Data Processing Agreement (DPA)

Preamble

This Data Processing Agreement (the "DPA") is entered into between:

• the Client, a legal entity or natural person that has subscribed to the Sylen Service under the Terms and Conditions of Sale, acting as controller within the meaning of Article 4.7 GDPR;
• and SYLEN SAS, a French simplified joint-stock company (Société par Actions Simplifiée) with share capital of €1,500, registered with the Nancy Trade and Companies Register (RCS) under number 999 064 215, SIRET 999 064 215 00018, intra-EU VAT number FR 36 999 064 215, whose registered office is located at 31 rue de Turique, 54000 Nancy, France, represented by its President, Mr. Idris MAADI, acting as processor within the meaning of Article 4.8 GDPR (hereinafter "Sylen").

This DPA is inseparable from the Terms and Conditions of Sale and forms an integral part of the Contract between the Client and Sylen. It is automatically accepted by the Client at the time of subscription and prevails over any contrary provision of the Terms and Conditions of Sale with respect to GDPR obligations.

01Subject matter

The purpose of this DPA is to define the conditions under which Sylen, as processor, processes on behalf of the Client the personal data necessary for the provision of the Sylen Service, in accordance with the obligations of Article 28 GDPR.

It specifies in particular:

• the nature, purpose, duration and subject matter of the processing (Annex 1);
• the categories of data and of data subjects (Annex 1);
• the obligations and responsibilities of the Parties;
• the technical and organizational security measures (Annex 2);
• the list of authorized sub-processors (Annex 3);
• the conditions for transfers outside the European Union.

02Definitions

The terms used in this DPA have the meaning given to them by Article 4 GDPR. In particular:

• Client or Controller: the legal entity or natural person that has subscribed to the Sylen Service, determining the purposes and means of the processing of the data subjects' data.
• Sylen or Processor: SYLEN SAS, processing the data on behalf of and on the instructions of the Client.
• Data subjects: the identified or identifiable natural persons whose data is processed, mainly the callers of the AI agent, and secondarily the business contacts, prospects and employees of the Client entered in the CRM and the calendar.
• Personal data: any information relating to a data subject within the meaning of Article 4.1 GDPR.
• Processing: any operation performed on personal data within the meaning of Article 4.2 GDPR.
• Data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data (Art. 4.12 GDPR).
• Sub-processor: a third party to which Sylen entrusts all or part of the processing carried out on behalf of the Client (hosting, telephony, AI model, email, payment, calendar).
• Service: the Sylen service (website sylen.ai and application app.sylen.ai) as described in the Terms and Conditions of Sale.

03Description of the processing

The detailed description of the processing entrusted to Sylen (nature, purpose, duration, categories of data, categories of data subjects) is set out in Annex 1 to this DPA.

In summary, Sylen processes the following data on behalf of the Client:

• call metadata (caller's number, timestamp, duration, status);
• text transcripts generated in real time from the audio stream;
• the audio stream of calls, processed in real time and neither recorded nor retained, either by Sylen or by the voice provider;
• appointment text messages sent to callers who accept them during the call;
• call summaries and detected intents;
• messages taken by the agent for the Client;
• appointments created, modified or canceled by the agent;
• contacts and prospects (internal CRM) entered by the Client or created by the agent.

04Obligations of the Processor

4.1 Processing on documented instructions (Art. 28.3.a)

Sylen processes personal data only on documented instructions from the Client, including with regard to transfers outside the European Union, unless required to do so by Union or Member State law. In the latter case, Sylen informs the Client before the processing, unless prohibited by law.

The Client's instructions are embodied in:

• these provisions and their annexes;
• the Terms and Conditions of Sale and the Terms of Use;
• the configuration of the AI agent carried out by the Client from its client account (system prompt, voice, hours, business rules, calendar integrations, message-taking, appointment-booking and call transfer tools);
• the retention and notification settings configured in the client account;
• any one-off instruction sent in writing to contact@sylen.ai.

Sylen immediately informs the Client if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

4.2 Confidentiality (Art. 28.3.b)

Sylen ensures that the persons authorized to process the personal data:

• have committed themselves contractually to confidentiality or are under an appropriate statutory obligation of confidentiality;
• are made aware of the requirements of personal data protection and receive the necessary training;
• access the data only on a need-to-know basis, that is, strictly to the extent necessary for the performance of their duties.

4.3 Security of processing (Art. 28.3.c & 32)

Sylen implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. These measures are detailed in Annex 2 to this DPA.

4.4 Sub-processors (Art. 28.2 & 28.4)

See section 05 and Annex 3.

4.5 Assistance with data subject rights (Art. 28.3.e)

Sylen assists the Client, through appropriate technical and organizational measures and insofar as possible, in responding to requests to exercise data subject rights (Articles 15 to 22 GDPR). The following features are made available to the Client in its client account:

• Data export (right to data portability, Art. 20): complete self-service ZIP download from the Profile page;
• Access and rectification: direct access to calls, transcripts, messages, appointments and CRM contacts, with the ability to modify or delete them individually;
• Erasure: automatic deletion of transcripts and messages after 12 months, or on request;
• Restriction and objection: targeted deactivation of future processing by the Client from the client account (deactivation of the AI agent, individual deletion of a call or a CRM contact). The exercise of rights over data already collected about an identified data subject is handled by forwarding the request to the Client.

If a request to exercise rights is sent directly to Sylen by a data subject, Sylen forwards it to the Client without delay and does not respond on the Client's behalf, unless instructed otherwise in writing.

4.6 Assistance to the Controller (Art. 28.3.f)

Sylen assists the Client, taking into account the nature of the processing and the information available to it, in ensuring compliance with the obligations set out in:

• Article 32 (security of processing);
• Article 33 (notification of a breach to the supervisory authority);
• Article 34 (communication of a breach to the data subject);
• Article 35 (data protection impact assessment - AIPD / DPIA);
• Article 36 (prior consultation of the supervisory authority).

Upon reasoned written request, Sylen provides the Client with the information necessary to carry out a DPIA on the processing covered by this DPA, in particular the description of the security measures, data flows and sub-processors involved.

4.7 Breach notification (Art. 28.3.f & 33.2)

In the event of a personal data breach affecting the data processed on behalf of the Client, Sylen notifies the Client as soon as possible and no later than 72 hours after becoming aware of it, by email sent to the GDPR contact address provided in the client account (or, failing that, to the email of the main account).

The notification contains, to the extent the information is available:

• the nature of the breach and, where possible, the categories and approximate number of data subjects and records concerned;
• the likely consequences of the breach;
• the measures taken or proposed by Sylen to address the breach and mitigate its effects;
• the name and contact details of the Sylen contact point from whom more information can be obtained.

Where the information cannot be provided at the same time, it is provided in phases without undue further delay.

4.8 Return and deletion at the end of the contract (Art. 28.3.g)

See section 09.

4.9 Provision of information and right of audit (Art. 28.3.h)

See section 10.

05Sub-processors

5.1 General authorization. The Client authorizes Sylen to engage the sub-processors listed in Annex 3 to carry out the processing. This general authorization is given pursuant to Article 28.2 GDPR.

5.2 Contractual safeguards. Sylen enters into a contract with each sub-processor imposing data protection obligations equivalent to those of this DPA, in accordance with Article 28.4 GDPR, in particular with regard to confidentiality, security, assistance with rights, breach notification and international transfers.

5.3 Notification of changes. Sylen notifies the Client, by email or via the client account, of any intended change concerning the addition, replacement or removal of a sub-processor processing Client data, with a minimum prior notice of 30 days before it takes effect.

5.4 Right to object. During this period, the Client may submit in writing to contact@sylen.ai a reasoned objection concerning the compliance of the new sub-processor. The Parties will then endeavor, in good faith, to find a solution. Failing agreement within a reasonable period, the Client may terminate the Contract without compensation, on the effective date of the change, by way of derogation from the Terms and Conditions of Sale.

5.5 Liability. Sylen remains fully liable to the Client for the performance by the sub-processors of their obligations.

06Transfers outside the European Union

6.1 Location. The personal data processed on behalf of the Client is stored in the European Union: Supabase database in Ireland, application run by Vercel in Paris, Railway voice server in the Netherlands, calls on most numbers processed by Twilio in Ireland. However, some processing takes place outside the EEA, mainly in the United States: the voice engine (ElevenLabs), which processes call audio and produces the transcript and the agent's response; text analysis (OpenAI), which in particular writes the summary of each call; sending of text messages and calls on certain numbers (Twilio); sending of emails (Resend). The U.S. companies that operate Vercel, Railway and Twilio, and the Singaporean company that operates Supabase, may also access the data for operational and support purposes. See Annex 3.

6.2 Legal framework. Any transfer outside the EEA is governed by at least one of the following mechanisms, provided for in Articles 44 to 49 GDPR:

• the Standard Contractual Clauses (SCCs) adopted by the European Commission by Implementing Decision (EU) 2021/914 of June 4, 2021, in their "Controller to Processor" or "Processor to Processor" module, as applicable;
• the sub-processor's participation in the EU-U.S. Data Privacy Framework, where it is certified (adequacy decision 2023/1795);
• supplementary technical measures (TLS encryption in transit, encryption at rest, RLS access controls, pseudonymization) and organizational measures, in accordance with EDPB Recommendations 01/2020.

6.3 Transfer impact assessment. Upon written request, Sylen makes available to the Client a summary of the transfer impact assessments (Transfer Impact Assessment) carried out for the main sub-processors.

07Retention periods

Sylen applies a retention policy that differs by data category, automated by a daily "cron" job. The periods applicable to the data processed on behalf of the Client are as follows:

08Records and documentation (Art. 30.2)

Sylen maintains a record of the categories of processing activities carried out on behalf of the Client, in accordance with Article 30.2 GDPR. This record contains:

• the name and contact details of the processor and, where applicable, of its representative;
• the categories of processing carried out on behalf of the Client;
• transfers outside the EU and the associated safeguards;
• a general description of the security measures (Annex 2).

This record is made available to the supervisory authority or to the Client upon written request.

09Return and deletion at the end of the contract

Upon termination of the Contract, for whatever reason, Sylen undertakes to:

1. Maintain access to the export for a period of 30 days from the effective date of termination. During this period, the Client can download all of its data from the client account, in a structured, commonly used and machine-readable ZIP JSON format (right to data portability, Art. 20).
2. Automatically delete or anonymize, on day 30, the personal data processed on behalf of the Client, namely:
   • complete deletion of transcripts, summaries, messages and appointments;
   • anonymization of call metadata (aggregated histories retained for internal statistical and billing purposes);
   • deletion of the user profile and anonymization of references in the client account.
3. Retain, where applicable, the data strictly necessary to comply with a legal retention obligation, in particular billing data retained for 10 years pursuant to Article L. 123-22 of the French Commercial Code.

A written certificate of deletion can be issued on request at contact@sylen.ai.

10Audits and inspections (Art. 28.3.h)

10.1 Principle. Sylen makes available to the Client all information necessary to demonstrate compliance with the obligations of this DPA and of Article 28 GDPR.

10.2 Documentation available. Upon written request from the Client, Sylen provides:

• an extract from the record of processing activities (Art. 30.2);
• a summary of the security measures implemented (Annex 2);
• any audit reports or third-party certifications that Sylen may come to hold, where applicable subject to a confidentiality undertaking;
• the up-to-date list of sub-processors and their transfer safeguards.

10.3 On-site or remote audit. The Client may, no more than once a year, conduct an audit of the compliance of the processing with the obligations of this DPA, under the following conditions:

• written notice of 30 days, sent to contact@sylen.ai;
• audit carried out by the Client's teams or by an independent third party bound by an equivalent confidentiality undertaking;
• audit carried out during business hours, without disrupting Sylen's operational activity, and at the Client's expense, it being specified that if the audit reveals a material breach by Sylen of its obligations under this DPA, the reasonable and documented costs of the audit are borne by Sylen, up to a limit of €5,000 excl. VAT;
• the audit may not cover the data of other clients or Sylen's trade secrets.

10.4 Audit following a breach. In the event of a proven data breach affecting the Client's data, a targeted audit outside the annual quota may be conducted at the Client's request, at the Client's expense unless Sylen is proven to be at fault.

11Liability and limitations

11.1 Each Party is liable for damage caused by processing that does not comply with the GDPR under the conditions provided for in Article 82 GDPR.

11.2 The limitations and caps on liability provided for in the Terms and Conditions of Sale apply to this DPA, except where a limitation would be contrary to Article 82.3 GDPR (intentional misconduct, failure to comply with a lawful instruction, serious breaches of the processor's obligations).

12Term, amendment, governing law

12.1 Term. This DPA enters into force on the date on which the Client accepts the Terms and Conditions of Sale and remains applicable for the entire term of the Contract, as well as for the obligations surviving its termination (return, deletion, confidentiality, audit).

12.2 Amendment. Sylen may amend this DPA to take into account regulatory changes, decisions of supervisory authorities, new EDPB recommendations, or changes in its sub-processors. Substantial amendments are notified to the Client by email with a minimum prior notice of 30 days. In the event of refusal, the Client may terminate the Contract without compensation, under the conditions provided for in the Terms and Conditions of Sale.

12.3 Signable version. A version of this DPA in signable contractual form (PDF) can be sent to the Client upon written request to contact@sylen.ai. This version strictly reproduces the provisions published on this page on the date of the request.

12.4 Governing law. This DPA is governed by French law. Any dispute relating to its interpretation or performance is submitted to the competent court designated by the Terms and Conditions of Sale.

A1Annex 1 - Description of the processing

A1.1 Subject matter and nature of the processing

Processing of incoming phone communications intended for the Client by a voice artificial intelligence conversational agent, including receiving the call, real-time transcription, generating a voice response, taking messages, booking, modifying or canceling appointments, transferring the call to a human, and creating CRM entries.

A1.2 Purpose of the processing

Provision of the Sylen Service for the benefit of the Client, namely the automation of phone reception: no longer missing calls, qualifying requests, booking appointments, taking messages and forwarding priority calls.

A1.3 Duration of the processing

Term of the Contract entered into between the Client and Sylen, plus the post-termination retention periods described in Article 9 and Article 7.

A1.4 Categories of data subjects

• Callers: natural persons dialing the number assigned to the Client, whether they are clients, prospects, suppliers, candidates or other contacts of the Client.
• Contacts and prospects entered by the Client or created by the agent in the internal CRM.
• Persons invited to an appointment created by the agent.
• Client's staff members receiving a call transfer or a message.

A1.5 Categories of personal data

• Identification data: last name and first name as given orally, calling phone number.
• Contact details: email, postal address, additional phone number, where provided during the call.
• Conversation content: text transcript of the exchange between the caller and the AI agent (no audio is retained), automatic summary, detected intent.
• Appointment text messages: caller's mobile number, text, date and status of sending.
• Technical metadata: timestamp, duration, status (answered, missed, transferred), Twilio number used.
• Calendar data: title, date, time, duration, participants and comments of the appointment.
• CRM data: status (prospect, client, archive), reason for contact, score, notes entered by the Client or the agent.

Special categories (Art. 9). Sylen does not process sensitive data within the meaning of Article 9 GDPR. The Client contractually undertakes to configure its agent so as not to request such data from callers. For healthcare professional accounts, the agent collects only administrative information, no transcript or audio recording is retained, and the content of past calls, messages and appointments is erased after 30 days.

A1.6 Processing operations

• collection (via the phone stream and entry in the client account);
• text recording (transcription; no audio retained, and no transcript for healthcare professional accounts);
• organization, structuring, storage;
• consultation by the Client in its client account;
• disclosure to the sub-processors listed in Annex 3;
• erasure or anonymization upon expiry of the retention periods.

A2Annex 2 - Security measures

Sylen implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR.

A2.1 Technical measures

• Encryption in transit: minimum TLS 1.2 on all streams (website, application, API, WebSocket, audio stream between telephony and the voice engine);
• Encryption at rest: encryption of databases and storage by the hosting providers (Supabase, Vercel);
• Multi-tenant isolation: PostgreSQL Row-Level Security (RLS) access control on all tables containing Client data (auth.uid() applied to every query);
• Authentication: hashed passwords (bcrypt), two-factor authentication (2FA) by code sent by email with a dedicated secret and signed time-limited tokens;
• WebSocket security: HMAC-SHA256 tokens signed with a shared secret key, short expiry, timing-safe verification on the server side;
• Prompt injection protection: sanitization of content before transmission to the AI model;
• Security headers: Content-Security-Policy, HSTS, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy, Permissions-Policy;
• In-memory rate limiting on sensitive endpoints (AI assistant, scraping, voice preview, support chat, Coshy training, data export);
• Daily automatic encrypted backups of the database, regular restoration tests;
• Logging of administrator access and security events.

A2.2 Organizational measures

• Password policy and mandatory 2FA on internal accounts with extended rights;
• Access management based on the principles of least privilege and need-to-know;
• Contractual confidentiality undertaking for any person authorized to process the data;
• Data protection awareness training upon hiring and when the regulatory framework changes;
• Dedicated GDPR contact point (contact@sylen.ai) monitoring data protection questions;
• Incident management: documented procedure for qualifying, containing and notifying data breaches within 72 hours;
• Periodic review of access, sub-processors and security measures.

A2.3 Measures specific to voice activity

• No audio recording retained, either by Sylen or by the voice provider, which does not keep any transcript either: the voice is processed in real time, for the duration of the conversation;
• AI Act transparency: the caller is informed as soon as the call is answered that they are talking with an artificial intelligence agent (Art. 50 Regulation (EU) 2024/1689);
• Maximum call duration capped on the WebSocket side to limit exposure;
• Automatic deletion of transcripts after 12 months by a scheduled process (daily cron job).

A3Annex 3 - List of sub-processors

Up-to-date list of the sub-processors engaged by Sylen to carry out the processing, their roles, their locations and the applicable transfer safeguards.

Google Calendar and Outlook Calendar are only activated after the Client's explicit consent in its client account. If they are not activated, no data is transmitted to these sub-processors.