Data processing agreement (DPA)

1. Parties and scope

The customer is the data controller and Nauva Era Technology, Unipessoal Lda. (NIF 519055799) is the processor. This agreement, under article 28 of the GDPR, forms part of the Terms of service.

2. Subject matter, nature and duration

• Subject matter: processing personal data to answer and record calls, book services and make the history available to the customer.
• Nature: collection, recording, transcription, storage, consultation and deletion.
• Duration: that of the subscription, plus the time needed to return or delete the data.

3. Categories of data and data subjects

• Data subjects: people who call the customer's business and its staff.
• Data: phone contact, name, reason for the call, recording, transcript and booking data.
• The service is not designed to process special categories of data.

4. Nauva's obligations

• Process the data only according to the customer's documented instructions, which include these terms and the platform configuration.
• Ensure that anyone who accesses the data is bound by confidentiality.
• Apply security measures appropriate to the risk described under "Security measures".
• Support the customer with requests to exercise data subject rights and with impact assessments, when needed.
• Notify the customer without undue delay, after becoming aware of a data breach.
• Make available the information needed to demonstrate compliance and allow reasonable audits, with prior notice.

5. Customer's obligations

• Have a legal basis for the processing and inform the data subjects.
• Comply with the law that applies to call recording.
• Give lawful instructions and configure the agent correctly.
• Set the retention period of recordings within the platform's limits (by default, 90 days).

6. Sub-processors

The customer authorises Nauva to use sub-processors for hosting, voice and telephony, payments and analytics, bound by obligations equivalent to those of this agreement. The list is available on request at contact@nauva.ai and we give notice of relevant changes, giving the customer the chance to object.

7. Security measures

• Access control and authentication.
• Encryption of data in transit.
• Logical separation between customer accounts.
• Access and audit logs.
• Backups and an incident response process.

8. International transfers

Some of our providers process data outside the European Economic Area, in the United Kingdom and the United States. Those transfers use adequate safeguards provided for in the GDPR, such as adequacy decisions and standard contractual clauses. The list of sub-processors is available on request at contact@nauva.ai.

9. End of the service

At the end of the service, and at the customer's request, Nauva returns or deletes the personal data within 30 days, unless there is a legal obligation to keep it.

10. Contact

To request a signed copy of this agreement or exercise rights provided for in it, write to contact@nauva.ai.