Data Processing Agreement

For caller, booking, transcript and Customer-imported data, the Customer is the controller and Alovo is the processor. Alovo processes this data only on documented instructions in the Terms, account configuration and support requests, unless law requires otherwise.

• Subject: operating an AI receptionist, telephony, bookings, messages, integrations, quality controls, security and support.
• Data subjects: callers, Customer staff, prospects, patients or clients, and other people whose data the Customer supplies.
• Data: contact details, call audio when enabled, transcripts, summaries, appointment details, messages, technical identifiers and configured business data.
• Duration: the subscription plus the deletion and backup period described in the Privacy Policy or agreed with the Customer.

• Ensure authorised personnel are bound by confidentiality.
• Maintain proportionate technical and organisational security measures.
• Assist the Customer with data-subject requests, security assessments and legally required impact assessments where reasonably possible.
• Notify the Customer without undue delay after confirming a personal-data breach affecting Customer data.
• Delete or return Customer data after the service ends, except where retention is legally required.

The Customer authorises Alovo to use infrastructure, telephony, speech, AI, messaging, monitoring and payment subprocessors needed for the service. Alovo remains responsible for placing appropriate data-protection obligations on subprocessors and will provide current provider information on request or in the Privacy Policy.

Alovo will use a lawful transfer mechanism and required safeguards for data sent outside its country of origin. The Customer is responsible for determining whether its use case permits a particular destination or provider; Alovo will support a configuration that restricts providers where commercially available and agreed.

On reasonable written request, Alovo will provide information needed to demonstrate compliance. Audits must protect other customers, security controls and confidential information and should first use existing reports and documentation.