Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) supplements the Terms of Service between Ventureship and the customer using SME AI (“Customer”). It applies where Ventureship processes personal data on Customer’s behalf in providing the Services (“Customer Personal Data”).

For Customer Personal Data, Customer is the controller (or business) and Ventureship is the processor (or service provider). If there is a conflict between this DPA and the Terms regarding Customer Personal Data, this DPA prevails.

2. Details of processing

• Subject matter: provision of the Services, including conversations with Samantha, campaign attribution, payments, handoffs and customer records.
• Duration: the term of the Terms, plus any period needed to return or delete data.
• Data subjects: Customer’s leads, customers, end users, partners and personnel.
• Categories of data: contact details, conversation content, recordings and transcripts where enabled, purchase and payment status, and campaign and attribution information.

3. Processing on instructions

Ventureship will process Customer Personal Data only on Customer’s documented instructions, including those given through the Services’ settings and configuration, unless required otherwise by law. Ventureship will not sell Customer Personal Data or use it for purposes outside the Services.

4. Confidentiality

Ventureship ensures that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.

5. Security measures

Ventureship maintains appropriate technical and organizational measures to protect Customer Personal Data, including encryption in transit, role-based access controls, separation of each customer’s data within the Services and logging of significant activity.

6. Subprocessors

Customer authorizes Ventureship to engage subprocessors to help provide the Services. Ventureship will impose data protection obligations on subprocessors that are no less protective than this DPA and remains responsible for their performance. Information about current subprocessors is available on request through our contact page.

7. Assistance and data subject requests

Taking into account the nature of the processing, Ventureship will provide reasonable assistance to help Customer respond to data subject requests and meet its obligations relating to security, breach notification and impact assessments. If Ventureship receives a request directly from a data subject relating to Customer Personal Data, it will refer the request to Customer where possible.

8. Personal data breaches

Ventureship will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to help Customer meet its obligations.

9. International transfers

Where Customer Personal Data is transferred across borders in a way that requires safeguards under applicable law, the parties will rely on an appropriate transfer mechanism.

10. Return and deletion

On termination of the Services, Ventureship will delete or return Customer Personal Data at Customer’s choice within a reasonable period, except where retention is required by law.

11. Information and audits

Ventureship will make available information reasonably necessary to demonstrate compliance with this DPA and will cooperate with reasonable audit requests, subject to confidentiality and reasonable notice.