Data Processing Agreement (DPA)
Version: 6 August 2026
1. Subject and roles
HalloMia (Archibo GmbH, "Processor") processes personal data exclusively on behalf and on the instructions of the customer ("Controller") pursuant to Art. 28 GDPR. The Controller remains responsible for the lawfulness of processing its callers' and contacts' data.
2. Subject, duration, nature, purpose
Provision of an AI phone assistant (call answering, appointment booking, message taking, transcription) for the term of the main contract plus statutory periods.
3. Data subjects and categories
The Controller's callers and contacts, and its staff where applicable. Categories: master data (name, phone, email), communication content (audio recordings — where activated — and transcripts), appointment and message data, call metadata. Special categories (Art. 9) depending on the Controller's industry — the Controller ensures the legal basis.
4. Technical and organizational measures
Encryption in transit (TLS) and at rest, role-based access control, per-organization tenant separation, audit log, automated security gates in the delivery pipeline.
5. Sub-processors
| Sub-processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Vapi | Voice-AI orchestration, call handling, recording/transcript | USA | SCC |
| Twilio | Telephony/numbers, SMS | EU/USA | SCC/DPF/BCR — additionally processes certain data as an independent controller (billing, fraud prevention, legal obligations, product improvement) per Twilio DPA §3 |
| Stripe | Payments | EU/USA | SCC |
| SendGrid (Twilio) | Transactional email | USA | SCC — backups up to 1 year post-termination (Twilio DPA §9) |
| Google / Microsoft | Calendar integration | EU/USA | SCC (opt-in only) |
| Anthropic | LLM processing | USA | SCC |
| ElevenLabs / Cartesia | TTS | USA | SCC |
| Deepgram (via Vapi) | STT | USA | SCC |
| Jina AI | Website analysis (public customer website only) | USA | SCC |
| Microsoft Azure | Hosting/DB/Storage | EU | EU region |
Changes are announced at least 30 days in advance in text form; the Controller may object on substantial data-protection grounds. Where individual providers (also) act as independent controllers, that processing lies outside this processor relationship; the respective agreements between Archibo GmbH and the provider govern.
6. Instructions
Processing only on documented instructions; this agreement and the platform configuration constitute documented instructions.
7. Deletion and return
Upon termination, deletion or return at the Controller's choice, subject to statutory retention. Retention: audit log 2 years (pseudonymization entries 6 years), usage/connection data 7 months, call recordings 30 days (configurable), billing data 10 years (German tax/commercial law).
8. Assistance, audits, notifications
Assistance with data-subject rights (Art. 15–22) and notification duties (Art. 33/34); provision of information required for audits; notification of personal-data breaches without undue delay.