Data Processing Agreement (DPA)

1. Parties

Controller: the Customer, meaning the individual or legal entity owning the account.
Processor: Dhalinta Digital Solutions, with address at Somalia, which provides the service to the Customer.
Technology provider of the platform and sub-processor: Muse Layer LLC, EIN 30-1474701 (New Mexico (USA)), which acts as sub-processor of Dhalinta Digital Solutions.

Where the service is provided through a reseller, Muse Layer LLC, technology provider of the platform, processes the data as sub-processor of the reseller under a written agreement imposing obligations equivalent to those of this Agreement and, where applicable, the Standard Contractual Clauses (Module 3). References to the "Processor" in this Agreement are to the reseller, which is liable to the Controller for its sub-processor.

2. Subject matter and relationship with the Terms

This Agreement governs the processing of personal data performed by the Processor on behalf of the Controller in connection with the Dhalinta AI Automation service, in accordance with Regulation (EU) 2016/679 (GDPR) and, where applicable, Spanish Organic Law 3/2018 (LOPDGDD). It forms part of the Terms and Conditions between the same parties. In case of conflict, this Agreement prevails on data protection matters and the Standard Contractual Clauses of section 9 prevail over both.

3. Nature, purpose and duration of processing

• Nature: hosting, storage, transmission, AI processing, search, retrieval, support and deletion.
• Purpose: provision of the service configured by the Controller.
• Channels: webchat, WhatsApp, Instagram, Messenger, Telegram, email, voice, tickets, calendars and other integrations enabled by the Controller.
• Duration: while the main agreement remains in force and for any legally required retention period.
• Knowledge base: text of the web pages and documents that the Controller points to or uploads, split into passages, and their numeric vectors (embeddings) so that agents can consult it. Private documents are stored encrypted and the original uploaded file is deleted once processing ends.

Knowledge base content. The Controller is solely responsible for the content it points to or uploads to the knowledge base, and warrants that it has the right to use it and that, unless necessary and with a legal basis, it does not include personal data of third parties or special categories of data (GDPR art. 9). The Processor processes that content only on the Controller's instructions (its consultation by the configured agents), does not review or validate it, and may suspend or delete a source on reasonable grounds of unlawfulness or risk to third parties or to the platform. Deleting a source or a knowledge base removes its passages and vectors.

4. Categories of data and data subjects

• Identification and contact data of the Controller's end users.
• Conversation content in text channels and generated AI responses.
• Caller ID / CLI, call timestamps, duration and voice-call metadata where voice is enabled.
• Text transcripts generated from voice interactions. No audio recording is stored by the Processor.
• Technical metadata such as IP address, device, language and timestamps.
• Data subjects include customers, leads, visitors, employees and other persons interacting with the Controller's channels.

The Controller must not submit special-category data under GDPR Article 9 unless a specific written agreement and additional safeguards are in place.

5. Processor obligations

1. Process data only on documented instructions from the Controller, including with regard to international transfers, unless required by law; in that case it will inform the Controller beforehand unless the law prohibits it.
2. Immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.
3. Ensure that authorised personnel are bound by confidentiality.
4. Apply the technical and organisational measures described in Annex II.
5. Assist the Controller with data subject requests and with its obligations under GDPR Articles 32 to 36.
6. Notify personal data breaches without undue delay and in any case within 72 hours of becoming aware of them.
7. Delete or return personal data at the end of the service, unless legal retention applies.
8. Make available the information needed to demonstrate compliance and allow audits as described in section 13.

6. Controller obligations

1. Have a legal basis for the processing and inform its end users (GDPR arts. 13 and 14), including the notices required for AI interaction and voice.
2. Give lawful instructions, which are the configuration it makes in the panel and the instructions it sends in writing.
3. Choose and configure the channels, integrations and external destinations it activates (section 8) and ensure they are lawful.
4. Keep its account credentials and those of its team confidential.

7. Sub-processors

The Controller grants general authorisation to use the sub-processors listed at /legal/subprocessors. Additions or replacements will be notified at least 30 days in advance where reasonably possible, allowing the Controller to object on justified grounds; if no solution is agreed in good faith, the Controller may terminate without penalty. The Processor imposes on each sub-processor, by written contract, data protection obligations equivalent to those of this Agreement and remains fully liable to the Controller for their performance.

8. Integrations and destinations chosen by the Controller

Some features allow the Controller to send data to systems that it chooses and configures itself: webhooks, automations (for example n8n or Make), its own APIs or CRM, its own Telegram bot, Telegram alerts for its team, calendars or other third-party tools.

1. Each such destination is activated by the Controller and is an instruction of the Controller. Those third parties are not sub-processors of the Processor: they act for the Controller under the Controller's own contracts.
2. The Controller is responsible for the legal basis of that communication, for informing data subjects and, if the destination is outside the EEA, for the applicable transfer mechanism.
3. The Processor may limit destinations technically (for example, accepting automation endpoints only in the EEA, the United Kingdom or Switzerland) and may suspend a destination when there are reasonable signs of unlawfulness, a security risk or a risk to data subjects, informing the Controller.
4. The Processor is responsible for the security of the platform up to delivery to the configured destination; it is not responsible for the processing carried out by those third parties.
5. Telegram. Telegram FZ-LLC (United Arab Emirates) does not offer a dedicated data processing agreement for bots; the Controller decides whether to enable it and may select the "minimal" mode for alerts, in which message content is not sent to Telegram.

9. International transfers

9.1 Module of the Standard Contractual Clauses for each relationship

The Customer's data is hosted on servers in the European Union (section 11). Because Muse Layer LLC is a company established in the United States, to the extent that a flow constitutes an international transfer under the GDPR, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 apply with the module that corresponds to the role of each party:

• Dhalinta Digital Solutions (processor) → Muse Layer LLC (sub-processor): Module Three (processor to processor), in the agreement between Dhalinta Digital Solutions and Muse Layer LLC.
• Processor in the EEA → controller outside the EEA: Module Four (processor to controller), where the flow requires it (section 9.3).
• Muse Layer LLC → sub-processors in the EEA: no transfer; governed by the written contracts of section 7.

In this service, provided through Dhalinta Digital Solutions, the Customer's relationship is with the reseller: the transfer, if any, from the Customer to the reseller depends on where the reseller is established and is the reseller's responsibility; the transfer from the reseller to Muse Layer LLC is governed by Module Three under the agreement between them.

9.2 Sub-processors outside the EEA

Where a sub-processor operates outside the EEA, the transfer is protected by the Standard Contractual Clauses, the EU-US Data Privacy Framework where the provider is certified, or another valid GDPR mechanism, as indicated in the sub-processor list.

9.3 Controllers established outside the EEA

If the Controller is established outside the EEA, it is responsible for complying with the data protection law of its country. Where the GDPR applies to the provision of data to the Controller, the module of the Standard Contractual Clauses that corresponds to that flow (normally Module Four) is incorporated by reference.

9.4 Requests from public authorities

If Dhalinta Digital Solutions or its sub-processor Muse Layer LLC receives a request from a public authority for access to the Customer's data, it will notify the Customer unless legally prohibited, review the lawfulness of the request, challenge it where there are reasonable grounds, and disclose only the minimum data required, documenting the request.

10. Voice data and transcripts

10.1 Stored data

• Only text is stored: speech is converted into text by a speech-to-text engine and only the textual transcript is persisted.
• No audio is recorded: the Processor does not store or retain call audio streams in files, databases or backups.

10.2 Caller ID / CLI

The caller phone number is direct personal data. It is processed only to associate the conversation with the Controller's contact, enable routing and provide auditability.

10.3 Configurable retention

Voice transcripts and associated CLI data are retained according to the Controller's configuration, with a minimum of 30 days, maximum of 365 days and default of 90 days, subject to daily automatic purge.

10.4 End-user notice

The Controller must inform end users, before or at the start of a voice interaction, that they are interacting with an AI system and that the conversation may be transcribed. The Controller is responsible for adapting the notice to its purpose and legal basis.

11. Hosting and backups

• Hosting: main servers in Germany (Contabo GmbH) and a replica server in Spain (Mallorca) operated by Muse Layer LLC, sub-processor. The replica is located in leased premises; the lessor provides only space, power and network and has no access to the data or to the keys.
• Backups: daily, within the EU, transferred over encrypted channels (TLS/VPN) and with access restricted to authorised personnel. Data encrypted in production remains encrypted in the copies.
• Retention: 60 days with automatic rotation and deletion.

12. Return and deletion

At the end of the service, the Processor will return or delete personal data within 30 days, at the Controller's choice, unless legal retention applies. Production deletion is immediate where technically possible; backup deletion follows the natural 60-day rotation cycle.

13. Audits

The Controller may audit compliance through questionnaires, current external audit documentation or on-site audit with 30 days' notice, no more than once per year unless a security breach occurs.

14. Liability

Each party is liable under GDPR Article 82 for damage caused by breach of its own obligations. The Processor is liable for its own breaches and for those of its sub-processors, and is not liable for processing carried out by the destinations chosen by the Controller (section 8). The limitations of the Terms and Conditions apply to this Agreement except where mandatory law prohibits it, and do not limit the rights of data subjects.

15. Sub-processor established outside the EU

Muse Layer LLC, technology provider of the platform and sub-processor, is established in the United States and has designated a representative in the European Union under GDPR Article 27. The designation does not alter the liability of the Processor towards the Controller.

16. Term

This Agreement enters into force upon acceptance by the Controller during registration or when it starts using the service, whichever comes first, and remains in force for the duration of the contractual relationship.

Annex I — Processing description

The Controller's identification data are those provided during registration and maintained in the organisation billing settings. Processing covers the categories, purposes, channels and data subjects described in sections 3 and 4.

Annex II — Technical and organisational measures

• TLS encryption in transit and encryption at rest (AES-256) for message content, stored attachments, integration tokens and sensitive secrets.
• Logical tenant isolation by organisation/workspace.
• Role-based access control, bcrypt password hashing and revocable sessions.
• Audit logs for sensitive configuration changes and administrative actions.
• Daily backups within the EU (Germany, with a replica in Spain) and 60-day retention.
• Documented incident response procedure with notification target under 72 hours.
• Periodic dependency and security patch reviews.
• Confidentiality duties for personnel with access to personal data.
• Configurable retention and daily purge for voice transcripts and caller ID data. No audio is stored.

Annex III — Current sub-processor list

Available and maintained at /legal/subprocessors.