Data Processing Addendum

1. Roles of the Parties

With respect to the personal data of Customer's callers and any contacts whose phone numbers Customer processes through Avidra, Customer is the “data controller” (or “business”) and Avidra is the “data processor” (or “service provider”).

With respect to the account information of Customer's authorized users (name, email, business name, billing details), Avidra acts as an independent data controller for the limited purposes described in our Privacy Policy.

2. Scope and Purpose of Processing

Avidra processes personal data on behalf of Customer solely for the purpose of providing the Avidra service as described in the Terms of Service. This includes:

• Receiving notification of missed calls to Customer's provisioned phone number
• Sending automated SMS replies on Customer's behalf to those callers
• Maintaining the resulting lead and conversation records inside Customer's account
• Providing analytics on call and message activity to Customer's authorized users

Avidra does not use Customer's end-user personal data for any other purpose, including its own marketing, model training, or sale to third parties.

3. Categories of Data and Data Subjects

Categories of personal data processed: phone numbers (caller and recipient), inbound and outbound SMS message content, call timestamps and metadata, lead records configured by Customer.

Categories of data subjects: Customer's prospective and existing customers and other individuals who call Customer's phone number.

4. Customer Obligations

Customer warrants that it will:

• Only instruct Avidra to process personal data in compliance with applicable data protection laws (including CASL, GDPR, TCPA, and CCPA where relevant).
• Obtain and maintain all necessary consents or other lawful bases for processing the personal data of its callers, including consent to receive SMS where required.
• Configure SMS reply content that is accurate, non-deceptive, and complies with the SMS Policy and Acceptable Use Policy.
• Promptly forward to Avidra any data-subject rights request that Customer cannot fulfill on its own through the dashboard.

5. Avidra Obligations

Avidra will:

• Process personal data only on documented instructions from Customer (as set out in the Terms of Service, this DPA, and through the configuration Customer makes in the dashboard), except as required by applicable law.
• Ensure that personnel with access to personal data are bound by appropriate confidentiality obligations.
• Implement appropriate technical and organisational measures to protect personal data (see Section 7).
• Assist Customer in responding to requests from data subjects exercising their rights under applicable law, taking into account the nature of the processing.
• Notify Customer without undue delay (and in any event within 72 hours of becoming aware) of any personal data breach affecting Customer data.
• On termination of the service, delete or return Customer personal data within 90 days, except where retention is required by applicable law.

6. Sub-Processors

Customer authorises Avidra to engage the following categories of sub-processors to provide the service:

• SMS delivery infrastructure (CPaaS provider, primarily Twilio)
• Cloud database and storage (Supabase)
• Application hosting and deployment (Vercel)
• Payment processing (Stripe)
• Email delivery for transactional notifications (Resend)

Avidra remains liable to Customer for the acts and omissions of its sub-processors. Avidra will give Customer reasonable prior notice of any intended addition or replacement of a sub-processor. The current list is available on request to support@avidra.net.

7. Security Measures

Avidra maintains administrative, technical, and physical safeguards appropriate to the nature of the personal data processed. These include, at minimum:

• TLS encryption in transit and encryption at rest for database storage
• Role-based access controls and least-privilege access for personnel
• Audit logging of administrative actions on Customer data
• Regular review of authentication, secrets management, and incident-response processes

8. International Transfers

Where Avidra processes personal data outside the EEA/UK/Switzerland in connection with providing the service, the parties rely on (i) the European Commission's adequacy decision for Canada to the extent applicable, and (ii) the EU Standard Contractual Clauses (Module Two: controller-to-processor) and the UK International Data Transfer Addendum, which are deemed incorporated into this DPA by reference for transfers to jurisdictions without an adequacy decision.

9. Audits

Avidra will, upon reasonable prior written request and no more than once per twelve months (unless mandated by a supervisory authority), make available to Customer the information necessary to demonstrate compliance with this DPA. This may take the form of summary reports, third-party audit attestations, or written responses to a questionnaire.

10. How to Request a Signed DPA

Avidra customers with enterprise procurement requirements may countersign this DPA. Email support@avidra.net with subject “DPA execution” and we will return a signed copy within five business days.