Scope
This Data Processing Agreement (“DPA”) applies where NaviCS AI processes personal data on behalf of a customer in connection with the Services and applicable data-protection law requires such processing to be governed by contractual terms.
Roles
For applicable processing activities:
- the customer acts as the data controller/business or equivalent role; and
- NaviCS AI acts as the data processor/service provider or equivalent role.
The parties' roles may vary for particular processing activities where required by applicable law.
Processing Instructions
NaviCS AI will process personal data only for purposes necessary to provide the Services and in accordance with the customer's documented instructions, subject to applicable law.
Nature and Purpose of Processing
Processing may include:
- collection;
- storage;
- organization;
- retrieval;
- transmission;
- analysis;
- AI processing;
- communication;
- reporting;
- deletion;
- other processing necessary to provide the Services.
Categories of Data
Depending on customer configuration, personal data may include:
- identity information;
- contact information;
- business information;
- communications;
- telephone information;
- call recordings;
- transcripts;
- account information;
- technical and usage information.
Categories of Data Subjects
Data subjects may include:
- customers;
- prospects;
- leads;
- employees;
- contractors;
- business contacts;
- other individuals whose information the customer submits to the Services.
Confidentiality
Persons authorized to process personal data should be subject to appropriate confidentiality obligations.
Security Measures
NaviCS AI maintains technical and organizational security measures appropriate to the Services and the risks associated with processing.
These may include:
- authentication controls;
- access controls;
- tenant isolation;
- encryption of certain sensitive credentials;
- audit logging;
- security monitoring;
- credential-management controls;
- incident-response procedures.
Under legal review. Final Annex describing specific technical and organizational measures.
Subprocessors
NaviCS AI may use subprocessors to provide infrastructure and supporting services.
Subprocessor engagement is subject to applicable contractual and legal requirements.
Under legal review. Attach the final list of subprocessors and applicable authorization/notification mechanism.
International Data Transfers
Where processing involves international transfers, the parties will implement applicable transfer mechanisms required by applicable data-protection law.
Under legal review. Final transfer mechanism and jurisdiction-specific clauses.
Data Subject Requests
Taking into account the nature of processing, NaviCS AI will provide reasonable assistance to the customer in responding to applicable data-subject requests.
Security Incidents
NaviCS AI will maintain processes for identifying and responding to security incidents involving personal data.
Under legal review. Final notification standard and contractual notification period.
Retention and Deletion
Following termination of applicable Services, personal data will be handled in accordance with the applicable agreement, documented customer instructions, legal obligations, and NaviCS AI's applicable retention and deletion processes.
Under legal review. Final retention and deletion period.
Under legal review. No specific universal deletion period should be stated until the retention schedule and technical deletion process have been approved.
Audits and Compliance Information
Under legal review. Final audit-rights, security-questionnaire, certification, and evidence provisions.
Under legal review. NaviCS AI should not represent that it holds a particular independent security certification unless that certification has been verified and is currently applicable.
Liability
Under legal review. Final liability allocation, indemnification, and contractual limitations.
Order of Precedence
If this DPA conflicts with another agreement between the parties concerning processing of personal data, the parties should specify which terms take precedence.
Under legal review. Final precedence clause.
Annexes
The final DPA should include, as applicable:
- Annex I: Processing Details
- Annex II: Technical and Organizational Security Measures
- Annex III: Approved Subprocessors
- Annex IV: International Transfer Mechanisms
Under legal review. Complete and approve all annexes before the DPA is presented as an executed contractual document.