Data Processing Agreement

1. Parties and Scope

This DPA applies to personal data submitted to Listenscene by or on behalf of the Controller, including data relating to the Controller's website visitors and callers processed through the Listenscene widget.

2. Roles

The Controller determines the purposes and means of processing personal data relating to its end users. Hevichay processes that data solely on documented instructions from the Controller to provide Listenscene.

3. Subject Matter, Duration, and Nature of Processing

Processing is limited to hosting, transmitting, transcribing, summarizing, and otherwise operating voice interactions configured by the Controller for the duration of the subscription and any applicable retention period.

4. Types of Personal Data

Depending on Controller configuration and end-user interactions, processing may include:

• Contact details and account information for Controller personnel
• Caller audio, transcripts, and AI-generated summaries
• Technical identifiers such as IP address, browser data, and session metadata
• Information voluntarily shared by callers during conversations

5. Categories of Data Subjects

Data subjects may include:

• Controller employees and authorized account users
• Website visitors and callers interacting with the widget
• Other individuals whose data the Controller chooses to process through the Service

6. Controller Obligations

The Controller agrees to:

• Ensure a lawful basis exists for processing and provide required privacy notices
• Configure assistants responsibly and avoid submitting unlawful or excessive data
• Respond to data subject requests where the Controller is responsible
• Ensure authorized users comply with applicable law and the Terms of Service

7. Processor Obligations

Hevichay will:

• Process personal data only on documented instructions from the Controller
• Implement appropriate technical and organizational security measures
• Ensure personnel with access are bound by confidentiality obligations
• Assist the Controller with data subject requests where reasonably possible
• Delete or return personal data upon termination, subject to legal retention requirements

8. Sub-processors

The Controller authorizes Hevichay to engage trusted sub-processors needed to operate Listenscene. A current list is available upon request, as described in our Privacy Policy.

9. Data Subject Requests

If Hevichay receives a request directly from a data subject relating to processing performed on behalf of the Controller, we will promptly notify the Controller unless prohibited by law and provide reasonable assistance.

10. Security Incidents

Hevichay will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data and provide information reasonably required for the Controller to meet its legal obligations.

11. Deletion and Export

Upon termination of the Service, Hevichay will delete or return Controller personal data within a reasonable period, unless retention is required by law. Export options may be available through the Service or upon request during the subscription term.

12. Audits

Upon reasonable notice and subject to confidentiality obligations, Hevichay will provide information necessary to demonstrate compliance with this DPA. Onsite audits may be conducted no more than once per year unless required by law or a competent authority.

13. Contact

To request a signed copy of this DPA, a subprocessor list, or privacy assistance for your organization, contact privacy@hevichay.com.

14. Governing Law and Jurisdiction

These Terms are governed by the laws of Madagascar. Any dispute shall be submitted to the competent courts of Madagascar, subject to mandatory provisions of applicable law.