Data Processing Agreement

1. Parties, formation and precedence

The processor is Totem Studio International Technologies, S.L., tax ID B45528395, Ronda de Buenavista 24, bloque 9, 4.º C, 45005 Toledo, Spain, registered in the Toledo Commercial Registry, volume 1,171, section 8, sheet TO-19.191 ("Totem"). Privacy contact: hello@totemstudio.ai. Totem has not appointed a data protection officer. The controller is the customer identified by legal name, tax ID, address and workspace in the acceptance record (the "Customer").

This Agreement forms part of the service contract when an authorized representative of the Customer accepts it together with the Terms of Service. The acceptance record identifies both parties, the representative, the date, the document version and its content digest, and the Customer's saved privacy settings, and can be downloaded by the Customer. This Agreement prevails over the Terms of Service on the processing of Customer personal data. It does not limit data subjects' rights or either party's statutory obligations.

Where the Customer itself acts as processor for a third-party controller, it confirms that it is authorized to appoint Totem as sub-processor and will pass on that controller's instructions; the same obligations apply. Totem's processing of its own account, billing, security and business-contact data is described in its Privacy Policy and is outside this Agreement.

2. Subject matter, nature, purpose and duration

Totem processes Customer personal data to provide the services the Customer selects: AI voice and chat assistants, telephony connection, CRM, bookings, messaging, automations, knowledge features, support and related administration. Processing includes collection, recording, transcription, storage, organization, retrieval, AI inference and summarization, transmission to the channels and providers the Customer enables, export, restriction and erasure. Schedule A describes the data and data subjects.

Processing lasts for the term of the service contract and the return and deletion period in section 12. Recording and transcription are enabled by default on supported voice channels and can be changed in the platform settings.

3. Documented instructions

Totem processes Customer personal data only on the Customer's documented instructions, which are this Agreement, the Terms of Service, the settings the Customer configures in the platform and written requests to support, including with regard to international transfers. Totem does not sell Customer personal data, use it for its own advertising or use it to train general-purpose AI models.

If Union or Member State law requires Totem to process beyond those instructions, Totem will inform the Customer beforehand unless that law prohibits it on important grounds of public interest. Totem will immediately inform the Customer if, in its opinion, an instruction infringes data protection law, and may suspend the affected processing until the instruction is confirmed or amended.

4. Customer obligations

The Customer determines the purposes and means of its processing and is responsible for: having a lawful basis and, where required, consent for each processing and communication (including outbound calls and messages); informing data subjects at collection, including of recording, transcription and the use of AI, using the notice and greeting tools the platform provides and adapting them to its activity; honoring objections and opt-outs; configuring the retention it needs; and handling data subject requests as controller.

The Customer will not upload data it is not entitled to process, and will not use the service for unlawful surveillance, discrimination, impersonation or decisions with legal or similarly significant effects based solely on automated processing. Where the Customer's activity requires special categories of data (for example, health appointments), the Customer is responsible for the applicable GDPR art. 9 condition, selects the sensitive-sector privacy setting and limits collection to what is necessary.

5. Confidentiality

Totem restricts access to Customer personal data to personnel who need it to provide, support or secure the service, and ensures they are bound by confidentiality obligations that continue after their access ends. Totem staff access Customer workspaces only for support requested by the Customer, security, incident handling or legal obligations.

6. Security

Totem implements the technical and organizational measures in Schedule C, appropriate to the risk under GDPR art. 32, taking into account the state of the art, costs, and the nature, scope, context and purposes of processing. Totem regularly reviews their effectiveness and may update them provided the overall level of protection is not reduced.

7. Sub-processors

The Customer gives general written authorization for Totem to engage the sub-processors listed in Schedule D. Totem will notify the Customer by email and in the platform at least 30 days before adding or replacing a sub-processor, identifying the provider, service, data and location. The Customer may object on reasonable data protection grounds within that period. The parties will seek a solution in good faith; if none is available, the Customer may terminate the affected service without penalty and receive a refund of prepaid fees for the unused period.

Totem imposes on each sub-processor, by written contract, data protection obligations equivalent to those in this Agreement, and remains fully liable to the Customer for their performance. On request, Totem will provide a copy of the relevant terms, which may be redacted to protect confidential information.

Services the Customer connects with its own accounts (listed in Schedule D as customer-connected) operate under the Customer's own contract with that provider and are not Totem sub-processors. Totem only exchanges data with them on the Customer's instructions.

8. International transfers

Totem's core infrastructure is located in the European Union. Transfers outside the EEA take place only as described in Schedule D and on the basis of an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914, with supplementary measures where needed. By accepting this Agreement, the Customer instructs Totem to make those transfers.

Where the Customer is established outside the EEA, the return of data to the Customer is governed by module 4 (processor to controller) of the Standard Contractual Clauses, which are incorporated by reference where required.

9. Assistance with data subject rights

Taking into account the nature of processing, Totem assists the Customer, through the platform functions (search, export, rectification and deletion of contacts, conversations and recordings) and through support, in responding to requests to exercise rights under Chapter III GDPR. Totem will forward to the Customer without undue delay any request it receives concerning Customer data and will not respond to it on its own, except to refer the requester to the Customer.

10. Personal data breaches

Totem will notify the Customer's account contact without undue delay and in any case within 48 hours of becoming aware of a personal data breach affecting Customer personal data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact point. Information not yet available will be provided in phases without undue delay.

Totem will take reasonable measures to contain and remedy the breach, preserve evidence and assist the Customer with its notifications to the supervisory authority and data subjects under GDPR arts. 33 and 34. The Customer decides on its own notifications.

11. Impact assessments, records, information and audits

Totem assists the Customer with data protection impact assessments and prior consultations under GDPR arts. 35 and 36, taking into account the information available to it. Each party keeps the record of processing activities required for its role (GDPR art. 30).

Totem makes available the information necessary to demonstrate compliance with this Agreement and allows and contributes to audits, including inspections, by the Customer or an auditor it mandates, subject to reasonable notice (at least 30 days, except after a breach or at a supervisory authority's request), confidentiality and security conditions, and without access to other customers' data. Totem may first answer through documentation and questionnaires. Audits beyond one per year, other than after a breach or at an authority's request, are at the Customer's cost.

12. Return and deletion

During the contract the Customer can export and delete its data using the platform functions. After termination, the Customer has 30 days to request the export of its data in a structured, commonly used format. Totem will then delete Customer personal data from its active systems and instruct its sub-processors to do so within a further 30 days, and will confirm deletion in writing on request. Backups expire on their rotation cycle (at most 98 days) and are protected from ordinary use until then; a restoration reapplies pending deletions.

Totem may retain data only where Union or Member State law requires it (for example, invoicing and accounting records), limited to the data and period that law requires and with restricted access. Data held by customer-connected providers is deleted under the Customer's own agreements with them.

13. Liability, term and law

Each party is liable for its own breaches of this Agreement and of data protection law under GDPR art. 82. Between the parties, the limitations of liability of the Terms of Service apply, except where the law does not permit them.

This Agreement remains in force as long as Totem processes Customer personal data. It is governed by Spanish law, and the jurisdiction clause of the Terms of Service applies, without prejudice to data subjects' rights and the powers of supervisory authorities. The Spanish and English versions are equally authentic; in case of discrepancy, the Spanish version prevails.

Schedule A — Description of processing

Data subjects: the Customer's prospects, customers, callers and message senders, booking participants, contacts in its CRM, and the Customer's own staff and authorized users.

Categories of data: identification and contact data (name, phone, email, channel identifiers); content of calls (audio recordings and transcripts), messages and attachments; summaries, notes and classifications generated by the service; appointment and service-request details; lead and CRM data; operational metadata (dates, durations, numbers, delivery status). Only the data needed for the services the Customer enables.

Special categories: not processed by default. Where the Customer's activity requires it (for example, health appointments), special categories disclosed by data subjects may be processed on the Customer's instructions and under its responsibility for the art. 9 condition, with the same security measures and data minimization. Criminal-offence data is excluded.

Nature and purposes: providing, operating, securing and supporting the services the Customer selects, as described in section 2. The Customer's purposes, channels and activity profile saved in the platform's privacy settings are archived with the acceptance record and complete this description.

Schedule B — Retention

Platform content (recordings, transcripts, messages, contacts, notes, bookings) is kept until the Customer deletes it or until the automatic deletion period the Customer configures in Settings (calls and messages can expire separately, for example after 30, 90, 180 or 365 days; leads have review reminders). Totem does not apply an automatic deletion period by default because the Customer, as controller, determines retention.

For these managed backend sessions, Totem requests deletion after a completed voice call has been reconciled, or after the completed onboarding result has been saved in a durable checkpoint. Abandoned sessions become eligible after seven days of inactivity. Failed deletions remain pending and are retried; completion must be verified. This session-state policy does not erase the separate CRM record, recording, backup or provider security log, each of which follows its applicable retention instructions.

Security and operational logs are kept up to 12 months. Database backups: point-in-time recovery for 7 days and scheduled backups retained up to 98 days. After termination, section 12 applies.

Schedule C — Technical and organizational measures

Hosting and location: core infrastructure on Google Cloud in the European Union (database eur3, storage and functions europe-west1), automation servers in France and Germany; providers with ISO 27001 and/or SOC 2 certifications.

Access control: authenticated access via Firebase Authentication; authorization scoped to each team (workspace) enforced on the server and in database security rules; role-based permissions for Customer users; Totem staff access restricted to authorized personnel and logged.

Encryption: TLS encryption in transit; encryption at rest by the infrastructure provider; connected-account tokens and provider credentials additionally encrypted with AES-256-GCM and stored server-side only.

Application security: anti-abuse verification (Firebase App Check) on public endpoints; rate limiting; input validation; separation of production data in a dedicated named database; secrets kept out of source code; reviewed and tested software changes.

Availability and resilience: point-in-time recovery (7 days), scheduled backups retained up to 98 days and delete protection on the production database.

Data protection by design: recording and retention controls in the platform; deletion and export functions with auditable receipts; minimization of data sent to AI providers to what each function requires; AI disclosure at the start of voice interactions by default.

Organization: confidentiality obligations for staff; incident response and breach notification procedure (section 10); supplier due diligence before engaging sub-processors; periodic review of these measures.

Schedule D — Sub-processors and customer-connected services

The list of sub-processors engaged by Totem and of customer-connected services, with each provider's entity, service, data, location and transfer mechanism, is published at /legal/subprocessors and forms part of this Schedule. Changes follow section 7.