Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the agreement between onCall Solutions LLC, a limited liability company registered in Pennsylvania, United States (the Processor), and the business or organization using Tanovo Assist (the Customer or Controller).

Tanovo Assist is an AI-powered business communication platform offered under the DevOnCall brand. This Agreement governs the processing of personal data on behalf of Customers using the Service.

This Agreement applies whenever onCall Solutions LLC processes personal data on behalf of a Customer and applicable data protection law requires a data processing agreement.

By accepting the Tanovo Assist Terms of Use and this Agreement, the Customer agrees to the terms described below.

The Customer generally acts as the Data Controller, determining the purposes and lawful basis for processing customer personal information.

onCall Solutions LLC generally acts as the Data Processor when processing customer information on behalf of the Customer.

The Processor shall process personal data only on documented lawful instructions from the Customer, including instructions contained in the Terms of Use, this Agreement, and authorized Platform configurations.

The Customer is responsible for providing appropriate privacy notices, obtaining required consent, and ensuring its processing activities comply with applicable law.

Where onCall Solutions LLC independently determines the purposes and means of processing personal information, it acts as a separate Data Controller for those activities.

The Service may process personal data relating to customers, prospective customers, and authorized business representatives.

Personal data may include names, WhatsApp phone numbers, message content, conversation histories, timestamps, product enquiries, order-related information, and other information shared during customer interactions.

Processing activities include receiving and sending WhatsApp messages, generating AI responses, storing conversation histories, managing customer enquiries, enabling human handover, and maintaining service security.

Processing continues for the duration of the Customer's use of the Service, subject to applicable retention and deletion obligations.

The Customer must not intentionally submit sensitive personal information unless the processing is lawful and appropriate safeguards have been established.

onCall Solutions LLC shall process personal data only for authorized purposes and in accordance with documented lawful instructions.

The Processor shall ensure that personnel authorized to access personal data are subject to appropriate confidentiality obligations.

The Processor shall implement appropriate technical and organizational security measures and restrict access to authorized personnel and systems.

The Processor shall provide reasonable assistance with applicable data protection obligations, including data subject requests, security incidents, and compliance assessments.

The Processor shall not sell Customer personal data or use customer conversation content to train its own general-purpose AI models without separate authorization and an appropriate lawful basis.

The Customer shall collect and process personal information lawfully and provide appropriate privacy notices to individuals.

The Customer is responsible for obtaining required permissions or consent for WhatsApp communications and complying with applicable WhatsApp Business policies.

The Customer shall maintain appropriate account security, accurate business information, and lawful AI assistant instructions.

The Customer shall respond to customer privacy requests in its capacity as Data Controller and avoid submitting unnecessary sensitive personal information.

The Customer provides general authorization for onCall Solutions LLC to engage subprocessors necessary to deliver the Service, subject to appropriate safeguards.

Subprocessors may provide WhatsApp messaging infrastructure, AI processing, cloud hosting, database storage, authentication, monitoring, and security services.

The Processor shall maintain a current subprocessor list, including relevant processing functions and locations, and make it available to Customers.

The Processor shall provide reasonable advance notice of material subprocessor changes and an opportunity for the Customer to raise reasonable data protection objections.

The Processor shall impose appropriate written data protection obligations on subprocessors and remain responsible for their performance of those obligations.

onCall Solutions LLC is registered in the United States and may use service providers located in other jurisdictions.

Personal data may be processed internationally where necessary to provide Tanovo Assist.

The Processor shall implement appropriate safeguards and legal transfer mechanisms where required by applicable data protection law.

Transfers involving personal data subject to Kenyan law shall comply with applicable requirements under the Kenya Data Protection Act, 2019, and related regulations.

Acceptance of this Agreement does not, by itself, establish a lawful basis for every international data transfer.

The Processor shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data.

The notification shall include reasonably available information concerning the nature of the incident, affected data, potential impact, and corrective measures.

The Processor shall cooperate with the Customer in investigating and responding to the incident.

Each party remains responsible for any direct notification obligations imposed on it by applicable law.

The Processor shall provide reasonable assistance to the Customer in responding to lawful requests to access, correct, delete, restrict, or otherwise exercise rights concerning personal information.

Where a request concerns information controlled by the Customer, the Processor shall refer the request to the Customer or act according to documented instructions unless legally required to respond directly.

The Processor shall not independently disclose Customer personal data except as authorized or required by law.

The Processor shall maintain technical and organizational safeguards appropriate to the risks associated with processing personal information.

These measures shall include, as applicable, encrypted communications, authentication, access restrictions, secure credential management, application monitoring, vulnerability remediation, and incident response procedures.

The Processor shall periodically review security controls and make reasonable improvements where necessary.

Customer WhatsApp conversation histories shall be retained for a maximum of twelve (12) months from the most recent customer interaction, unless a shorter retention period applies or continued retention is legally justified.

Merely opening or viewing a conversation does not reset the retention period.

Expired conversation histories shall be deleted or irreversibly anonymized from active production systems, subject to lawful retention exceptions.

Following a verified account deletion request, onCall Solutions LLC shall process the request and delete associated personal data from active production systems within thirty (30) calendar days, subject to applicable legal and contractual obligations.

Backup data may remain temporarily after deletion from active systems and shall be removed through the applicable backup expiration cycle, targeted within thirty (30) days after active-system deletion unless a longer period is legally required.

Where backups containing previously deleted information are restored, the Processor shall take reasonable steps to reapply the relevant deletion instructions.

Business account information, product catalogues, and AI configurations may be retained during an active subscription. Customer contact records may be retained separately where the Customer has an appropriate lawful basis and documented retention purpose.

Limited information may be retained where necessary for tax, accounting, regulatory compliance, security investigations, legal claims, or valid preservation requirements.

Deletion from Tanovo Assist does not automatically delete information independently retained by Meta, WhatsApp, the Customer, or other independent controllers.

The Processor shall communicate applicable deletion instructions to authorized subprocessors in accordance with contractual obligations and applicable law.

The Processor shall make available information reasonably necessary to demonstrate compliance with this Agreement.

Where required by applicable law, the Processor shall permit and reasonably contribute to appropriate audits or inspections conducted by the Customer or an authorized independent auditor.

Audits shall be subject to reasonable confidentiality, security, and scheduling requirements and must not unnecessarily compromise other customers' information.

Each party shall be responsible for its own breaches of this Agreement and applicable data protection law.

Liability between the parties shall be governed by the applicable Terms of Use unless mandatory law requires otherwise or the parties expressly agree to different provisions.

Nothing in this Agreement excludes liability that cannot lawfully be excluded.

This Agreement takes effect when the Customer accepts it and remains in force for as long as the Processor processes personal data on the Customer's behalf.

Termination of the Service does not relieve either party of obligations that must survive termination, including confidentiality, lawful retention, deletion, and cooperation obligations.

This Agreement shall be governed by the laws of the Commonwealth of Pennsylvania, United States, subject to applicable mandatory data protection laws.

The parties shall comply with additional mandatory legal requirements applicable to the processing of personal data in jurisdictions where they operate.

Data Processor: onCall Solutions LLC, operating Tanovo Assist under the DevOnCall brand.

Registered Jurisdiction: Pennsylvania, United States.

Website: https://devoncall.net

Privacy Contact: info@devoncall.net

Business Address: onCall Solutions LLC 8 The Green Suite Suite B Dover,DE 19901

Data Controller: The business or organization accepting this Agreement through Tanovo Assist, as identified in its account registration and applicable service agreement.