AiAssistant24.com
This Data Processing Agreement (“Agreement”) is entered into between:
Digimark
Zgornje Škofije 115m
6281 Škofije
Slovenia
Email: info@aiassistant24.com
(“Processor”)
and
The Customer / Client using AiAssistant24 services
(“Controller”)
This Agreement governs the processing of personal data by the Processor on behalf of the Controller in connection with the use of AiAssistant24 services.
It ensures compliance with the General Data Protection Regulation (GDPR).
Personal Data: Any information relating to an identifiable individual
Processing: Any operation performed on personal data
Controller: The entity determining purposes and means of processing
Processor: The entity processing data on behalf of the Controller
Sub-processor: Third party engaged by the Processor
The Controller determines how and why personal data is processed
The Processor processes data solely on behalf of the Controller
The Processor does NOT use personal data for its own independent purposes.
Nature of Processing:
AI-based call handling (inbound/outbound)
Call recording and transcription (if enabled)
SMS and messaging automation
Appointment booking and scheduling
Storage and routing of communication data
Categories of Data Subjects:
Customers of the Controller
Website visitors
Callers and message participants
Types of Personal Data:
Name
Phone number
Email address
Voice recordings
Message content
Booking and reservation data
This Agreement remains in effect for as long as the Processor processes personal data on behalf of the Controller.
The Processor shall:
Process personal data only on documented instructions from the Controller
Ensure confidentiality of all personal data
Implement appropriate technical and organizational measures
Not sell or use personal data for its own purposes
Assist the Controller with GDPR obligations where reasonably possible
Notify the Controller without undue delay in case of a data breach
The Controller is responsible for:
Ensuring a lawful basis for processing personal data
Informing users that AI systems may handle communications
Obtaining consent where required (e.g., call recording)
Ensuring compliance with GDPR and applicable laws
The Controller acknowledges full responsibility for how the service is used.
The Controller authorizes the Processor to use sub-processors necessary to deliver the service.
These include, but are not limited to:
OpenAI – natural language processing
Google (including Gemini) – AI processing and infrastructure
ElevenLabs – voice synthesis
Twilio – telephony and messaging
Additional sub-processors may include:
Cloud hosting providers
Analytics providers
Monitoring and infrastructure services
The Processor ensures that all sub-processors are subject to GDPR-compliant obligations.
The Processor may update or replace sub-processors at any time. An updated list will be available upon request.
Personal data may be transferred outside the European Economic Area (EEA).
The Processor ensures appropriate safeguards, including:
Standard Contractual Clauses (SCCs)
Use of GDPR-compliant providers
The Processor implements appropriate technical and organizational measures, including:
Encryption (where applicable)
Access controls
Secure infrastructure
The Controller acknowledges that no system can guarantee absolute security.
The Controller acknowledges that:
Personal data may be processed by AI systems
AI outputs are generated automatically and may not always be accurate
AI systems operate based on probabilistic models
The Processor does not guarantee accuracy or reliability of AI-generated outputs.
The Controller is responsible for reviewing and supervising use where necessary.
The Processor shall assist the Controller in fulfilling obligations related to:
Access requests
Correction of data
Deletion requests
Data portability
The Controller remains responsible for responding to such requests.
In the event of a personal data breach, the Processor shall:
Notify the Controller without undue delay
Provide relevant information available at the time
Personal data is retained only as long as necessary to provide the service
Upon termination, data may be deleted within a reasonable period
The Controller may request deletion of data
Each party is responsible for its own compliance with GDPR.
The Processor is NOT liable for:
Unlawful use of the service by the Controller
Failure of the Controller to obtain required consent
Instructions that violate applicable law
The Controller may request information regarding data protection measures.
Formal audits are limited to reasonable requests and must not disrupt operations.
This Agreement terminates automatically upon termination of the main service agreement.
This Agreement is governed by the laws of Slovenia.
This Agreement is governed by the laws of Slovenia.