This Data Processing Addendum ("DPA") forms part of the Terms and Conditions or other written agreement (the "Agreement") between OPTICOMM AI S.R.L. ("OptiComm", "Processor") and the customer entity ("Customer", "Controller") for the provision of the Services. It governs the processing of personal data by OptiComm on behalf of the Customer in accordance with Article 28 of the GDPR.In case of conflict between this DPA and the Agreement regarding the processing of personal data, this DPA prevails.
Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach", and "supervisory authority" have the meanings given in the GDPR.
"Data Protection Law" means the GDPR, Romanian Law no. 190/2018, and other applicable data protection laws.
"Sub-processor" means any processor engaged by OptiComm to process personal data.
2.1 The Customer is the controller (or processor acting on behalf of its own controllers), and OptiComm is the processor, in respect of personal data contained in Customer Data ("Customer Personal Data"). This includes data ingested from the Customer's connected commerce platforms and the contact details, call audio, and transcripts of individuals contacted by the AI voice agents.
2.2 OptiComm processes Customer Personal Data only on documented instructions from the Customer, including as set out in the Agreement and this DPA, unless required to do otherwise by EU or Member State law (in which case OptiComm will inform the Customer unless that law prohibits it).
2.3 The subject matter, duration, nature, purpose, types of personal data, and categories of data subjects are described in Annex I.
OptiComm will:
a) Process Customer Personal Data only on the Customer's documented instructions;
b) Ensure that persons authorised to process the data are bound by confidentiality;
c) Implement the technical and organisational measures set out in Annex II;
d) Respect the conditions for engaging sub-processors (Section 5);e) taking into account the nature of the processing, assist the Customer by appropriate measures, insofar as possible, in fulfilling the Customer's obligation to respond to data subject requests (Section 6);
f) Assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of processing and information available to OptiComm;
g) At the Customer's choice, delete or return all Customer Personal Data after the end of the provision of the Services, and delete existing copies unless storage is required by law (Section 11);
h) Make available to the Customer information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits (Section 7); and
i) Immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Law.
The Customer warrants that:
(a) it has a valid legal basis for the processing and the provision of Customer Personal Data to OptiComm, including any profiling/prediction and any recording of calls by the voice agents;
(b) its instructions comply with Data Protection Law; and
(c) it has provided all required notices and obtained all required consents from data subjects, including for AI interaction disclosure and call recording where required.
5.1 The Customer provides general authorisation for OptiComm to engage sub-processors to process Customer Personal Data. A current list of sub-processors is maintained at /subprocessors (see also Annex III).
5.2 OptiComm will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains fully liable for the performance of each sub-processor.
5.3 OptiComm will give the Customer prior notice of the addition or replacement of a sub-processor (for example, by updating the list and/or by email) at least thirty (30) days in advance. The Customer may object on reasonable, data-protection-related grounds within that period; the parties will then work in good faith to resolve the objection, and if they cannot, the Customer may terminate the affected Services.
Taking into account the nature of the processing, OptiComm will assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests by data subjects exercising their rights under the GDPR. If OptiComm receives a request directly from a data subject relating to Customer Personal Data, it will, unless legally prohibited, promptly forward it to the Customer and not respond except on the Customer's instructions.
7.1 OptiComm will make available to the Customer the information necessary to demonstrate compliance with this DPA, including current third-party certifications and audit reports (e.g. ISO/IEC 27001 certificate and Statement of Applicability summary).
7.2 The Customer may, no more than once per year (and additionally following a personal data breach or upon a supervisory authority's request), conduct an audit on reasonable prior notice, during business hours, subject to confidentiality and without compromising the security of other customers. The parties may agree that an independent auditor performs the audit. The Customer bears its own audit costs.
OptiComm implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex II, supported by its certified management systems (including ISO/IEC 27001 and ISO/IEC 27018) and aligned with NIS2 and, where applicable, DORA requirements.
OptiComm will notify the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably required for the Customer to meet its own notification obligations under Articles 33 and 34 GDPR.
10.1 OptiComm will not transfer Customer Personal Data outside the EEA without ensuring appropriate safeguards under Chapter V of the GDPR.
10.2 Where the European Commission's Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914) apply, they are incorporated into this DPA by reference, with the relevant modules completed as set out in Annex IV, and supplemented by additional measures where required following a transfer impact assessment. This is relevant to certain AI/LLM and voice providers that may process data outside the EEA.
On termination or expiry of the Services, OptiComm will, at the Customer's choice, return or delete Customer Personal Data within thirty (30) days, and delete existing copies, unless retention is required by EU or Member State law.
12.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement.
12.2 This DPA takes effect on the effective date and continues for as long as OptiComm processes Customer Personal Data under the Agreement.
This DPA is governed by Romanian law and, where the SCCs apply, by the law designated in the SCCs.
See the separate, maintained register at /subprocessors.