Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Workky Terms of Service between WORKKY, Inc. ("Workky") and the customer that accepts the Terms ("Customer"). It applies whenever Workky processes personal information about Customer's callers, contacts, or staff ("Customer Personal Data") on Customer's behalf.

1. Roles

Customer is the business (controller). Workky is Customer's service provider (processor) under the California Consumer Privacy Act and comparable laws.

2. Workky's obligations

Workky will:

1. Process only on instructions. Process Customer Personal Data only to provide the Services described in the Terms and as Customer instructs through the platform. Workky will not process it for any other purpose.
2. Not sell or share. Not sell Customer Personal Data or share it for cross-context behavioral advertising.
3. Not combine. Not combine Customer Personal Data with data from other customers or sources, except as needed to provide the Services.
4. Not train AI. Not use Customer Personal Data to train, fine-tune, or improve any AI or machine-learning model.
5. Confidentiality. Ensure staff with access are bound by confidentiality obligations.
6. Security. Maintain the safeguards described on the Security & Compliance page, including encryption in transit and at rest, access controls, and logging.
7. Subprocessors. Use only the subprocessors listed at workky.ai/subprocessors, flow down equivalent obligations to them, remain responsible for them, and give Customer 15 days' notice before adding a new one.
8. Assist with rights requests. Within 10 business days, provide Customer with the tools or information needed to respond to a consumer's request to access, delete, or correct their data.
9. Breach notice. Notify Customer without undue delay, and within 72 hours, after confirming a security incident involving Customer Personal Data, with reasonable detail.
10. Deletion. Delete or return Customer Personal Data within 30 days after the Terms end, except as law requires retention; purge backups within 90 days.
11. Compliance. Comply with applicable privacy law and notify Customer if Workky determines it can no longer meet its obligations.
12. Audit. Once per year on 30 days' notice, answer Customer's reasonable written security questionnaire and provide available vendor audit reports.

3. Customer's obligations

Customer will:

• Have a lawful basis to collect and share Customer Personal Data with Workky.
• Provide any notices to callers required by law (Emma's call disclosure covers recording and AI status; Customer covers its own website and intake notices).
• Not provide Protected Health Information under HIPAA unless and until a Business Associate Agreement is signed with Workky.
• Use the platform's settings to control retention and access.

4. Details of processing

• Subject matter: Operating Emma and Workky CRM for Customer.
• Duration: The term of the Customer's subscription plus the deletion period.
• Nature and purpose: Answering calls and web conversations, transcribing, booking appointments, sending SMS confirmations, storing records.
• Data subjects: Customer's callers, prospects, clients, and staff.
• Data categories: Names, phone numbers, emails, call audio, transcripts, appointment details, and any information callers choose to share.

5. Liability

Each party's liability under this DPA is subject to the limitations in the Terms.

6. Precedence

If this DPA conflicts with the Terms, this DPA controls for matters of personal data processing.