Data processing agreement

Version: September 2026

between the customer (the „controller“) and Rylivo UG (haftungsbeschränkt), Friedrichstr. 155, 10117 Berlin (the „processor“).

§ 1 Subject matter and duration

(1) The processor provides the controller with the AI-supported telephone call answering services described in the contract of use. The subject matter of this DPA is the processing of personal data on behalf that takes place in the course of those services.

(2) The duration of this DPA corresponds to the term of the contract of use. It ends when that contract ends, but at the latest when the data has been completely deleted or returned under § 8.

§ 2 Nature and purpose of the processing

The processing comprises answering incoming telephone calls, transcribing the conversations in real time, summarising them by machine and recording requests in structured form (in particular callback and appointment requests), as well as notifying the controller by e-mail and making the data available in the dashboard. The purpose is the controller's reachability and the orderly handling of their calls.

§ 3 Categories of data and of data subjects

Categories of data:

• Callers' basic details, insofar as given during the conversation (e. g. name, company)
• Telephone numbers and connection data (time, duration)
• Conversation content in written form (transcript, summary, recorded requests such as callback number and preferred appointment)

Categories of data subjects: the controller's callers (in particular customers, prospective customers, suppliers and other contacts).

§ 4 Obligations of the processor

The processor

1. processes the data exclusively on documented instructions from the controller (Art. 28(3)(a) GDPR); the contract of use and the controller's configuration of the assistant count as instructions. If the processor considers an instruction unlawful, it informs the controller without undue delay;
2. ensures that the persons authorised to process the data have committed themselves to confidentiality (Art. 28(3)(b) GDPR);
3. takes all technical and organisational measures required under Art. 32 GDPR (Annex 1);
4. assists the controller by appropriate means in responding to requests from data subjects (Art. 12–23 GDPR) and with the obligations under Art. 32–36 GDPR, in particular with the notification of personal data breaches; it reports such breaches to the controller without undue delay;
5. deletes or returns the data in accordance with § 8;
6. makes available to the controller all information necessary to demonstrate compliance with Art. 28 GDPR (§ 7).

§ 5 Sub-processors

(1) The controller approves the sub-processors listed in Annex 2. The processor has concluded a contract with each sub-processor imposing on it the same data protection obligations as are set out in this DPA.

(2) The processor informs the controller in text form of any intended engagement or replacement of sub-processors. The controller may object to the change within 14 days on important data protection grounds. If no agreed solution is possible, both parties have a right of extraordinary termination.

§ 6 Transfers to third countries

Processing in third countries takes place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of the EU Standard Contractual Clauses (SCC) with the sub-processors named in Annex 2, supplemented by additional safeguards (in particular transport encryption and pseudonymisation where possible).

§ 7 The controller's rights of inspection

(1) The controller is entitled to verify compliance with this DPA. The processor allows for and contributes to audits — including inspections — conducted by the controller or an auditor mandated by the controller.

(2) Inspections take place after reasonable prior notice during ordinary business hours. The processor may in the first instance furnish evidence by way of suitable documentation, attestations or certifications.

§ 8 Deletion and return

(1) The processor deletes individual records at any time on the controller's instruction.

(2) After the contract of use ends, the processor, at the controller's choice, deletes all personal data or returns it in a common format and deletes existing copies, unless statutory retention obligations preclude this.

§ 9 Final provisions

(1) In the event of contradictions between this DPA and the contract of use, the provisions of this DPA prevail in matters of data protection law.

(2) German law applies. Amendments and additions must be made in text form.

Annex 1: Technical and organisational measures (TOMs)

• Encryption: all data transmissions are transport-encrypted (TLS); stored data is held on encrypted systems of the infrastructure providers.
• Access control: access to call data is limited to the customer concerned (dashboard with access protection, HttpOnly session cookies) and to authorised staff of the processor on a need-to-know basis; administrative access is separately secured.
• Choice of location: processing and storage take place in EU data centres where the providers used make this possible.
• Audio retention with a deletion policy: conversations are recorded as audio after a prior announcement and transcribed; the recording and the transcript are retained and deleted in accordance with the agreed deletion policy.
• Logging: system events and administrative access are logged and evaluated regularly.
• Separation: customers' data is logically separated (all call data is assigned to a tenant).
• Recoverability: regular backups of the database and documented recovery procedures.

Annex 2: Approved sub-processors