Data Processing Agreement

Last updated: 18 August 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between BrewApps ("Processor", "we", "us") and the customer identified in the applicable order form or account registration ("Controller", "you"), together the "Parties".

This DPA applies where we process Personal Data on your behalf in connection with BrewVoice. Where you and we have signed a negotiated data processing agreement, that agreement prevails over this one.

1. Definitions

"Applicable Data Protection Law" means, as relevant to the processing: Regulation (EU) 2016/679 ("EU GDPR"); the EU GDPR as incorporated into United Kingdom law together with the Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection; the California Consumer Privacy Act as amended by the CPRA and comparable state privacy laws of Virginia, Colorado, Connecticut, Utah, Texas and other US states ("US State Privacy Laws"); and India's Digital Personal Data Protection Act, 2023 together with rules made under it ("DPDP Act").

"Controller", "Processor", "Personal Data", "Personal Data Breach", "Data Subject", "processing" and "Supervisory Authority" have the meanings given in the EU GDPR. Where the DPDP Act applies, "Data Fiduciary" corresponds to Controller, "Data Processor" to Processor, and "Data Principal" to Data Subject. Where US State Privacy Laws apply, "Business" corresponds to Controller and "Service Provider" or "Processor" to Processor.

"Customer Personal Data" means Personal Data contained in Customer Data that we process on your behalf under the Terms of Service.

"Sub-processor" means any third party engaged by us to process Customer Personal Data.

"Standard Contractual Clauses" or "SCCs" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914.

"UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

2. Roles of the Parties

For Customer Personal Data, you are the Controller and we are the Processor. You determine the purposes and means of processing. We process only on your documented instructions.

Where you are yourself a processor acting for a further controller, you warrant that you have that controller's authority to enter into this DPA and to issue the instructions you give us.

For account information about your own administrators and users, including sign-in records and product analytics, we act as an independent Controller and process that information as described in our Privacy Policy.

Nothing in this DPA makes the Parties joint controllers.

3. Details of processing

The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are set out in Annex I.

4. Your instructions and obligations

We process Customer Personal Data only:

• on your documented instructions, including the instructions inherent in your configuration and use of BrewVoice, and those given through the product interface or support channels; and
• where required by law to which we are subject, in which case we will inform you of that legal requirement before processing unless the law prohibits it on important grounds of public interest.

We will tell you if, in our opinion, an instruction infringes Applicable Data Protection Law. We may suspend processing of the affected instruction until it is withdrawn or amended.

You are responsible for:

• establishing and maintaining a lawful basis for the processing, and for obtaining and evidencing any consent required to call or message a Data Subject;
• the accuracy, quality and legality of Customer Personal Data and the means by which you acquired it;
• providing any notice required to Data Subjects, including notice of call recording and notice that they are speaking to an AI agent where the law requires it;
• configuring retention, recording, calling-hours and suppression settings in the product to match your legal obligations;
• not submitting to BrewVoice any special category data under Article 9 EU GDPR, data concerning criminal convictions, payment card numbers, government identifiers, or sensitive personal data as defined under US State Privacy Laws or the DPDP Act. The service is not designed for such data and we do not undertake to apply the additional controls it requires.

5. Confidentiality

We ensure that personnel authorised to process Customer Personal Data are bound by an appropriate duty of confidentiality, are subject to access controls limiting them to what their role requires, and receive training on their obligations.

6. Security

We implement and maintain the technical and organisational measures set out in Annex II, having regard to the state of the art, cost of implementation, and the nature, scope, context and purposes of processing, as well as the risk to Data Subjects.

We may update these measures over time provided the level of protection is not materially reduced.

7. Sub-processors

You give general written authorisation for us to engage Sub-processors. The categories currently engaged are listed in Annex III.

We will:

• impose on each Sub-processor written data protection obligations no less protective than those in this DPA;
• remain fully liable to you for the performance of each Sub-processor's obligations;
• give you at least 30 days' notice before adding or replacing a Sub-processor in a way that materially changes the processing, by email to your account's notification address or through the product.

You may object on reasonable data protection grounds within that notice period. The Parties will discuss the objection in good faith. If we cannot offer a reasonable alternative, you may terminate the affected part of the service without penalty, with a pro-rata refund of prepaid fees for the unused period.

8. Assistance with Data Subject rights

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests to exercise Data Subject rights, including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.

If a Data Subject contacts us directly about Customer Personal Data, we will not respond substantively other than to direct them to you, unless you have instructed us otherwise or the law requires us to respond. We will inform you of the request without undue delay.

Where the request is a do-not-contact or STOP request, we will act on it directly by recording it against the relevant number, and will inform you. Suppression records are retained after account closure, because deleting them is what would allow contact to resume.

9. Personal Data Breach

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

The notification will describe, to the extent then known: the nature of the breach including the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point for further information. Where we cannot provide all of this at once, we will provide it in phases without undue further delay.

We will assist you in meeting your own notification obligations to Supervisory Authorities, to the Data Protection Board of India, and to Data Subjects.

Our notification is not an acknowledgement of fault or liability.

10. Data protection impact assessments

Taking into account the nature of processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and prior consultations with Supervisory Authorities, where these relate to processing carried out under this DPA. We may charge a reasonable fee for assistance that goes materially beyond providing our standard documentation.

11. Deletion and return

On termination of the Terms of Service, we will delete or anonymise Customer Personal Data within a reasonable period, unless you request return of a copy before deletion, or unless we are required to retain it by law. You can export Customer Data through the product before closing your account.

We may retain Customer Personal Data to the extent required by law, and may retain it in routine backups for a limited period, during which it remains protected by this DPA and is not actively processed.

12. Audits and information

We will make available the information reasonably necessary to demonstrate compliance with this DPA, and will contribute to audits conducted by you or an auditor you mandate.

We may satisfy this obligation by providing our security documentation and responses to a reasonable security questionnaire. Where that is not sufficient for your regulator or your own compliance obligations, you may conduct an audit on at least 30 days' written notice, no more than once in any 12-month period unless a Personal Data Breach has occurred or a Supervisory Authority requires it. Audits take place during business hours, must not unreasonably disrupt our operations, are subject to confidentiality, and must not involve access to other customers' data. You bear the cost of the audit unless it reveals a material breach of this DPA.

13. International transfers

We and our Sub-processors operate in the United States and other countries, so Customer Personal Data may be transferred outside the country where the Data Subject lives.

EEA transfers. Where we transfer Personal Data protected by the EU GDPR to a country without an adequacy decision, the SCCs apply and are incorporated by reference. Module Two (controller to processor) applies where you are a controller; Module Three (processor to processor) applies where you are a processor. Clause 7 (docking) applies. Under Clause 9, option 2 applies with the notice period in section 7 above. Under Clause 11, the optional independent dispute resolution body language does not apply. Under Clause 17, the governing law is the law of Ireland. Under Clause 18(b), disputes are resolved before the courts of Ireland. Annexes I, II and III to this DPA populate the corresponding annexes of the SCCs.

UK transfers. The UK Addendum applies to transfers protected by the UK GDPR, with the SCCs as the approved clauses. In Table 4, neither Party may end the Addendum as set out in section 19 of the Addendum.

Swiss transfers. The SCCs apply with references to the GDPR read as references to the Swiss FADP, references to Supervisory Authorities read as references to the Swiss Federal Data Protection and Information Commissioner, and the term "Member State" not preventing Data Subjects in Switzerland from bringing proceedings in Switzerland.

India transfers. Transfers of Personal Data of Data Principals in India are made in accordance with section 16 of the DPDP Act and any restrictions notified by the Central Government.

Where a transfer mechanism is invalidated, the Parties will work in good faith to adopt a valid replacement.

14. US State Privacy Laws

This section applies where we process Personal Data on your behalf that is subject to US State Privacy Laws. We act as a Service Provider or Processor, and you as a Business or Controller. We:

• process Personal Data only for the limited and specified business purposes set out in Annex I and as necessary to provide the service;
• do not sell or share Personal Data, and do not process it for cross-context behavioural advertising;
• do not retain, use or disclose Personal Data for any purpose other than the business purposes specified, or outside the direct business relationship between the Parties, except as permitted by law;
• do not combine Personal Data received from you with Personal Data received from another source, except as permitted by law;
• comply with the obligations applicable to us and provide the same level of privacy protection required of you;
• notify you if we determine we can no longer meet our obligations, and on notice will stop processing or take reasonable steps to remediate.

You may take reasonable and appropriate steps to ensure we use Personal Data consistently with your obligations, and to stop and remediate unauthorised use.

We certify that we understand and will comply with these restrictions.

15. DPDP Act

Where we process Personal Data of Data Principals in India, you act as Data Fiduciary and we as Data Processor under a valid contract, being this DPA. You are responsible for obtaining and maintaining verifiable consent or establishing another legitimate use under the DPDP Act, for issuing the required notice to Data Principals, and for responding to their requests. We will assist you in meeting your obligations, including in the event of a breach requiring intimation to the Data Protection Board of India and to affected Data Principals.

The Parties acknowledge that rules under the DPDP Act continue to be issued and will act reasonably to accommodate them as they take effect.

16. Liability

Each Party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service. Nothing in this DPA limits any liability that cannot be limited under Applicable Data Protection Law, including liability to Data Subjects under the third-party beneficiary rights in the SCCs.

17. Term

This DPA takes effect when you accept the Terms of Service and continues until we have ceased all processing of Customer Personal Data. Sections that by their nature should survive termination do so.

18. Order of precedence and governing law

In the event of conflict, the SCCs prevail over this DPA on matters they govern, this DPA prevails over the Terms of Service, and the Terms of Service prevail over any other document.

Except where the SCCs or Applicable Data Protection Law specify otherwise, this DPA is governed by the laws of the State of Delaware, United States, without regard to conflict of law rules, and the state and federal courts located in Delaware have exclusive jurisdiction.

19. Contact

Data protection enquiries: contact@thebrewapps.com.

Annex I: Details of processing

A. Parties

Data exporter (Controller): the customer identified in the order form or account registration. Contact details are those held in the BrewVoice account. Activities: use of an AI voice agent to communicate with the customer's own contacts.

Data importer (Processor): BrewApps. Contact: contact@thebrewapps.com. Activities: provision of the BrewVoice service.

B. Description of processing

Categories of Data Subjects

• The Controller's contacts, leads, customers and prospective customers who are called or messaged through BrewVoice, or who call in
• Individuals who submit a lead form on an advertisement or web form connected to the Controller's account
• The Controller's own personnel who administer the account

Categories of Personal Data

• Identity and contact data: name, phone number, mobile number, email address
• Record notes and lead form responses supplied by the Controller or submitted by the Data Subject
• Call metadata: phone number, time, duration, direction, outcome, disposition
• Call recordings and transcripts, where enabled by the Controller, and AI-generated summaries of what was discussed and agreed
• Message content and delivery status for SMS and MMS sent through the service
• SMS opt-in and consent records, including when and how consent was given and withdrawn
• Do-not-contact and suppression records
• Appointment details written to a connected calendar
• Account data for the Controller's personnel: name, email, sign-in records, product usage analytics

Special category data

None is requested or intended. The service is not designed to process special category data and the Controller undertakes in section 4 not to submit it. Because calls are open conversations, a Data Subject may volunteer such information in speech; where this occurs it is processed only incidentally, within the recording or transcript, and is subject to the same security measures.

Frequency of processing

Continuous, for the duration of the account.

Nature and purpose of processing

Placing, answering and routing calls; speech-to-text and text-to-speech conversion; generation of the agent's side of the conversation by AI models; transcription, summarisation and outcome recording; sending acknowledgement, transactional and follow-up messages; appointment booking; writing results back to the Controller's connected CRM; honouring do-not-contact requests, calling-hours rules and frequency limits; securing the service, diagnosing faults and preventing abuse.

Duration

For as long as the Controller's account is active or as the Controller instructs, then deletion or anonymisation within a reasonable period, save for suppression records and data retained to meet a legal obligation or resolve a dispute.

C. Competent Supervisory Authority

Where the EU GDPR applies, the Supervisory Authority of the Member State in which the Controller is established, or where the Controller is not established in the EEA, the authority of the Member State in which its EU representative is established. Where the UK GDPR applies, the Information Commissioner's Office. Where the Swiss FADP applies, the Federal Data Protection and Information Commissioner. Where the DPDP Act applies, the Data Protection Board of India.

Annex II: Technical and organisational measures

Access control. Access to customer data is restricted to personnel whose role requires it, on a least-privilege basis. Access to production systems requires authentication and is logged. Access rights are reviewed periodically and revoked promptly on role change or departure.

Credential security. Credentials for connected third-party accounts, including CRM, calendar and advertising platform tokens, are stored encrypted at rest.

Encryption. Personal Data is encrypted in transit using industry-standard transport encryption, and encrypted at rest in our databases and object storage.

Pseudonymisation and minimisation. The service is configured not to request payment card numbers, government identifiers, or health and financial data. Analytics on product usage are separated from call content.

Segregation. Customer data is logically separated so that one customer cannot access another's records.

Availability and resilience. Data is backed up on a regular schedule. Backups are encrypted and access-controlled. Restoration procedures are tested periodically.

Logging and monitoring. System and access events are logged to support detection of unauthorised access and to support incident investigation.

Incident response. A documented process governs identification, triage, containment, notification and post-incident review of security incidents, including the notification timelines in section 9.

Sub-processor governance. Sub-processors are contractually bound to data protection obligations no less protective than those in this DPA, and are assessed before engagement.

Personnel. Personnel with access to Personal Data are bound by confidentiality obligations and receive data protection and security training.

Secure development. Changes to production systems go through review before deployment. Dependencies are monitored for known vulnerabilities.

Deletion. Documented procedures govern deletion and anonymisation of Personal Data on account closure and on instruction.

Annex III: Categories of Sub-processors

We engage Sub-processors in the following categories. A current list identifying each Sub-processor by name, location and role is available on request to contact@thebrewapps.com, and notice of changes is given as set out in section 7.

Sub-processors are located in the United States and other countries. Transfers to them are made under the mechanisms in section 13.