1. Parties and scope

This agreement is between the party named on the signature page (the "Controller") and [legal name], of [address] (the "Processor").

It supplements the service agreement between the two parties.

2. Subject matter and duration

The Processor provides an AI agent platform that talks with the Controller's customers by phone, WhatsApp, SMS and website chat, and processes personal data for that purpose only.

Processing lasts for the term of the service agreement.

3. Data categories and data subjects

Data categories: contact records, conversation messages, call recordings, caller memory records and consent records.

Data subjects: the Controller's customers, callers and contacts, and the users the Controller adds to its account.

4. Controller instructions

The Processor processes personal data only on the Controller's documented instructions. The account settings, the service agreement and this agreement are documented instructions.

5. Security

The security measures in place at the date last checked (2026-10-17) are set out in Annex A. Items marked "In progress" are not yet in place and are not warranted by the Processor.

6. Sub-processors

The Controller authorises the Processor to use the sub-processors listed in Annex B. The Processor will notify the Controller in writing of any addition or change.

7. Transfers of personal data

Some sub-processors may process data outside Saudi Arabia. Transfer terms with the providers are in progress. The regions in Annex B are those that could be confirmed at the date last checked.

8. Data subject rights

The Processor will help the Controller answer data subject requests through [security contact email]. Self-service for these requests inside the platform is in progress.

9. Personal data breaches

The Processor will notify the Controller without undue delay after it becomes aware of a breach affecting personal data.

10. Retention and deletion

Retention periods are being defined. The parties will agree in writing the retention period and the method of deletion or return at the end of the service agreement.

11. Information and audit

On written request, the Processor will give the Controller the reasonable information needed about how this agreement is carried out.

12. Regulatory status

The Processor is working towards the requirements of the GDPR and the Saudi PDPL, and does not claim to meet them today.

For SOC 2, the Processor is preparing for an independent audit.

13. Governing law

This agreement is governed by [governing law].

14. Signature

For the Processor: [legal name], represented by [signatory].

For the Controller: name, title, signature and date: ____________________