Data Processing Agreement

1. Definitions

• Controller: The customer using MadeAgentic services.
• Processor: Initphase Pte. Ltd..
• Data Subject: End users of the Controller's agents.
• Personal Data: Any data relating to identified or identifiable individuals.
• Data Protection Laws: All laws that apply to the processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR and the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection (FADP), where applicable.

2. Processing Details

3. Categories of Data

• Conversation logs and transcripts.
• Voice audio, processed in real time for speech recognition (if voice features are enabled). Raw audio is not stored in standard operation; the text transcript may be stored.
• Contact details voluntarily provided by end users (e.g. email, phone number, name).
• IP addresses and technical metadata.
• User interaction metadata.
• Business information provided by the Controller.

4. Processor Obligations

The Processor shall:

• Process personal data only on documented instructions from the Controller.
• Inform the Controller if an instruction appears to infringe applicable data protection laws.
• Ensure persons processing data are under appropriate confidentiality obligations.
• Implement appropriate technical and organizational security measures.
• Not engage sub-processors without appropriate safeguards and transparency.
• Assist the Controller with data subject requests where feasible.
• Delete or return all personal data upon termination of services, unless retention is required by law.
• Make available information necessary to demonstrate compliance with applicable data protection laws.

5. Security Measures

Technical and organizational measures include:

• Encryption of data at rest and in transit where appropriate.
• Access controls and authentication systems.
• Regular security testing and assessment.
• Incident detection and response procedures.
• Business continuity and disaster recovery planning.
• Physical security of data centers (Frankfurt, Germany).

6. Sub-processors

Depending on the enabled services, current sub-processors include:

• Infrastructure, database and edge services: Hetzner, Supabase and Cloudflare.
• Real-time media and connectivity: LiveKit.
• AI, speech and model-routing services: Deepgram, Anthropic, Inworld AI, Cartesia, OpenRouter and xAI.
• Transactional email delivery: Resend.

The Controller will be notified of material changes to sub-processor use with reasonable advance notice and a right to object where required by law or contract.

7. International Transfers

Primary data storage is in Frankfurt, Germany (EU). Processing by the Singapore-based Processor or by providers outside the European Economic Area is subject to the EU Standard Contractual Clauses or another valid transfer mechanism, together with appropriate contractual, organizational, and technical safeguards.

United Kingdom: For transfers of personal data subject to the UK GDPR, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) applies and forms part of this DPA. References in the Standard Contractual Clauses to the GDPR and to EU Member States are read as references to the UK GDPR and the United Kingdom.

Switzerland: For transfers subject to the Swiss FADP, the EU Standard Contractual Clauses apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner (FDPIC), and references to the GDPR are read as references to the FADP.

8. Data Breach Notification

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data and will provide reasonable assistance in meeting any legal obligations related to such breach.

9. Audits

Upon reasonable request and subject to confidentiality, the Processor will provide information or summaries of third-party audits to demonstrate compliance with this DPA and applicable data protection laws.

10. Liability

Liability provisions in the main Terms & Conditions apply. Each party is responsible for its own compliance with applicable data protection laws and indemnifies the other for damages arising from its own violations, to the extent permitted by law.

11. Related Documents

Review the Terms & Conditions, Privacy Policy, and Cookie Policy for the agreements and notices that apply alongside this DPA.