Data Processing Agreement

1. Who the parties are and when this agreement applies#

• Controller: the company that signs up for atendIA ("you"). It is the one that decides what your customers' data is used for.
• Processor: ATENDIA TECNOLOGIA LTDA, CNPJ (Brazilian company tax ID) 69.450.061/0001-57, which processes this data on your behalf, to provide the service.

This agreement is part of the Terms of Use and applies automatically from the creation of the account, with no need for a separate signature. On the protection of your customers' personal data, it prevails over the Terms. If your legal team needs a signed copy, ask at [email protected]: we send the same text digitally signed with the company's ICP-Brasil certificate (the Brazilian public key infrastructure).

On the data of the people who use the dashboard (sign-up, login, billing), atendIA is the controller, and the Privacy Policy governs.

2. Purpose and subject of the processing#

atendIA processes your customers' personal data exclusively to provide the contracted service: receiving, storing, organizing and displaying the conversations of your channels; sending the messages that your team, your automation or your AI send; booking and showing appointments; generating reports; and, when you turn it on, generating answers with artificial intelligence and transcribing audio.

The duration of the processing is that of your subscription, plus the return and deletion period of section 12.

3. What data and from whom#

4. Your instructions#

atendIA processes the data according to your instructions, which are: these terms and policies, and what you configure in the dashboard (connected channels, AI on or off, model provider, team permissions, automatic messages). If an instruction of yours, in our assessment, violates the LGPD, we tell you before complying with it.

5. What atendIA undertakes to do#

• Not use it for its own purposes. No advertising, profiling, sale or transfer of your customers' data, under any circumstances.
• Not train artificial intelligence on the content of your conversations, neither ours nor a third party's. Model providers are contracted under a mode that does not use content sent through the API to train their models.
• Confidentiality. Only those who need it to operate the service access data, and with a duty of secrecy. Support access to your account depends on the approval of whoever administers the account, is time-limited and is logged (see the Support Policy).
• Security. Maintain the technical measures described in Security and data, among them the isolation of each company by the database itself and the record of who did what.
• Record of processing operations, as article 37 of the LGPD requires.
• Help you comply with the law: respond to data subject requests (section 10), provide the information you need for an impact assessment report (article 38) and answer your legal team's security questionnaires.

6. What your company is responsible for#

• Have a legal basis to process your customers' data and to send messages to them.
• Inform your customers that the service uses a platform and, if applicable, artificial intelligence, in your own privacy notice.
• Respect the consent and opt-out of those who receive messages, as the Acceptable Use Policy requires.
• Request and record only the necessary data, especially health data and other sensitive categories.
• Give each person on the team the minimum access they need, and keep passwords secret.

7. Sub-processors#

You authorize atendIA to use the sub-processors listed in Sub-processors, for the purposes described there. Before adding a new sub-processor, we notify you by email at least 30 days in advance. If you disagree, you can cancel before the change takes effect, with no penalty, as with any cancellation.

Artificial intelligence providers only receive data when the AI is on. With it off, no conversation content goes to a model provider.

8. International transfer#

Some of the sub-processors process data outside Brazil. The transfer takes place on the basis of article 33 of the LGPD, for the performance of this contract and under the contractual clauses of the respective suppliers. If your operation cannot transfer data outside the country, the AI can be left off: in that case atendIA works as an inbox, sales funnel and calendar.

9. Security incident#

If atendIA confirms an incident affecting your company's personal data, we notify you without undue delay and in time for you to meet the 3 business day deadline of Resolution CD/ANPD nº 15/2024 to notify the ANPD (Brazil's national data protection authority) and the data subjects, where applicable. The notice states:

• what happened and when, as far as is known;
• what data and, approximately, how many data subjects were affected;
• what has already been done to contain it and what is still being done;
• who at atendIA is the contact for the incident.

Information that is not yet available is sent as soon as it exists, without waiting for the final report.

10. Data subject requests#

If a customer of yours asks atendIA for access, correction or deletion of their data, we forward the request to you, since you are the one who decides, and we notify the data subject. We do not delete your customer's data on our own without your instruction, except by legal order, because that would destroy a history that is yours. The dashboard already lets your team view and delete conversations and contacts.

11. Demonstrating compliance#

On request, we provide in writing the information you need to demonstrate that the processor complies with this agreement: security measures, the list of sub-processors, the record of incidents that affected your company. An on-site audit depends on prior agreement on scope, date and confidentiality.

12. End of the contract: return and deletion#

• You export your data at any time while the account exists.
• After cancellation, the data is kept for 30 days, in case of a change of mind or a late export, and is then deleted.
• If you want deletion before that, the path is in Data deletion.
• Only what the law requires us to keep is retained (the tax record of the subscription and the minimum access record, under the Marco Civil da Internet, Brazil's internet law) and the record of the deletion request itself.

13. Liability#

Each party answers for what it did, under articles 42 to 45 of the LGPD. The processor is jointly liable when it breaches the law or the controller's lawful instructions. The limits of liability in the Terms of Use apply to the extent the law permits.

14. Changes to this agreement#

A relevant change is notified by email at least 30 days in advance and never reduces the protection already promised to the data on the platform. Questions about this agreement: [email protected].