Data Processing Summary

1Scope#

• Data: your customers' data that you add or that arrives through your channels, such as names, phone numbers, messages, call audio and transcripts, customer records and tickets.
• Purpose: providing the service you configure, such as answering calls and messages, placing outbound calls, summarising conversations and managing customers.
• Duration: for as long as you use the service, then until return or destruction is complete.

2Our commitments#

• We process the data only on your documented instructions, including your settings in the platform, and do not use it for our own purposes.
• Everyone on our team who can access it is bound by confidentiality, and access is limited to those who need it.
• We apply the security measures described on the security and trust page.
• We help you respond to data subject requests and pass on any we receive directly.
• We notify you without undue delay when we become aware of a breach affecting your data, with enough detail for you to meet your obligations to the authority and to data subjects.
• We help with the information you need for your impact and risk assessments.
• When the service ends we let you export the data, and then destroy it unless the law requires us to keep it.

3Sub-processors#

We use sub-processors under written obligations that protect data at least as well as these terms, in these categories: hosting and databases, AI and speech processing, telephony and messaging delivery, email delivery, and bot protection. We remain responsible to you for their performance.

The schedule of sub-processors and their processing locations is available to enterprise customers under the data processing agreement, on request to karan@hetaf.ai, with advance notice of any change.

4Transfers outside the Kingdom#

Our primary systems are hosted on Microsoft Azure in the United Arab Emirates (UAE North region), and some service providers may process data in other countries. We transfer data only as far as the service needs, on a basis the Regulation on Personal Data Transfer outside the Kingdom permits, with contractual safeguards with the recipients.

5Your obligations#

• Have a lawful basis for processing your customers' data and for sharing it with us.
• Inform your customers about the processing, including the use of AI agents and recording where you turn it on.
• Get the consents required and follow the acceptable use policy.
• Add sensitive data only when needed and with a lawful basis.

6Requesting the full agreement#

To request the full data processing agreement, the sub-processor schedule or further security information, email karan@hetaf.ai with your business and account name.