Data Processing Addendum

This Data Processing Addendum (“DPA”) supplements the Finn General Terms and Conditions (the “Agreement”) entered into by and between AIforge Tech Private Limited (“Processor”) and the client agreeing to these terms (“Controller”).

This DPA governs the processing of Personal Data in connection with Controller’s use of the Finn platform — AI agents for voice calls, WhatsApp, website chat, SMS and email, the shared inbox, and the Rep Parallel Dialer (the “Services”).

1. Definitions

• “Applicable Data Protection Laws” means all applicable federal, state, and international laws and regulations relating to the privacy and security of Personal Data, including but not limited to the California Consumer Privacy Act (CCPA) as amended by the CPRA, the EU General Data Protection Regulation (GDPR), the UK GDPR, the Digital Personal Data Protection Act, 2023 (India), and applicable US State Privacy Laws (e.g., Virginia, Colorado, Connecticut, Utah, Florida).
• “Controller Data” means any Personal Data processed by Processor on behalf of Controller pursuant to the Agreement.
• “Personal Data” means any information relating to an identified or identifiable natural person contained within Controller Data (including voice audio, spoken names, phone numbers, message content and attachments, WhatsApp profile names, email addresses and website chat visitor data).
• “Sub-processor” means any third-party data processor engaged by Processor to assist in fulfilling its obligations under the Agreement.

2. Roles and Scope of Processing

2.1 Roles of the Parties. For the purposes of Applicable Data Protection Laws, Controller is the Data Controller (or “Business”), and Processor sits strictly as the Data Processor (or “Service Provider”).

2.2 Scope of Processing. Processor shall process Controller Data strictly to provide the Services, and strictly in accordance with documented instructions from Controller (which include the settings, prompt configurations, channel connections, retention settings, Dialer settings and API Webhooks configured by Controller within the platform).

3. Specific AI, Telephony & Messaging Restrictions

3.1 No Model Training. Processor acknowledges and agrees that Controller Data shall not be used to train, retrain, fine-tune, or benchmark any artificial intelligence, Large Language Model (LLM), or Speech-to-Text (STT) model, whether owned by Processor or by its third-party Sub-processors. Processor engages third-party model providers under terms, or with account settings, that exclude Controller Data from model training, and uses zero-data-retention configurations where the provider offers them and they are included in Controller’s plan. Where such a configuration is not offered or not so included, the provider may retain data only for a limited operational period under its own terms, and not for model training.

3.2 Live Audio Processing. Processor processes live conversational audio in memory to convert speech to text and generate responses. Call recordings are stored only where recording is enabled for the call, and are kept subject to Controller’s retention settings under Section 7 (default: twenty-four (24) months, unless Controller configures otherwise).

3.3 Disclosure Tools. Processor provides tools to deliver recording and AI disclosures: the “First Utterance” disclosure at the start of AI calls, including for jurisdictions that require two-party recording consent (e.g., Florida Stat. § 934.03); an AI disclosure that Controller can configure for chat conversations; and a recording notice played at the start of recorded Dialer calls. Controller remains solely legally responsible for deciding which disclosures and consents the law requires, and for configuring the Services to deliver them before any call is recorded or any AI interaction proceeds.

3.4 Messaging Channels. Processor processes messages, attachments and voice notes sent and received on the channels Controller connects (WhatsApp, website chat, SMS and email), stores them as Controller Data subject to Section 7, and sends message content to Sub-processor language models only to generate the replies, summaries and analytics Controller has configured. Where Controller connects WhatsApp, Controller does so under its own agreement with Meta; Meta processes those WhatsApp messages under that agreement and is not Processor’s Sub-processor for them. Processor uses data received from Meta, including Controller’s access token, only to provide the Services to Controller and in line with Meta’s terms for platform data, and never for advertising or model training.

3.5 Rep Parallel Dialer. For calls that Controller’s representatives place through the Dialer, Processor places and connects the calls and, as Controller configures, records them (recordings are stored with Processor’s telephony Sub-processor), transcribes them, and generates summaries and coaching. On every answered call, Processor analyses the first seconds of audio with Sub-processor speech and language models to detect voicemail, whether or not the call is recorded. Dialer data is retained as set out in Section 7. Processor keeps call outcomes, attempt counts and do-not-call flags for the life of Controller’s account, so that Controller’s opt-outs and limits keep working, and deletes them under Section 7.

4. Sub-processing

4.1 Authorized Sub-processors. Controller grants Processor general authorization to engage Sub-processors to deliver the Services (e.g., cloud hosting, telecommunications carriers and messaging providers, email delivery, and no-training LLM APIs with zero-data-retention configurations where offered and applicable to Controller’s plan). A current list of Sub-processors is maintained at hirefinn.ai/subprocessors.

4.2 Notice of New Sub-processors. Processor shall provide Controller with at least fourteen (14) days’ written notice of the addition of any new Sub-processor. Notice is given by email to Controller’s account owner and by updating the list at hirefinn.ai/subprocessors. If Controller has a reasonable, data-protection-related objection to the new Sub-processor, Controller may terminate the applicable portion of the Services without penalty.

4.3 Flow-down Obligations. Processor shall enter into a written agreement with each Sub-processor imposing data protection obligations that meet the requirements of Article 28(4) GDPR and other Applicable Data Protection Laws, and remains responsible to Controller for each Sub-processor’s performance of those obligations.

5. Security & Personal Data Breaches

5.1 Technical and Organizational Measures (TOMs). Processor shall implement and maintain the technical and organizational security measures set forth in Schedule B.

5.2 Security Incident Notification. If Processor becomes aware of a confirmed security incident resulting in the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Controller Data (a “Personal Data Breach”), Processor shall notify Controller without undue delay, and in any event within forty-eight (48) hours.

6. Data Subject Requests

Processor shall, to the extent legally permitted, promptly notify Controller if Processor receives a request from a Data Subject (e.g., an individual who spoke or chatted with a Controller’s deployed agent, or was called through the Dialer) exercising their rights under Applicable Data Protection Laws (such as a request to erase their call transcript or chat conversation). Processor shall not respond to such requests directly, other than to pass them to Controller, and will provide Controller with the tools or assistance necessary to execute the Data Subject’s request.

7. Return and Deletion of Data

Upon termination or expiration of the Agreement, at Controller’s election, Processor shall either return Controller Data to Controller in a commonly used, machine-readable format or securely delete it, in each case within thirty (30) days, except to the extent that retention is required by applicable law. Controller may also request deletion of specified Controller Data at any time by written request to [email protected], and Processor shall complete such deletion within thirty (30) days. Deleted Controller Data may persist in encrypted backups until those backups expire in the normal backup cycle (no longer than thirty-five (35) days), during which it is not used or restored except to recover from an incident.

Controller instructs Processor, as a documented instruction under this DPA, to retain call recordings and transcripts, messages and chat conversations (WhatsApp, website chat, SMS and email in the Finn inbox) and Dialer records for twenty-four (24) months, or for any other period Controller sets in its workspace retention settings, and to delete them when that period ends.

When Controller disconnects WhatsApp, Processor stops receiving new messages for that number, deletes the access token and removes its access to Controller’s WhatsApp Business Account. Stored conversations remain subject to the retention instruction above unless Controller requests their deletion.

In addition, Controller instructs Processor, as a documented instruction under this DPA, to automatically and permanently delete all stored Controller Data comprising call communications (including audio recordings and transcripts) associated with Controller’s account if that account remains entirely inactive for twelve (12) consecutive months.

Upon Controller’s written request, Processor shall confirm completion of any deletion under this Section in writing.

7A. Data Location

Processor stores Controller Data at rest in the region agreed for Controller’s workspace in its order form or account settings (United States, India, Singapore, UAE, United Kingdom or Germany (EU)), or, where no region has been agreed, in India. Rep Parallel Dialer recordings are stored with Processor’s telephony Sub-processor, and service and error logs with its monitoring Sub-processor, in the locations listed at hirefinn.ai/subprocessors. AI processing, telephony and messaging may take place in other regions, as listed there, and WhatsApp messages are also processed by Meta.

8. California (CCPA / CPRA) Specific Terms

To the extent Controller Data belongs to California residents:

1. Processor is acting solely as a “Service Provider”.
2. Processor shall not “Sell” or “Share” Controller Data (as those terms are defined under the CPRA).
3. Processor shall not retain, use, or disclose Controller Data for any purpose other than for the specific business purpose of performing the Services specified in the Agreement.
4. Processor shall not combine Controller Data with personal information received from other sources, except as permitted for service providers under the CCPA/CPRA.
5. Processor shall notify Controller if it determines that it can no longer meet its obligations under the CCPA/CPRA.
6. Upon such notice, Controller may take reasonable and appropriate steps to stop and remediate any unauthorized use of Controller Data.

9. International Data Transfers

9.1 Restricted Transfers. Where Processor’s processing of Controller Data involves a transfer of Personal Data out of the European Economic Area (EEA), the United Kingdom, or Switzerland to a country without an adequacy decision, the mechanisms in this Section apply.

9.2 EU Standard Contractual Clauses. The parties incorporate by reference the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (the “EU SCCs”) for transfers governed by the GDPR: Module Two (Controller-to-Processor) between Controller and Processor, and Module Three (Processor-to-Processor) for onward transfers to Sub-processors. The EU SCCs are governed by the law of Ireland, and the courts of Ireland have jurisdiction over disputes arising from them. The information required for the Annexes to the EU SCCs is set out in Schedules A and B, and a completed copy of the Annexes is provided on request at [email protected].

9.3 UK and Swiss Transfers. For transfers governed by the UK GDPR, the parties incorporate the UK International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner. For transfers governed by the Swiss FADP, the EU SCCs apply with the amendments identified by the Swiss Federal Data Protection and Information Commissioner.

9.4 Supplementary Measures. The parties acknowledge the technical and organizational measures in Schedule B and Section 3 as supplementary measures protecting transferred data, including AES-256 encryption at rest, TLS 1.2/1.3 in transit, in-memory processing of live audio, exclusion of Controller Data from model training, zero-data-retention configurations where offered and applicable to Controller’s plan, tenant isolation, and least-privilege access.

9.5 Precedence and Government Access. In the event of a conflict between the EU SCCs or UK Addendum and this DPA, the SCCs or UK Addendum prevail with respect to the Personal Data they govern. Processor shall, to the extent legally permitted, notify Controller of any binding request from a public authority for disclosure of Controller Data and challenge requests that are unlawful under Applicable Data Protection Laws.

10. Confidentiality, Assistance & Audit

10.1 Personnel Confidentiality. Processor ensures that persons authorized to process Controller Data are bound by an appropriate written or statutory duty of confidentiality.

10.2 DPIA and Prior-Consultation Assistance. Taking into account the nature of processing and the information available to it, Processor shall provide Controller with reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities relating to the Services.

10.3 Audit. Processor shall make available to Controller the information reasonably necessary to demonstrate compliance with this DPA, and satisfies this obligation by providing its most recent SOC 2 Type II report (under confidentiality) and responses to a reasonable security questionnaire. On-site audits are available only where these are insufficient to satisfy a mandatory legal requirement, and are limited to once per twelve (12) months, on at least thirty (30) days’ written notice, at Controller’s cost, under confidentiality, during business hours, and without disrupting Processor’s operations.

10.4 Governing Law. Except where the Standard Contractual Clauses or the UK Addendum mandate otherwise, this DPA is governed by the law governing the Agreement, and disputes under it are resolved through the same dispute-resolution mechanism as the Agreement.

Schedule A: Details of Processing

• Subject Matter: Providing the Services to Controller: AI agents that handle inbound and outbound voice calls and conversations on WhatsApp, website chat, SMS and email; a shared inbox where Controller’s team can read, reply and take over; and the Rep Parallel Dialer for calls by Controller’s representatives. It also covers related transcription, recording, data extraction, analytics, contact lists and, at Controller’s request, contact-data enrichment.
• Nature of Processing: Receiving, recording, transcribing, storing, retrieving and analysing Personal Data (analysis includes generating AI replies, summaries, sentiment and extracted fields, and detecting voicemail on Dialer calls), transmitting it to carriers and messaging platforms, and deleting it.
• Purpose of Processing: To provide, secure and support the Services in accordance with the Agreement and Controller’s documented instructions.
• Duration of Processing: The term of the Agreement plus the wind-down period until return or deletion under Section 7 (thirty (30) days).
• Frequency: Continuous, for as long as Controller uses the Services.
• Categories of Data Subjects: (a) Controller’s customers, leads, prospects, patients, debtors and other contacts who call, are called by, message, chat or email with Controller through the Services, including people in contact lists Controller uploads; (b) visitors to Controller’s websites who use the chat widget; (c) Controller’s employees, contractors and representatives who use the Services, including representatives whose voices are recorded on Dialer calls and team members whose replies and actions are logged; and (d) job applicants or others Controller chooses to contact.
• Categories of Personal Data: Calls: phone numbers, caller-ID metadata, voice audio and recordings, transcripts, call duration, timestamps, routing and disposition data, and anything a person says during the call. Messages and chat: message text, attachments, images and voice notes; phone numbers, WhatsApp profile names, email addresses and names people give; delivery and read status; timestamps; for website chat, also the page the chat started from, browser type and IP address. Dialer: lead names and phone numbers, call outcomes, notes, follow-ups, attempt counts and do-not-call flags; recordings, transcripts, summaries and coaching; representatives’ names, the phone numbers they use to take calls, their voices on recorded calls, and their activity. Contact lists and enrichment: contact details Controller uploads and, at Controller’s request, business contact data from the enrichment providers listed at hirefinn.ai/subprocessors. Analytics: conversation summaries, sentiment and mood analysis, extracted fields and lead scores. Account users: names, email addresses, roles and activity logs of Controller’s team members.
• Sensitive Data: Protected Health Information (PHI) may be processed only by enterprise Controllers who have executed a Business Associate Agreement (BAA) with Processor; that BAA governs the handling of PHI, and PHI is processed only by Sub-processors that have agreed to equivalent business associate terms with Processor. Absent an executed BAA, the Services are not intended for PHI, and chat AI agents and the Rep Parallel Dialer are not intended for PHI unless Processor has agreed to it in writing. By default, the Services are likewise not intended for cardholder data governed by the Payment Card Industry Data Security Standard (PCI DSS), and Controller is instructed not to configure agents to request Social Security Numbers, national ID numbers, financial account credentials or full payment-card numbers on calls, in chat or in messages. Where a Controller requires the processing of cardholder data, such processing is supported only under a separate, custom Master Services Agreement and data-protection terms that define the applicable PCI DSS-aligned controls and the responsibilities of each party.
• Retention: As set out in Section 7: by default, call recordings and transcripts, messages and chat conversations, and Dialer records are kept for twenty-four (24) months, or the periods Controller sets. All Controller Data is returned or deleted within thirty (30) days of termination.
• Sub-processors: As listed at hirefinn.ai/subprocessors, for the purposes and in the locations stated there, for the duration above.

Schedule B: Technical & Organizational Measures (TOMs)

1. Encryption in Transit: All telephony signaling (SIP/TLS) and API Webhook traffic passing between Controller, Processor, and Sub-processors is encrypted using TLS 1.2 or TLS 1.3.
2. Encryption at Rest: All Controller Data stored by Processor — including audio files, transcripts, message and conversation databases, Dialer records, attachments and backups — is encrypted at rest using AES-256.
3. Access Controls: Access to production infrastructure containing Controller Data is restricted to authorized Processor personnel on a least-privilege basis, enforced via Multi-Factor Authentication (MFA) and SSH keys.
4. Tenant Isolation: Controller Data is logically segregated by workspace; one Controller cannot query, call or access the data, conversations, inboxes, call records or voice instances of another Controller.

AIforge Tech Private Limited · D-253, Kardhani Govindpura, Kalwar Road, Jaipur, Rajasthan, India - 302012 · CIN: U62099RJ2025PTC099494 · [email protected]