Data processing agreement (DPA)

This data processing agreement (the "DPA") is part of the terms between you ("the Customer") and Guimauve Digital SAS ("the Publisher", 60 rue François Ier, 75008 Paris, France). It applies when you use Allomi to process personal data of other people (your contacts, the people the assistant calls or who call it) and GDPR (Regulation (EU) 2016/679) applies. For that data the Customer is the controller and the Publisher is the processor (GDPR art. 28). For the data of your own account (sign-in, billing), the Publisher is the controller: see the privacy policy.

1. Subject, nature and duration

The Publisher processes personal data to provide the Service: placing and receiving calls, transcribing and summarising them, keeping the assistant's memory (contacts, notes, commitments), delivering webhooks. The processing lasts as long as the account is open, plus the deletion period of section 9.

2. Data and people concerned

Details are in the annex at the end. Categories: identity and phone numbers of contacts, call audio and transcripts, summaries, notes, commitments, and anything said during calls. People: the Customer's contacts, the people called or calling, the Customer's own users.

3. Instructions

The Publisher processes the data only on the Customer's documented instructions: the terms, this DPA, the use of the Service (app, API, MCP, schedules) and the settings the Customer chooses (recording, retention). If the Publisher believes an instruction breaches the law, it tells the Customer.

4. Confidentiality and security

The people who can access the data are bound by confidentiality. The Publisher applies the measures of the annex: encryption in transit, secrets encrypted at rest, hashed API keys, restricted access, no prompts, transcripts, keys or audio in logs.

5. Sub-processors

The Customer gives a general authorisation for the sub-processors of the list, who are bound by obligations equivalent to this DPA. The Publisher tells the account owner by e-mail at least 30 days before adding or replacing one that handles call content. The Customer may object on reasonable data-protection grounds within that time; if the parties cannot agree, the Customer may close the account and is refunded the unused part of the paid period. The Publisher remains responsible for its sub-processors.

6. Transfers outside the EEA

The Service is hosted in Switzerland (adequacy decision of the European Commission). Some sub-processors process data in the United States; each transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses, as detailed in the list. If a mechanism is invalidated, the Publisher puts another in place or stops the transfer.

7. Helping the Customer

Taking the nature of the processing into account, the Publisher helps the Customer answer requests from the people concerned (access, erasure…) through the export and deletion features of the Service, helps with impact assessments and consultations with authorities, and answers reasonable questions within 30 days.

8. Personal data breach

The Publisher tells the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting the Customer's data, with the information it has (nature, data and people concerned, likely consequences, measures taken), so the Customer can meet its own 72-hour obligation.

9. Deletion and return

Call transcripts are deleted after 90 days by default; the Customer can delete data at any time and export it with the API. When the account is closed, the data is deleted within 30 days, except what the law requires to keep, and backups are overwritten within their 14-day retention.

10. Audits

The Publisher gives the Customer the information needed to show compliance and allows audits, by the Customer or an auditor it appoints bound by confidentiality, once a year with 30 days' notice, during business hours and without disturbing the Service. The sub-processors' own certifications and reports may replace an audit where they answer the question.

11. The Customer's duties

The Customer decides the purposes, has a legal basis for the calls it asks for (see acceptable use and AI and recording), informs the people concerned, and does not use the Service to process special categories of data unless the law allows it and it has told the Publisher.

12. Liability and law

The liability clauses of the terms apply. French law applies; the competent courts are those of Paris, without prejudice to mandatory rules.

Annex: details of the processing and security measures