposes as intended by the Customer, including but not limited to carrying out analytics for machine learning.

17. Miscellaneous

1. In case of any conflict, the provisions of this DPA shall take precedence over the provisions of any other agreement with Enthu.AI.

2. No Party shall receive any remuneration for performing its obligations under this DPA except as explicitly set out herein or in another agreement.

3. Where this DPA requires a “written notice” such notice can also be communicated per email to the other Party. Notices shall be sent to Enthu.AI at legal@localhost and Customer at the email address with which they signed up.

4. Any supplementary agreements or amendments to this DPA must be made in writing and signed by both Parties.

5. Should individual provisions of this DPA become void, invalid or non-viable, this shall not affect the validity of the remaining conditions of this agreement.

---

The following Appendices forms an integral part of this DPA:

APPENDIX 1

TO THE STANDARD CONTRACTUAL CLAUSES

DETAILS OF THE PROCESSING OF PERSONAL DATA

Data exporter

The data exporter is the Customer and the user of the Services.

Data importer

The data importer is Enthu.AI, a conversation intelligence provider that enables calls/chats analysis  features and allows users the ability to listen to conversations and run analysis on it.

Data subjects

The Personal Data transferred concern the following categories of data subjects:

Data exporter’s end-users. The Personal Data that the data exporter will transfer to the data importer is determined and controlled solely by the data exporter. The data importer will receive this Personal Data in the form of Customer Content that the data exporter instructs it to Process through its products and services.

Categories of data

The Personal Data transferred concern the following categories of data (please specify):

Customer Content: As defined in Section 1 (“Definitions”) of this Agreement.

Special categories of data (if appropriate)

No Sensitive Data shall be transferred as part of Customer Content.

Processing operations

The Personal Data transferred will be subject to the following basic Processing activities (please specify):

Enthu.AI must Process the data collected from or for the Customer or in connection with its Services provided to the Customer solely to provide the services specified in the DPA. The duration of processing will be as designated in the DPA.

 

Enthu.AI intends to use the service of the following subcontractors for Processing of Personal Data as of the effective date of this DPA.

Name of Sub-processor	Purpose
AWS	Server & Hosting
Chargebee	Invoicing
Stripe	Billing
MongoDB	Provides Database

 

APPENDIX 2

 SECURITY MEASURES

Organizational Security

1. Enthu.AI has the following policies established, management approved, and documented. The policies shall be continually improving and reviewed at least annually. Evidence of policies is required.

1. 1. Access Control Policy
   2. Change Management Policy

2. Security Awareness and Training Program

1. 1. Enthu.AI has in place a Security Awareness Program that all employees are required to complete at hire and at least annually thereafter.

3. Physical Security

1. 1. Enthu.AI shall limit access to areas where Controller data is Processed.