# Data processing agreement > The contract between Deduxer S.R.L. and the businesses that use Onist: what the receptionist does, what you pay, what each side is responsible for. _Deduxer S.R.L. · Onist · The short version_ - This section is the data processing agreement under Article 28 of the GDPR between you, as controller, and us, as processor, for the personal data of your callers, customers and staff that we process to provide the service ("customer data"). We can sign it as a standalone document on request. ## 14. Data processing agreement This section is the data processing agreement under Article 28 of the GDPR between you, as controller, and us, as processor, for the personal data of your callers, customers and staff that we process to provide the service ("customer data"). We can sign it as a standalone document on request. Subject matter and duration. We process customer data to run the receptionist, the app and the messages for you, for as long as your account exists plus the deletion period below. What we process. Phone numbers, names, vehicle details and plates, what callers say (the audio while the call lasts, which is not stored, then the transcript and a summary), appointments, messages sent and received, consent flags, the notes you and your staff add, the facts the owner asks the WhatsApp assistant to remember, and the content of the apps you connect (what they send to Onist and what you approve sending through them). The people concerned are your callers, your customers and the staff you invite into the app. Your instructions. We process customer data only to provide the service, as described in these terms and as you configure the app. Your settings in the app are your written instructions. We tell you if we think an instruction breaks the law. Confidentiality. Only people who need access to help you have it, and they are bound by confidentiality. We may read a call's transcript to fix a problem you reported or to check quality, never to build profiles. Security. Database policies keep each business's data apart. Files are private and open only through links that expire. Changes are audited and application logs leave out caller content. Data is encrypted in transit and at rest. No call audio is stored. Keeping data in the EU does not remove international transfers, which the Privacy Policy lists. Sub-processors. We use the providers listed in section 6 of the Privacy Policy, under contracts that impose the same obligations on them. We tell you by email at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we cannot offer an alternative, you may cancel with a refund of any prepaid period you have not used. Transfers. Some providers process data outside the European Economic Area, among them OpenAI, which runs the AI on calls from the United States, and Composio, which connects the apps a business chooses to connect, also from the United States. Each such transfer relies on the Standard Contractual Clauses adopted by the European Commission or on another mechanism under Chapter V of the GDPR, such as an adequacy decision. The Privacy Policy lists every provider, where it processes data and the safeguard it relies on. No training. We do not use customer data, including transcripts, to train AI models, and our providers may not either. Help with your obligations. We help you answer requests from data subjects, and we give you the information you need for a data protection impact assessment or for a supervisory authority. If we become aware of a breach affecting customer data, we tell you without undue delay and at the latest within 48 hours, with what we know. Audits. Once a year, on 30 days' notice, you may ask us for evidence of our compliance, including reports from our providers. If that evidence is not enough, you may audit us at your cost during working hours, without disrupting the service. Deletion and return. Contact us to export or delete customer data. We check that the request comes from you, carry it out and document anything the law obliges us to keep. There is no call audio to delete, because none is stored. If a database backup is ever restored, we apply the deletions made since then again before access reopens. --- [HTML](https://onist.ro/en/dpa) · [https://onist.ro](https://onist.ro/en)