Data Processing Agreement.

This Data Processing Agreement ("DPA") is between EchoNova AI L.L.C-FZ, licensed by Meydan Free Zone, Dubai (trade licence no. 2650442.01), Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, UAE ("EchoNova"), and the business that holds an EchoNova account (the "Customer").

The Customer accepts this DPA online, by accepting the Platform Terms or the Enterprise Terms when opening or upgrading its account. No separate signature is needed. The acceptance date, version and account are recorded by EchoNova.

It forms part of the Platform Terms or the Enterprise Terms, whichever applies to the Customer's account (the "Agreement"). If this DPA and the Agreement conflict on data protection, this DPA prevails.

1. Definitions

1.1 "Data Protection Law" means all laws on personal data that apply to the processing under this DPA, including:

• the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its implementing regulations ("UAE PDPL");
• the Saudi Personal Data Protection Law (Royal Decree No. M/19 of 1443H, as amended) and its implementing and transfer regulations ("KSA PDPL"); and
• where the Customer is subject to it, the EU General Data Protection Regulation ("GDPR").

1.2 "Customer Personal Data" means personal data that EchoNova processes for the Customer under the Agreement, including call audio, voice messages, transcripts, chat and messaging content, phone numbers, and AI-generated summaries or actions.

1.3 "Personal Data Breach" means a breach of security that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

1.4 "Subprocessor" means a third party that EchoNova engages to process Customer Personal Data.

1.5 "Controller", "processor", "data subject", "processing" and "sensitive personal data" have the meanings given in the Data Protection Law that applies.

2. Roles

2.1 The Customer is the controller and EchoNova is the processor of Customer Personal Data.

2.2 EchoNova is a separate controller only for the account, billing and usage data it needs to run its business. Its Privacy Policy covers that data.

2.3 The details of the processing are set out in Annex 1.

3. EchoNova's obligations

EchoNova will:

3.1 process Customer Personal Data only on the Customer's documented instructions, which are the Agreement, this DPA, and the Customer's configuration and use of the platform. If EchoNova believes an instruction breaks the Data Protection Law, it will tell the Customer. If the law requires EchoNova to process the data otherwise, it will tell the Customer first, unless the law forbids it;

3.2 ensure everyone authorised to process Customer Personal Data is bound by confidentiality;

3.3 implement the security measures in Annex 2, and keep them appropriate to the risk;

3.4 keep a record of the processing it carries out for the Customer;

3.5 assist the Customer, taking into account the nature of the processing, with data subject requests, security, breach notification, data protection impact assessments, and consultations with regulators;

3.6 make available the information needed to show compliance with this DPA (section 9).

4. AI models and training

4.1 The Customer instructs and authorises EchoNova to train, fine-tune and evaluate EchoNova's own models on a separate copy of Customer Personal Data with names, email addresses and the account link removed, kept for up to 3 years after the Customer's last activity, unless the Customer turns this off in its account settings. After the Customer turns it off, EchoNova takes no new copies; copies taken before stay until their period ends unless the Customer asks EchoNova to delete them. What a model has already learned cannot be removed. The Customer is responsible for telling data subjects about this use and for having a lawful basis for it.

4.2 EchoNova will contractually prohibit its Subprocessors, including any provider of AI models, from using Customer Personal Data to train or improve their models.

4.3 Voice cloning and biometrics. EchoNova will not create a voiceprint or synthetic voice from any data subject's voice unless the Customer has enabled that feature in writing and has confirmed it holds the data subject's explicit consent.

5. Customer's obligations

The Customer:

5.1 is responsible for having a lawful basis for the processing and for giving data subjects the required notices. In particular, it is responsible for informing callers that they are speaking with AI, and for obtaining any consent the law requires before calls are recorded or transcribed (see the Acceptable Use Policy);

5.2 will not send EchoNova categories of data restricted by section 2.7 of the Acceptable Use Policy without EchoNova's prior written agreement;

5.3 is responsible for its own decisions based on AI output.

6. Subprocessors

6.1 The Customer authorises the Subprocessors listed in Annex 3.

6.2 EchoNova will give at least 30 days' notice before adding or replacing a Subprocessor, by email or through a subscription to its subprocessor page. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Services and receive a refund of prepaid fees for the unused period.

6.3 EchoNova will impose data protection terms on each Subprocessor that are at least as protective as this DPA, and remains responsible to the Customer for its Subprocessors.

7. International transfers

7.1 EchoNova will store Customer Personal Data in the hosting region(s) stated in Annex 1. It will not move the data to another country without the Customer's prior written agreement, except for the Subprocessor access listed in Annex 3.

7.2 Every transfer out of the UAE must meet the UAE PDPL's conditions for cross-border transfers. Every transfer out of Saudi Arabia must meet the KSA PDPL transfer regulations. Where needed, the parties will sign the transfer clauses required by the relevant regulator or, for GDPR, the European Commission's standard contractual clauses.

7.3 If a public authority asks EchoNova for Customer Personal Data, EchoNova will refer the authority to the Customer and tell the Customer promptly, unless the law forbids this.

8. Personal Data Breaches

8.1 EchoNova will notify the Customer without undue delay, and in any case within 24 hours of becoming aware of a Personal Data Breach.

8.2 The notice will include, as far as known: what happened; the categories and approximate number of data subjects and records affected; the likely consequences; and the steps taken or proposed. EchoNova will add information as it becomes available.

8.3 EchoNova will help the Customer meet its own duties to notify regulators and data subjects within the time limits of the Data Protection Law: under the UAE PDPL, the UAE Data Office, within the period set by the implementing regulations; under the KSA PDPL, SDAIA, within the regulations' time limit of 72 hours; and the GDPR regulator within 72 hours where the GDPR applies.

8.4 Notifying a breach is not an admission of fault.

9. Audits

9.1 On request, no more than once a year (or after a Personal Data Breach, or when a regulator requires it), EchoNova will answer a reasonable security questionnaire and provide its security policies and any available audit reports or certificates.

9.2 If that is not enough to show compliance, the Customer may carry out an audit itself or through an independent auditor bound by confidentiality, on 30 days' notice, during business hours, and in a way that does not disrupt the Services or expose other customers' data. The Customer bears its own audit costs, unless the audit reveals a material breach by EchoNova.

10. Return and deletion

10.1 During the Agreement, the Customer can delete conversation data through the platform, and can ask for a copy at privacy@echonova.ai.

10.2 When the Agreement ends, EchoNova will, at the Customer's choice made within 30 days, return the Customer Personal Data in a common machine-readable format, and then delete it, including copies held by Subprocessors, from live systems within 60 days of the end date and from backups within a further 35 days.

10.3 EchoNova may keep data longer only during a misuse investigation, a dispute or legal claim, or when an authority or the law requires it, and then only for that purpose and under this DPA. On request it will confirm deletion in writing.

11. Liability

Each party's liability under this DPA is subject to the limitations in the Agreement. Each party is responsible for regulatory fines imposed on it for its own breach.

12. Term, law and disputes

12.1 This DPA lasts as long as EchoNova processes Customer Personal Data for the Customer.

12.2 The governing law and dispute resolution clauses of the Agreement apply, unless the Data Protection Law requires otherwise.

Accepted online with the Platform Terms or the Enterprise Terms.

Annex 1: Details of the processing

Annex 2: Security measures

Annex 3: Authorised subprocessors