Data Processing Addendum

• “Applicable Privacy Laws” means all privacy and data protection laws that apply to the processing of Customer Personal Data, including the Act respecting the protection of personal information in the private sector (Quebec) (“Law 25”), the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”), and, where applicable, the EU and UK General Data Protection Regulation and U.S. state privacy laws.
• “Customer Personal Data” means personal information that Vatel processes on behalf of Customer in providing the Service, as described in Annex A.
• “Subprocessor” means a third party engaged by Vatel that processes Customer Personal Data.
• “Security Incident” means any access to, use of, communication of, or loss of Customer Personal Data that is not authorized by law or this DPA, or any other breach of its protection, including a “confidentiality incident” under Law 25.
• “Anonymized” means information that irreversibly no longer allows any person to be identified, directly or indirectly, in accordance with generally accepted best practices.

2.1 Customer is responsible for Customer Personal Data and determines the purposes for which it is processed. Vatel processes Customer Personal Data as a service provider on Customer's behalf.

2.2 Customer is responsible for having a lawful basis to collect Customer Personal Data and to share it with Vatel, including providing any required notices to callers, obtaining any required consent to call recording, and completing any privacy impact assessment required for transfers outside Quebec.

3.1 Vatel will process Customer Personal Data only to provide the Service and in accordance with Customer's documented instructions. The Agreement, any Order Form, and Customer's configuration of the Service constitute Customer's complete instructions.

3.2 Vatel will inform Customer if, in its opinion, an instruction violates Applicable Privacy Laws.

3.3 Vatel will not sell Customer Personal Data or use it for any purpose other than providing the Service, except as permitted in section 11.

Vatel will ensure that every person authorized to access Customer Personal Data is bound by an obligation of confidentiality and has access only to the extent necessary to provide the Service.

5.1 Vatel will implement and maintain the technical and organizational measures described in Annex B, appropriate to the sensitivity of Customer Personal Data.

5.2 Vatel may update these measures over time, provided the overall level of protection is not reduced.

6.1 Customer authorizes Vatel to engage the Subprocessors listed at vatel.ai/security, including those identified in Annex C.

6.2 Vatel will notify Customer of any new Subprocessor at least 30 days before it begins processing Customer Personal Data, by email to customers who have requested notice at privacy@vatel.ai and by updating the list. Customer may object on reasonable privacy grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected Service without penalty and receive a refund of any prepaid fees for the unused period.

6.3 Vatel will impose on each Subprocessor written data protection obligations no less protective than this DPA, and remains responsible for its Subprocessors' performance.

6.4 Providers that Customer chooses to use with its agents (for example, a specific voice or language model, or Customer's own integrations and webhooks) are processed at Customer's direction.

7.1 Customer Personal Data may be processed in Canada and the United States, as described in Annex A and Annex C. Customer-selected providers may process data in other locations, as listed at vatel.ai/security.

7.2 Vatel will provide Customer with the information reasonably needed to assess a transfer of Customer Personal Data outside Quebec under Law 25.

7.3 Where GDPR applies, transfers outside the European Economic Area are made under the European Commission's Standard Contractual Clauses or another valid transfer mechanism.

8.1 Vatel will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data.

8.2 The notice will describe, to the extent known: the nature of the incident, the categories of information involved, the measures taken or proposed, and a contact for more information. Vatel will update Customer as more information becomes available.

8.3 Vatel will take reasonable steps to contain and mitigate the incident and will cooperate with Customer so that Customer can meet its own obligations, including keeping a register of incidents and notifying the Commission d'accès à l'information and affected individuals where required. Unless required by law, Vatel will not notify regulators or individuals on Customer's behalf without Customer's approval.

9.1 Taking into account the nature of the processing, Vatel will assist Customer in responding to requests from individuals exercising their rights under Applicable Privacy Laws, including access, correction, deletion, and data portability. If Vatel receives such a request directly, it will redirect the individual to Customer.

9.2 Vatel will provide reasonable assistance with Customer's privacy impact assessments and consultations with regulators relating to the Service.

10.1 Customer can configure retention of call recordings, transcripts, and related data per agent, from 24 hours to 2 years, and can disable call recordings.

10.2 On termination of the Agreement, Vatel will retain Customer Personal Data for 30 days so Customer can export it, and will then delete it, unless retention is required by law. Data in backups will be deleted in the normal backup cycle and kept protected in the meantime.

10.3 Vatel will not keep Customer Personal Data after the end of the Agreement except as described in this section.

Vatel may create Anonymized, aggregated data from Customer Personal Data to operate, secure, and improve the Service. Vatel will not attempt to re-identify such data and will not use identifiable Customer Personal Data to train artificial intelligence models. Customer may opt out of this use at any time by contacting privacy@vatel.ai.

Upon Customer's written request, Vatel will configure the Service so that its speech, voice, and language model Subprocessors do not retain Customer Personal Data beyond what is necessary to process each request, subject to any additional fees set out in an Order Form.

13.1 On request, Vatel will make available the information reasonably necessary to demonstrate compliance with this DPA, including security documentation and, once available, its SOC 2 Type II report, under confidentiality.

13.2 If that information is not sufficient, Customer may conduct an audit no more than once per year, on at least 30 days' written notice, during business hours, at Customer's cost, and in a way that does not unreasonably disrupt Vatel's operations or compromise other customers' data.

Each party's liability arising out of or related to this DPA is subject to the limitations of liability in the Agreement.

15.1 This DPA remains in effect for as long as Vatel processes Customer Personal Data.

15.2 In the event of a conflict between this DPA and the Agreement regarding the processing of personal information, this DPA prevails.

15.3 This DPA is governed by the laws of the Province of Quebec and the federal laws of Canada applicable therein.

15.4 Vatel may update this DPA from time to time. Material changes will be notified by email at least 30 days before they take effect and will not reduce the protection of Customer Personal Data.

Subject matter: providing the Vatel AI voice agent platform.

Duration: for the term of the Agreement, plus the 30-day period in section 10.2.

Nature and purpose: answering and placing phone calls on Customer's behalf, transcribing speech, generating spoken responses, summarizing calls, booking appointments, sending notifications, syncing data with Customer's integrations, quality assurance, analytics, and support.

Categories of individuals:

• People who call or are called by Customer's agents
• Customer's employees and authorized users
• Contacts in Customer's integrated systems (CRM, calendar, ticketing)

Categories of personal information:

• Phone numbers, names, email addresses
• Call audio recordings, transcripts, and summaries
• Information callers share during calls, which may include sensitive information depending on Customer's use case (for example, health or legal matters)
• Appointment and booking details
• Call metadata (time, duration, outcome)
• Account information for Customer's users

Voice data: Vatel processes voice audio only to transcribe and respond to calls. Vatel does not create voiceprints or use voice data to identify individuals.

Locations: Canada (language model processing) and the United States (speech-to-text, text-to-speech, telephony, database and storage). Customer-selected providers may process in other locations, as listed at vatel.ai/security.

• Encryption: data encrypted in transit using TLS and at rest using AES-256 (databases, audio files, transcripts).
• Access control: role-based access, multi-factor authentication for internal administrative access and customer console accounts, need-to-know access for staff.
• Secrets management: API keys, database credentials, and SIP tokens stored in encrypted vaults with rotation.
• Environment separation: development, staging, and production are separated; production data is not used in non-production testing.
• Network protection: web application firewall and rate limiting.
• Retention controls: configurable per-agent retention and option to disable recordings.
• Change management: automated CI/CD with rollback capability.
• Monitoring and logging: centralized logging of system activity.
• Vendor management: written data protection terms with Subprocessors.
• Compliance program: SOC 2 Type II and ISO 27001 programs in progress.

The full and current list is at vatel.ai/security.