Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between YOVAI LLC ("YOVAI", "Processor") and the client ("Controller") under which YOVAI provides its managed AI communication services. This DPA governs YOVAI's processing of personal information on behalf of Controller during the provision of the services.

"Personal Information" means any information that relates to an identified or identifiable natural person that YOVAI processes on behalf of Controller.

"Processing" means any operation performed on Personal Information, including collection, recording, storage, use, transmission, and deletion.

"Sub-processor" means a third party engaged by YOVAI to process Personal Information on Controller's behalf as part of the services.

YOVAI processes Personal Information solely to provide the managed AI communication services, including answering inbound calls, capturing caller intent and details, scheduling or requesting appointments, sending confirmations and reminders, updating connected systems, and delivering internal notifications.

Categories of data typically processed include caller name, phone number, email address, service or appointment request details, and the audio and transcript of the interaction.

Controller is responsible for the lawful basis on which Personal Information is collected and shared with YOVAI, including obtaining any required consents from callers and message recipients, providing accurate business knowledge, and defining the escalation and transfer rules used by YOVAI.

YOVAI will (a) process Personal Information only on documented instructions from Controller, including as configured in the deployment; (b) impose confidentiality obligations on personnel with access to Personal Information; (c) implement reasonable technical and organizational safeguards; and (d) assist Controller with data-subject requests and regulatory inquiries to the extent reasonably practicable.

YOVAI maintains administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, and loss. These include access controls, encryption of data in transit, vendor due diligence, and environment-level logging.

YOVAI relies on qualified Sub-processors to deliver components of the service, including cloud hosting, voice telephony, artificial intelligence model providers, calendaring systems, CRM systems, and messaging providers. YOVAI will impose data-protection obligations on Sub-processors that are no less protective than those in this DPA.

A current list of Sub-processors is available on request by contacting yovel@yovaiagency.com.

Where applicable law grants a data subject the right to access, correct, delete, restrict, object to, or port their Personal Information, YOVAI will provide reasonable assistance to Controller in responding to those requests.

YOVAI retains Personal Information only for as long as necessary to provide the services or as required by law. Upon termination of the services, YOVAI will delete or return Personal Information at Controller's written request, subject to any legal retention obligation.

If YOVAI becomes aware of a confirmed security incident affecting Personal Information processed on Controller's behalf, YOVAI will notify Controller without undue delay and provide the information reasonably available to assist Controller in meeting its own notification obligations.

Personal Information is processed in the United States. Where Controller directs the transfer of Personal Information from another jurisdiction, Controller is responsible for ensuring that a lawful transfer mechanism is in place.

This DPA is effective for the duration of the underlying services agreement and any period during which YOVAI continues to process Personal Information on Controller's behalf. YOVAI may update this DPA to reflect changes in applicable law or the services; material changes will be communicated to Controller.

Questions about this DPA may be sent to yovel@yovaiagency.com.