Data Processing Agreement (DPA)

Version of June 11, 2026 — integral part of the Terms

1. Purpose

This Data Processing Agreement (GDPR art. 28) governs the personal data processing that Secondia (“the Processor”) performs on behalf of the Client (“the Controller”) as part of the AI agent services.

2. Nature and purposes

Receiving and qualifying phone calls; creating, sending and tracking invoicing documents; payment reminders; customer support replies. Sole purpose: performance of the subscribed service.

3. Data categories and minimization

Identity and contact details of callers (name, phone, email), message content, invoice references and amounts, payment statuses. Strict minimization: for healthcare professions, no health data (claim forms, named procedure codes, medical reasons, patient records) is processed or stored — only invoice references, amounts and statuses.

4. Duration

For the duration of the contract. Upon termination, deletion or return of data at the Client's choice within 30 days, except legal retention obligations.

5. Processor obligations

Process only on the Client's documented instructions; ensure confidentiality (staff and systems); implement appropriate technical and organizational measures (encryption in transit, access control, logging, per-client isolation); assist the Client with data subject requests and breach notifications (notice to the Client within 48h); maintain a record of processing.

6. Sub-processors

The Client authorizes the following sub-processors: Vercel (application hosting), Supabase (database, EU), Stripe (payments), Anthropic (AI models), Resend (transactional email), and where applicable the telephony/voice provider named in the contract. Secondia informs the Client of any change and remains fully liable for its sub-processors.

7. Transfers outside the EU

Where sub-processors process data outside the EU, transfers are governed by standard contractual clauses or an adequacy mechanism. Data is hosted in the EU whenever possible.

8. Audit

Once a year, the Client may request evidence of the Processor's compliance (description of measures, sub-processor attestations).