This Data Processing Agreement ("DPA") supplements the ARIA Terms and conditions and applies whenever ARIA processes personal data on your behalf (on behalf of the client business) in accordance with Art. 28 GDPR.
1. Roles
You (the client business) are the data controller of the data of your customers who interact with ARIA. We (Annapolis Tour S.R.L., which operates the ARIA service) are the data processor, which processes that data only in accordance with your instructions and with these terms.
2. Purpose of the processing
We process personal data exclusively in order to deliver the ARIA service to you: to receive messages from your customers, to reply on your behalf, to keep the context of the conversations, to escalate sensitive cases to your team, and to provide you with aggregated usage reports.
3. Categories of data
We process the following categories of personal data of your customers:
| Category | Examples |
|---|---|
| Identification data | Surname, first name (where provided) |
| Contact data | Telephone number, email |
| Conversation content | Text messages, voice transcripts, attachments |
| Metadata | Message time, channel, detected language |
| Transactional context | Details specific to your business (bookings, appointments, etc.) |
4. Duration of the processing
The duration of the processing is the same as the duration of your contract with us. On termination, the data is deleted from our systems within 30 days at the latest, or returned to you in a standard format, as you request.
5. Subprocessors
We use the following subprocessors. The list may be updated with 14 days' notice.
| Subprocessor | Purpose | Location |
|---|---|---|
| Contabo GmbH | Hosting (servers, infrastructure) | Lauterbourg, France (EU) |
| Mistral AI SAS | Language model (processing of messages), through a proxy with retention opt-out | France (EU) |
| Soniox Inc. | Transcription of speech into text, on telephone calls | European access point (EU) |
| ElevenLabs Inc. | Synthesis of ARIA's voice, on telephone calls | USA (SCCs) |
| Telnyx LLC | Transport of telephone calls (numbers and connectivity) | USA (SCCs) |
| Meta Platforms Ireland Ltd. | WhatsApp connectivity (the messaging channel) | Ireland (EU) / USA (SCCs) |
All subprocessors are covered by contracts with standard contractual clauses (SCCs) where these apply.
6. Security measures
We apply technical and organisational measures described on the Security page: TLS 1.3 encryption in transit, AES-256 at rest, controlled access to production systems, hardware authentication, weekly audit.
7. Assistance to you
We help you respond to the requests of your customers who exercise their GDPR rights. If a customer asks you for the deletion or the export of their data, we can do that within 5 working days at the latest from your request.
8. Incident notification
We notify you of any security breach that affects your data within 72 hours at the latest from the moment we detect it, in accordance with Art. 33 GDPR.
9. Audit
Upon written request 30 days in advance, we allow you (or an accredited third party auditor) to audit our data processing practices. The costs of the audit are borne by you, except where the audit uncovers material problems.
10. Transfer of data outside the EU
Your data is not transferred outside the EU for storage; hosting and language processing (Mistral AI) take place in the European Union, and so does voice transcription (Soniox, on its European access point). For voice synthesis (ElevenLabs), for the transport of telephone calls (Telnyx) and for WhatsApp connectivity, certain suppliers may also process data in the USA, covered by standard contractual clauses (SCCs). Telephony is not activated for a business unless that business asks for it, so if you do not use telephone calls the transfers related to voice do not apply.
11. Changes
Changes to this DPA apply by notification at least 30 days in advance. The current version is dated at the top of the page.
12. Contact
For any question relating to data processing: [email protected].
Translation
This page is an English translation of the Romanian original. In case of any discrepancy between the two versions, the Romanian version at ariaknows.com/dpa prevails.