Data Processing Addendum
This Data Processing Addendum (“DPA”) amends and supplements the Agreement between Sadie Technology Limited (“Sadie”) and [Customer] (“Customer”) and governs Sadie’s Processing of Personal Information on behalf of Customer under the Agreement. Capitalized terms used but not defined in this DPA have the meanings given in the Agreement.
1. Definitions
1.1 “Applicable Privacy Laws” means all privacy and data-protection laws applicable to the Processing of Personal Data under this DPA, including, as applicable (a) U.S. state privacy laws, including the California Consumer Privacy Act as amended by the CPRA, the Colorado Privacy Act, the Virginia Consumer Data Protection Act, the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act; (b) Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws (including Alberta PIPA, BC PIPA, and Quebec’s Law 25); (c) General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”); (d) the GDPR as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”); (e) Illinois Biometric Information Privacy Act, 740 ILCS 14 (“BIPA”), EU AI Act and HIPAA (each as defined herein); and (f) any substantially similar or successor laws. For Personal Data originating from the EEA or otherwise subject to the GDPR, the GDPR shall govern and prevail over any non-EU privacy laws in case of conflict.
1.2 “Controller” means the entity that determines the purposes and means of the Processing of Personal Data. For purposes of this DPA, Customer acts as the Controller with respect to all Personal Data Processed through the Services (or as a Processor solely to the extent Customer acts on documented instructions from an Upstream Customer). Sadie acts exclusively as Customer’s Processor or Sub-processor and shall Process Personal Data only on Customer’s documented lawful instructions.
1.3 “Customer Data” means data, content, or information submitted by or on behalf of Customer into the Services. Customer Data does not include aggregated data or any data generated by Sadie through the operation of the Services.
1.4 “Data Subject” means an identified or identifiable natural person to whom Personal Information relates.
1.5 “EEA” means European Economic Area.
1.6 “Personal Data” means Personal Information within the Service Data that Sadie Processes on behalf of Customer under the Agreement, whether such data is submitted by Customer or generated, derived, or otherwise produced through operation of the Services. For clarity, any information that qualifies as “personal data” under the GDPR or Applicable Privacy Laws shall be treated as Personal Data under this DPA, regardless of format, source, or method of generation, and includes any information that relates to a Data Subject, whether directly or indirectly, including but not limited to identifiers, contact information, device information, usage data, behavioural data, audio, transcripts, metadata, and any other information that can reasonably be linked to a natural person.
1.7 “Personal Information” means any information relating to an identified or identifiable individual, including information defined or described as “personal information,” “personal data,” “personally identifiable information,” or similar terms under Applicable Privacy Laws.
1.8 “Processor” means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
1.9 “Restricted Transfer” means: (i) where GDPR applies, a transfer of Personal Data from the EEA to a country outside the EEA that is not subject to an adequacy determination, or (ii) where UK GDPR applies, a transfer of Personal Data from the United Kingdom to any other country that is not subject to an adequacy determination.
1.10 “Security Incident” means any actual or reasonably suspected breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data Processed by Sadie, excluding unsuccessful attempts or activities that do not compromise the confidentiality, integrity, or availability of Personal Data (such as unsuccessful login attempts, pings, port scans, or denial-of-service attacks).
1.11 “Sensitive Data” means categories of Personal Information that are subject to enhanced or special protection under Applicable Privacy Laws, including health data, biometric identifiers, financial account numbers, precise geolocation, information about children, and any other data categorized as “sensitive” by Applicable Privacy Laws.
1.12 “Services” means Sadie’s AI-powered voice assistant platform, as further described in the Agreement.
1.13 “Service Data” means (i) Customer Data, and (ii) any data generated through the operation of the Services, including transcripts, outputs, metadata, and analytics, to the extent such data contains or constitutes Personal Data.
1.14 “Sub-processor” means any third party engaged by Sadie to Process Personal Data on behalf of Customer.
1.15 “Upstream Customer” means Customer’s customers to whom Customer provides the Services.
2. Roles and Scope
2.1 Roles. The parties shall clearly define their respective roles for each Processing activity. Customer will act as the Controller where it determines the purposes and means of the Processing of Personal Data. Customer will act as a Processor (or Sub-processor) only where it Processes Personal Data on documented instructions of an Upstream Customer. Sadie will act solely as Customer’s Processor when Processing Personal Data on Customer’s behalf. The specific role of each party for each category of Processing shall be detailed in Annex A, which the parties shall update as necessary to reflect the actual Processing operations.
Sadie’s obligations under this DPA apply solely to Personal Data Processed within Sadie’s own systems, infrastructure, and sub-processors. Where Customer or any Upstream Customer builds, hosts, or operates integrations on top of Sadie’s Service (including integrations with external CRM, PMS, or other third-party systems), the data handling practices of those downstream integrations are Customer’s responsibility and fall outside the scope of this DPA. Customer shall ensure that any such downstream integration complies with Applicable Privacy Laws and does not cause Sadie to be in breach of its obligations under this DPA. There is no commingling of Personal Data across different Customers or integration partners within Sadie’s systems.
2.2 Instructions. Customer is responsible for ensuring that its instructions to Sadie regarding the Processing of Personal Data comply with Applicable Privacy Laws. The parties agree that the Agreement (including this DPA), together with Customer’s use of the Services in accordance with the Agreement, constitute Customer’s complete and final instructions to Sadie for the Processing of Personal Data. Customer may issue additional written instructions during the applicable Term; provided that such instructions are: (a) consistent with the Agreement; (b) technically feasible; (c) lawful; and (d) provided with at least thirty (30) days’ prior written notice to Sadie where such instructions require material changes to Sadie’s processing activities or technical infrastructure. Where Customer acts as a Processor (including a sub-processor), Customer’s instructions to Sadie may reflect instructions it has received from an Upstream Customer, and Sadie shall comply with such instructions as communicated by Customer. Sadie will promptly notify Customer if Sadie determines that Customer’s instructions are unlawful under Applicable Privacy Laws.
2.3 Compliance with Instructions and Purpose Limitation. Sadie will Process Personal Data only for the purposes described in the Agreement and this DPA, or as otherwise documented within Customer’s lawful instructions, except where Processing is required by applicable Laws (including Applicable Privacy Laws). Sadie will notify Customer if Sadie is required by applicable law to Process Personal Data in a manner that conflicts with Customer’s instructions.
2.4 Description of Processing. The subject matter, nature, and purpose of the Processing, the types of Personal Data, the categories of Data Subjects, and the duration of the Processing are set out in Annex A. Any updates to Annex A shall require prior written agreement by both parties and shall not modify or expand the scope of Processing unless expressly authorized by Customer through documented instructions in accordance with Article 28 GDPR.
2.5 Sensitive Data. Customer determines, through its configuration and use of the Services, the types of Service Data that Customer transmits or Processes within the Services. Customer is responsible for ensuring that appropriate safeguards, notices, consents, and security controls are in place prior to transmitting or Processing any Sensitive Data (as defined under Applicable Privacy Laws) via the Services. Unless expressly agreed in writing, the Services are not designed to Process Sensitive Data subject to heightened protections under Applicable Privacy Laws (including, where applicable, health information, financial account numbers, biometric identifiers, precise geolocation, children’s data, or other categories designated as sensitive). To the extent Customer chooses to submit Sensitive Data, or Sensitive Data is otherwise included in the Service Data (including transcripts or outputs generated through operation of the Services), such Processing will be subject to the scope limitations, restrictions, and safeguards described in this DPA and any additional mutually agreed terms between the parties. Where Personal Data includes health information or other special categories under Article 9 GDPR, Customer is solely responsible for ensuring an appropriate lawful basis under Article 9(2) GDPR exists for such Processing, and for obtaining any required consents or authorizations from Data Subjects prior to transmitting such data to the Services
2.6 Outbound Calling Instructions. Where the Outbound Calling Feature is enabled, Customer’s submission of a telephone number or calling list to the Services constitutes Customer’s documented instruction under Article 28(3)(a) GDPR to place outbound calls to that number. Customer represents and warrants that it has established and documented a lawful basis under Article 6 GDPR, and has obtained any consent required under Applicable Privacy Laws governing unsolicited communications and automated calling systems, for each such call prior to submission. Customer is responsible for the accuracy and currency of all calling lists it submits, including for ensuring that telephone numbers remain correctly associated with the intended individual, and Sadie processes such numbers as submitted without independent verification. Sadie may decline to place, or may suspend the placing of, outbound calls where Sadie reasonably determines that the instruction is unlawful under Applicable Privacy Laws, and such refusal or suspension will not constitute a breach by Sadie of this DPA or the Agreement.
2.7 Restrictions on Processing. Sadie will not:
2.7.1 sell or share Personal Data, or otherwise Process Personal Data for Sadie’s own purposes or for any purpose other than providing the Services;
2.7.2 retain, use, or disclose Personal Data for any purpose other than to perform the Services or as permitted under the Agreement, this DPA, or Applicable Privacy Laws;
2.7.3 retain, use, or disclose Personal Data outside the direct business relationship between Customer and Sadie;
2.7.4 combine Personal Data with any other data nor use Personal Data for model training or service improvement, except (i) strictly for security, debugging, or operational integrity; or (ii) upon documented written request from Customer for the specific purpose of debugging or troubleshooting a reported call issue, subject to role-based access controls and access logging. Any such access shall be limited to the minimum data necessary to resolve the reported issue and shall not be used for any secondary purpose.
2.7.5 Process, transfer, modify, amend, or alter Personal Data except in accordance with Customer’s lawful instructions or as required by Applicable Privacy Laws;
2.7.6 disclose Personal Data to any third party except to authorized Sub-processors or as otherwise permitted under this DPA or required by Applicable Privacy Laws; or
2.7.7 engage in any Processing that would cause Sadie to qualify as a “business” or “controller” with respect to Personal Data under Applicable Privacy Laws.
Sadie certifies that it understands and will comply with the restrictions set out in this Section.
3. Sadie Personnel
3.1 Limited Access. Sadie shall implement strict role-based access controls ensuring that access to Personal Data is granted solely on a least-privilege basis, subject to periodic access reviews, and monitored through auditable access logging mechanisms.
3.2 Confidentiality Obligations. Sadie will ensure that all personnel who have access to Personal Data are bound by written confidentiality obligations that are no less protective than those in the Agreement. Such obligations will survive termination of the personnel’s engagement with Sadie.
4. Security
4.1 Security Program. Sadie will maintain an information security program with administrative, technical, and physical safeguards appropriate to the nature of the Services and the types of Personal Data Processed. Sadie’s security program is designed to protect Personal Data against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss, alteration, disclosure, or access. Sadie may update its security program from time to time, provided such updates do not materially reduce the overall level of protection for Personal Data.
4.2 Security Measures. Without limiting Section 4.1, Sadie will implement and maintain measures as may be described further in Annex B (Security Measures) that include, as appropriate:
4.2.1 access controls and authentication measures;
4.2.2 encryption of Personal Data in transit and at rest where technically feasible;
4.2.3 network and perimeter security measures;
4.2.4 protections against malicious code;
4.2.5 regular testing and evaluation of security procedures; and
4.2.6 personnel training consistent with Section 3.
4.3 Security Incidents. Sadie will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a confirmed Security Incident involving Personal Data Processed by Sadie under the Agreement. Such notice will include information reasonably sufficient to allow Customer to meet its obligations under Applicable Privacy Laws, to the extent known to Sadie at the time of notification. Such notice will, to the extent known, describe (i) the nature of the Security Incident (including the categories and approximate number of Data Subjects and records concerned), (ii) likely consequences, and (iii) measures taken or proposed to address and mitigate the Security Incident.
4.4 Following a Security Incident, Sadie will:
4.4.1 promptly investigate the Security Incident;
4.4.2 take reasonable steps to contain, mitigate, and remediate its effects; and
4.4.3 provide Customer with updates as necessary to keep Customer informed of material developments.
4.4.4 Provide incident reporting and root cause analysis
4.5 Sadie’s obligations under this Section apply to any Security Incident involving Personal Data that occurs within systems, infrastructure, environments, or services that are owned, operated, controlled, or managed by Sadie, including those provided by Sadie’s Sub-processors or cloud service providers acting on Sadie’s behalf. These obligations also apply where Sadie reasonably suspects or becomes aware of a potential or actual Security Incident affecting Personal Data for which Sadie is responsible under this Agreement.
4.6 Cooperation. Customer is responsible for determining whether to notify regulators, Data Subjects, or other third parties regarding a Security Incident, and for making any such notifications, unless otherwise required by Applicable Privacy Laws. Sadie will provide reasonable cooperation and assistance to Customer in relation to any Security Incident (including assistance reasonably requested to enable Customer to support its Upstream Customers’ compliance obligations) to the extent required for Customer to comply with its obligations under Applicable Privacy Laws, taking into account the nature of the Processing and the information available to Sadie.
4.7 Customer Responsibilities. Customer is responsible for securing its own systems, networks, and access credentials used to connect to the Services. This responsibility does not limit or reduce Sadie’s independent obligations under the GDPR, including its duty to implement appropriate technical and organizational measures and to ensure the security of Personal Data it Processes under Article 32 GDPR. Sadie remains fully responsible for the security of all systems, infrastructure, environments, and subprocessors that it owns, operates, or controls, and for any Personal Data Processing activities performed on its behalf. Nothing in this clause shall be interpreted as shifting Sadie’s statutory responsibilities as a Processor.
5. Sub-processors
5.1 Authorization. Customer authorizes Sadie to engage Sub-processors only following the notification and objection procedure in Section 5.3. Affiliates are not deemed pre-approved and shall be treated as Sub-processors subject to all requirements of this Section.
5.2 Sadie will ensure that each Sub-processor is bound by a written contract that:
5.2.1 requires the Sub-processor to Process Personal Data only on Sadie’s behalf and only for the purposes permitted under this DPA and the Agreement;
5.2.2 imposes data-protection obligations that are no less protective of Personal Data than those in this DPA; and
5.2.3 requires the Sub-processor to implement appropriate technical and organizational security measures consistent with this DPA.
5.3 Sub-processor List and Notifications. Sadie will maintain a list of current Sub-processors, which may be made available to Customer upon request. Sadie will provide Customer with at least thirty (30) days’ prior written notice of any new Sub-processor (unless a shorter period is required due to urgent security, legal, or service continuity needs, in which case Sadie will provide notice as soon as reasonably practicable). Customer may object to a new Sub-processor on reasonable data-protection grounds.
5.4 Objections. If Customer objects to a new Sub-processor on reasonable grounds relating to data protection, the parties will discuss in good faith to find a mutually acceptable resolution. If no resolution is reached, Customer may terminate the affected portion of the Services with written notice, and Sadie will refund any prepaid fees for the terminated portion.
5.5 Where Customer acts as a Processor (including a Sub-processor), Sadie shall act as Customer’s Sub-processor under Article 28(4) GDPR. Sadie shall be bound only by those upstream data-protection obligations that (i) relate to the Processing activities Sadie performs, (ii) are consistent with GDPR, and (iii) have been disclosed to Sadie in writing prior to becoming applicable.
6. Data Subject Rights Assistance
6.1 Customer Responsibilities. Customer is responsible for responding to requests from individuals (Data Subjects) to exercise their rights under Applicable Privacy Laws, including rights of access, deletion, correction, and opt-out. Sadie will not respond directly to any Data Subject request relating to Personal Data unless expressly instructed to do so by Customer or required by Applicable Privacy Laws.
6.2 Notice of Requests Received by Sadie. If Sadie receives a Data Subject request relating to Personal Data, Sadie will promptly, and in any event within five (5) business days, notify Customer, unless legally prohibited from doing so. Sadie may respond to the Data Subject only to confirm receipt and indicate that the request has been forwarded to Customer. Where the Outbound Calling Feature is enabled, the parties acknowledge that a called party may communicate an objection to further calls, or a withdrawal of consent, directly to the Services during a call. Sadie will record any such request and make it available to Customer through the Services, and may apply it as a suppression entry to prevent further outbound calls. Customer remains responsible for determining the legal effect of, and for otherwise actioning, each such request, including its application to other channels and systems.
6.3 Sadie Assistance. To the extent Customer is unable to fulfill a Data Subject request through the self-service features of the Services, Sadie will, upon Customer’s request and to the extent reasonably possible, assist Customer in responding to such request. Sadie will provide such assistance taking into account the nature of the Processing and the information available to Sadie. Such assistance includes, where applicable, supporting Customer in fulfilling requests for access, deletion/erasure, correction, restriction, portability, and objection, and enabling Customer to support its Upstream Customers’ compliance obligations. If such assistance requires effort beyond standard functionality or support, Customer will reimburse Sadie’s reasonable costs.
6.4 Limitations. Sadie has no obligation to fulfill or respond to any Data Subject request where:
6.4.1 Customer has not provided necessary details;
6.4.2 the request pertains to data that Sadie does not Process on behalf of Customer;
6.4.3 fulfilling the request would violate Applicable Privacy Laws; or
6.4.4 the data is not Personal Data within the meaning of this DPA.
7. Return or Deletion of Personal Data
7.1 During the Term. At any time during the Term, Customer may instruct Sadie to return or delete Personal Data (including Personal Data contained in Service Data). Sadie will comply with Customer’s instruction within a reasonable period, subject to Sadie’s need to maintain data necessary to operate the Services or comply with law (e.g., audit logs, billing records). Where the Outbound Calling Feature is enabled, Sadie may retain, notwithstanding any deletion instruction, the minimum data necessary to give effect to an opt-out, do-not-call, or suppression request (which may comprise a telephone number, or a hashed or otherwise minimized representation of it, together with the date of suppression), for so long as necessary to prevent further outbound calls to that individual. Such retained data will be Processed solely for suppression purposes and for no other purpose, and Customer acknowledges that instructing deletion of suppression data may result in further calls being placed to the affected individual.
7.2 End of Term. Upon termination or expiration of the Agreement, or upon Customer’s written request, Sadie will, at Customer’s option:
7.2.1 return Personal Data in a commonly used, machine-readable format;
7.2.2 delete Personal Data; or
7.2.3 both return and delete it,
unless Sadie is required by Applicable Privacy Laws to retain some or all Personal Data.
7.3 Backup and Archival Copies. Notwithstanding a deletion instruction, Sadie may retain Personal Data solely within immutable disaster-recovery or business-continuity backups, provided that (i) such copies are not accessible for routine Processing, (ii) remain subject to all obligations under this DPA, (iii) are automatically and irrevocably overwritten in the normal backup-rotation cycle, and (iv) are retained only for the minimum period strictly necessary to comply with applicable data-retention laws or to ensure disaster-recovery capability.
7.4 Retention Required by Law. If Sadie is legally required to retain Personal Data beyond termination of the Agreement, Sadie will continue to ensure the confidentiality, security, and limited Processing of such retained data, and will Process it only as necessary to comply with the legal requirement.
8. Regulatory Cooperation
8.1 Assistance with Data Protection Impact Assessments. Sadie shall provide Customer with reasonable and proportionate assistance, as required under Article 28(3)(f) GDPR, in relation to (i) Data Protection Impact Assessments, (ii) risk assessments, and (iii) consultations with supervisory authorities. Such assistance shall include providing relevant documentation, technical details, and access to knowledgeable personnel. These obligations apply regardless of Sadie’s internal confidentiality or security policies, except where disclosure would violate applicable law. Any proprietary information disclosed shall remain subject to contractual confidentiality protections.
9. Cross-Border Transfers
9.1 Personal Data may be transferred and processed globally as necessary to provide the Services. Each party will ensure that any such cross-border transfers comply with Applicable Privacy Laws, including any requirements relating to notice, consent, or contractual safeguards. Sadie will process and store Personal Data only in the approved hosting regions documented in the Appendix A. Sadie will not materially change hosting regions for Personal Data without prior written notice to Customer and, where required by Applicable Privacy Law or customer commitments, Customer’s prior written approval. Any transfer of Personal Data to, or remote access from, a third country outside the EEA may occur only where (i) required for the provision of the Services, (ii) appropriate safeguards under Chapter V GDPR are in place (including, where applicable, SCCs and a documented Transfer Impact Assessment), and (iii) Customer has received prior written notice and, where required by law or customer commitments, provided prior written approval.
9.2 To the extent a Restricted Transfer of Personal Data is required to or from jurisdictions outside the United States or Canada, the parties will implement appropriate transfer mechanisms as set out in Appendix C (Cross-Border Transfer Mechanisms).
10. Changes in Law
10.1 Required Modifications. If either party believes that changes to this DPA are necessary to comply with Applicable Privacy Laws, that party may notify the other in writing. If changes to this DPA are required to comply with Applicable Privacy Laws, either party shall promptly notify the other. The parties shall implement such changes without undue delay. In the event the parties cannot reach agreement within a reasonable and legally compliant timeframe, Customer’s instructions as Controller shall prevail to the extent required under the GDPR.
10.2 Cooperation. Sadie shall provide reasonable assistance to Customer as required under the GDPR, including assistance necessary to fulfil Customer’s obligations under Articles 28, 32, 33, 34, 35, and 36 GDPR. Any additional measures required from Sadie shall be proportionate to the nature of the Processing and shall be subject to mutually agreed cost-allocation where appropriate.
11. Audit Rights
11.1 Demonstrating Compliance. Upon Customer’s reasonable request, Sadie will make available information necessary to demonstrate Sadie’s compliance with this DPA, which may include:
11.1.1 responses to reasonable security or privacy questionnaires;
11.1.2 summaries of Sadie’s internal or external audits; and
11.1.3 copies of independent third-party audit reports or certifications, if applicable (e.g., SOC 2, ISO 27001).
11.2 Audit Process. Customer shall have the right to audit Sadie’s compliance with this DPA and the GDPR once per calendar year and upon reasonable prior notice. Audits may be conducted by Customer or by an independent auditor mandated by Customer. Sadie shall provide reasonable cooperation to facilitate such audits, which shall be conducted primarily through documentary review of responses to questionnaires, internal audit summaries, and available third-party certifications (e.g., SOC 2 Type II, ISO 27001). Physical on-site access to Sadie’s systems, personnel, and facilities shall be limited to circumstances where: (a) a supervisory authority has expressly required such on-site access in connection with a formal investigation or enforcement action; or (b) a confirmed Security Incident requires an investigation and documentary review alone is demonstrably insufficient. Additional audits beyond the annual audit may be conducted only where: (i) a prior audit identified a material unresolved compliance issue; (ii) a confirmed Security Incident has occurred; or (iii) a supervisory authority has expressly required such audit. The costs of any such additional audit shall be borne by Customer.
11.3 Limitation. No audit may access Personal Data belonging to other customers, Sadie’s unrelated proprietary information, or internal HR data. Such limitations shall not restrict Customer’s ability to verify Sadie’s compliance with this DPA and the GDPR. Sadie shall provide alternative means (e.g., redacted documentation, controlled demonstrations, or auditor-verified summaries) sufficient to enable Customer to assess Sadie’s technical and organizational measures, security controls, and processing activities.
12. Biometric Information Privacy (BIPA)
12.1 Customer Consent Obligations. If Sadie notifies Customer that the Services create or may create biometric identifiers or biometric information, or if Customer otherwise has reason to believe that individuals interacting with the Services may be subject to biometric data collection, Customer:
12.1.1 If interacting directly with individuals through the Services, shall: (i) provide each individual with written notice and obtain their written consent prior to the collection of any biometric identifier or biometric information, in accordance with BIPA or applicable biometric privacy law; (ii) maintain a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information; and (iii) refrain from selling, leasing, trading, or otherwise profiting from any biometric identifier or biometric information.
12.1.2 Where Services are provided to or through Upstream Customers, shall additionally: (i) impose on each Upstream Customer, through binding written agreement, obligations equivalent to those in sub-section 12.2.1 above prior to permitting that Upstream Customer to use the Services in connection with individuals who may be subject to biometric data collection; (ii) not permit any Upstream Customer to use the Services in circumstances where biometric data may be collected unless that Upstream Customer has agreed to such obligations; and (iii) promptly notify Sadie upon becoming aware that any Upstream Customer has failed to comply with such obligations, and cooperate with Sadie in determining appropriate remediation measures.
12.2 Customer is solely responsible for ensuring compliance with BIPA and any analogous state biometric privacy laws with respect to: (a) any individuals whose audio data is processed directly through the Services by Customer; and (b) any individuals whose audio data is processed through the Services by or on behalf of Customer’s Upstream Customers, provided that Customer has imposed the obligations in this Section on each such Upstream Customer through binding written agreement.
13. AI Act Compliance
13.1 Scope. The parties acknowledge that the Services may constitute or incorporate an AI system within the scope of Regulation (EU) 2024/1689 (the “EU AI Act”), the Colorado Artificial Intelligence Act (C.R.S. § 6-1-1701 et seq) (the “CAIA”) or any analogous federal or state AI law, to the extent it applies to the Services and their deployment, and this Section sets out the parties’ respective obligations with respect to such regulations.
13.2 Transparency Obligations. Sadie shall ensure that the Services support compliance with the transparency requirements of Article 50 of the EU AI Act, including by: (i) ensuring the Services do not actively conceal their AI nature from individuals interacting with them; (ii) providing Customer with technical mechanisms and configuration options enabling Customer to deliver a disclosure to end users that they are interacting with an AI system; and (iii) not permitting Customer to entirely disable the AI disclosure capability within the Services. Customer is responsible for configuring and deploying the Services in a manner that ensures end users receive clear and conspicuous notice that they are interacting with an AI system prior to or at the point of such interaction, in accordance with Article 50 of the EU AI Act. Where the Outbound Calling Feature is enabled, Customer acknowledges that the required notice must be delivered by the Services at the commencement of the call, before any substantive interaction with the called party, and Customer is responsible for configuring the Services so that the disclosure is delivered in that manner and in a language the called party can reasonably be expected to understand. Where Customer provides the Services to or through Upstream Customers, Customer shall require each Upstream Customer to implement the required notice through binding written agreement and shall not permit any Upstream Customer to deploy the Services to end users without the required disclosure in place.
13.3 Deployer Obligations. To the extent Customer acts as a “deployer” of an AI system within the meaning of the EU AI Act in connection with its use of the Services, Customer is responsible for: (a) ensuring that the AI system is used in accordance with its intended purpose and Sadie’s instructions; (b) where Customer interacts directly with individuals through the Services, providing any required transparency disclosures or notices to affected individuals under Article 50 of the EU AI Act or applicable guidance prior to those individuals interacting with the AI system; (c) where Customer provides the Services to or through Upstream Customers who in turn interact directly with individuals, imposing on each such Upstream Customer, through binding written agreement, obligations equivalent to those in sub-section (b), and not permitting any Upstream Customer to deploy the Services to end users without first having implemented the required AI transparency measures; and (d) conducting any fundamental rights impact assessment required under Article 27 of the EU AI Act in connection with Customer’s or its Upstream Customers’ deployment of the Service.
13.4 Cooperation. The parties shall cooperate in good faith to comply with any applicable obligations under the EU AI Act and any implementing regulations or guidance, including obligations relating to registration, conformity assessment, post-market monitoring, and incident reporting. Each party shall promptly notify the other upon becoming aware of any actual or potential non-compliance with the EU AI Act in connection with the Services, including any non-compliance arising from the conduct of Customer’s Upstream Customers. Customer shall use commercially reasonable efforts to ensure that any non-compliance by an Upstream Customer is promptly remediated.
14. HIPAA and Protected Health Information
14.1 Applicability. This Section applies only where Customer is a Covered Entity or Business Associate as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations (45 C.F.R. Parts 160 and 164), and where Customer transmits or makes available Protected Health Information (“PHI”) to Sadie in connection with the Services. Where this Section applies, it supplements and does not replace any Business Associate Agreement (“BAA”) executed between the parties; in the event of conflict between this Section and a BAA, the BAA shall govern with respect to PHI.
14.2 BAA Requirement. Where Customer transmits or makes available PHI to Sadie in connection with the Services, the parties shall execute a BAA prior to any such transmission. Sadie’s obligations as a Business Associate or Subcontractor shall be governed by the BAA.
14.3 Customer Consent and Notice Obligations. Customer represents, warrants, and covenants that, with respect to any PHI made available to Sadie for processing through the Services, the following obligations are satisfied prior to and at the time of each disclosure:
14.3.1 Where Customer itself is a Covered Entity or Business Associate that directly controls the disclosure of PHI to Sadie, Customer has: (i) obtained all required patient authorizations, consents, and notices under HIPAA and Applicable Privacy Laws, and established and documented the applicable HIPAA-compliant legal basis, for such disclosure, including either a valid written authorization under 45 C.F.R. § 164.508 or a permissible basis under 45 C.F.R. §§ 164.506 or 164.512, and under any applicable state medical privacy law, including California Civil Code § 56.10 where applicable; (ii) provided each applicable patient all required notices of privacy practices under 45 C.F.R. § 164.520 and any additional notice required under applicable law, including where the Services involve recording or AI-assisted processing of patient voice communications, clear and conspicuous notice prior to or at the point of call connection that the call will be recorded and processed using artificial intelligence; (iii) maintained written records sufficient to demonstrate compliance with (i) and (ii) and will make such records available to Sadie upon written request; and (iv) where the Services involve audio transcription or recording in connection with patient encounters, obtained all consents required under applicable electronic communications privacy laws, including the California Invasion of Privacy Act (Cal. Penal Code §§ 630 et seq.) (“CIPA”) where applicable.
14.3.2 Where Customer causes or permits Upstream Customers to share, transmit, submit, or otherwise make available PHI to Sadie for processing through the Services, Customer represents that it has: (i) imposed on each such Upstream Customer, through binding written agreement, obligations equivalent to those in sub-section 14.3.1; (ii) not transmitted or made available to Sadie any PHI originating from an Upstream Customer that has not agreed to such obligations; (iii) required each Upstream Customer that is a Covered Entity or Business Associate to execute a business associate agreement with Customer prior to any disclosure of PHI through the Services; and (iv) promptly notified Sadie upon becoming aware that any Upstream Customer has failed to comply with any obligation in this Section with respect to PHI that has been or may be transmitted to Sadie, and cooperated with Sadie in determining appropriate data handling measures in response to any such failure
14.4 No Secondary Use. Sadie shall not use PHI for any purpose other than providing the Services, including without limitation for analytics, product improvement, AI or machine learning model training, marketing, sale, or any other secondary or commercial purpose. This restriction applies to all PHI regardless of form, including call recordings, transcripts, and derived data that has not been de-identified in accordance with 45 C.F.R. § 164.514(b).
15. Indemnity
Customer shall indemnify, defend, and hold harmless Sadie and its affiliates, officers, directors, employees, and agents from and against any third-party claim, demand, action, regulatory proceeding, investigation, fine, penalty, or award (including reasonable legal fees) arising from or related to:
15.1 HIPAA and Medical Privacy. Customer’s or any of Customer’s Upstream Customers’ failure to: (i) obtain written patient authorization or consent required under HIPAA, any applicable state electronic communications privacy law including without limitation the CIPA, California Civil Code § 56.10, or any other applicable medical privacy law, prior to sharing, transmitting, or making available any PHI to Sadie for processing under this Agreement; (ii) provide proper written notice of privacy practices to any patient in accordance with 45 C.F.R. § 164.520 or applicable state law; or (iii) establish, document, or maintain a valid legal basis under HIPAA for disclosing PHI to Sadie;
15.2 Biometric Privacy. Customer’s or any of Customer’s Upstream Customers’ failure to: (i) provide individuals with written notice and obtain their written consent prior to the collection of any biometric identifier or biometric information, in accordance with BIPA or any analogous state or federal biometric privacy law; (ii) maintain a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information; or (iii) otherwise comply with the obligations in the Biometric Information Privacy section of this DPA;
15.3 AI Regulatory Compliance. Customer’s or any of Customer’s Upstream Customers’ failure to: (i) provide consumers with required notice or disclosure that they are interacting with an AI system, as required under Article 50 of the EU AI Act, the CAIA or any analogous AI transparency or disclosure law; (ii) obtain any required consent or authorization for AI-assisted processing of personal data or biometric information under applicable law; or (iii) otherwise comply with the deployer obligations set out in the EU AI Act, the CAIA, or Biometric Information Privacy sections of this DPA; and
15.4 General Non-Compliance. Customer’s or any of Customer’s Upstream Customers’ material failure to comply with any obligation expressly imposed on Customer under this DPA with respect to Applicable Privacy Laws, to the extent such failure directly gives rise to a third-party claim or regulatory action against Sadie. The foregoing indemnity shall not apply to the extent a claim arises from Sadie’s own breach of this DPA, gross negligence, or wilful misconduct. Customer’s indemnity obligations under this Section survive termination or expiration of the Agreement.
16. Limitation of Liability
16.1 The liability limitations in the Agreement apply to this DPA. Notwithstanding the foregoing, nothing in the Agreement or this DPA limits or excludes either party’s liability (i) to the extent such limitation is not permitted under Applicable Privacy Laws, including liability to Data Subjects under Article 82 GDPR; (ii) Customer’s indemnification obligations under Section 15; or (iii) arising from willful misconduct or gross negligence. As between the parties, Sadie remains liable for compliance with its obligations under this DPA. Nothing in this DPA limits the rights of Data Subjects under Article 82 GDPR. As between the parties, any contractual claims under this DPA may be brought only by the parties to the Agreement.
16.2 Customer acknowledges that it is solely responsible for the sufficiency, validity, and accuracy of any such authorizations, consents, and notices required to be obtained under Sections 12, 13 and 14. Sadie has no obligation to verify whether Customer has satisfied the foregoing requirements prior to processing PHI on Customer’s behalf. Customer is solely responsible for the adequacy, legality, and sufficiency of all end-user or patient facing consent forms and notices.
17. Conflict
In the event of a conflict between this DPA and the Agreement, this DPA controls for all Processing of Personal Data. In the event of conflict with Applicable Privacy Laws, Applicable Privacy Laws prevail, including with respect to liability and Data Subject rights.
18. Duration
All GDPR-related obligations, including confidentiality, security, cooperation, and liability under Article 82 GDPR, survive termination for as long as Sadie Processes or retains Personal Data.
19. Acceptance and Incorporation
This DPA automatically applies whenever Sadie Processes Personal Data on behalf of Customer, regardless of execution method, and forms an integral part of the Agreement. Where required under Applicable Privacy Laws, this DPA governs all such Processing.
Appendix A: Description of Processing
This Appendix A describes the subject matter and details of Sadie’s Processing of Personal Data under the DPA.
1. Subject Matter of the Processing
Processing of Personal Data as necessary to provide, maintain, support, secure, and operate the Services under the Agreement.
No Training / Limited Improvement Use. Sadie will not use Personal Data processed under the DPA to train or fine-tune general AI or machine learning models, except (i) as instructed in writing by Customer for Customer’s exclusive benefit, and (ii) subject to the DPA and Applicable Privacy Laws. Sadie may use de-identified and aggregated operational telemetry that cannot reasonably identify an individual or Upstream Customer solely to maintain and improve service reliability and security.
2. Duration of the Processing
For the Term of the Agreement and as long as Sadie Processes Personal Data on behalf of Customer, including any retention permitted under the Agreement or required by Applicable Privacy Laws.
3. Nature and Purpose of the Processing
The Processing includes the following activities, as applicable to the Services purchased by Customer:
Hosting and storage of Personal Data
Transmission of Personal Data
Access, retrieval, and display
Organization, structure, and use
Analysis, reporting, and service-related analytics (excluding use of Personal Data to train or fine-tune general AI models
Authentication and authorization
Logging, monitoring, and security operations
Backup and archival for business continuity
Customer support and troubleshooting
Configuration, maintenance, and administration of the Services
Where the Outbound Calling Feature is enabled: receipt and storage of calling lists submitted by Customer, initiation and placing of outbound telephone calls to individuals identified by Customer, and recording of call outcome and disposition data
Any other Processing strictly necessary to perform the Services in accordance with the Agreement
Audio Handling / Retention. Sadie’s handling of audio varies by environment and configuration:
(a) Recording Disabled (default). Where the recording feature is not enabled for a given assistant configuration, audio is streamed and processed in real time and is not retained in any form following completion of processing, except for transient technical buffers strictly necessary for service operation, which are purged as soon as reasonably practicable following the call. Sadie represents that all sub-processors involved in audio processing are bound by written data processing agreements imposing restrictions on use of audio data that are no less protective than those applicable to Sadie under this DPA, including a prohibition on processing or retaining audio beyond what is strictly necessary to perform transcription services.
(b) Recording Enabled. Where Customer enables the recording feature for a specific assistant configuration, raw audio recordings are retained in an encrypted environment. Recording is not enabled by default and is configurable at the assistant level, and this default applies equally to inbound and outbound calls. The retention period for audio recordings shall be as specified by Customer in the applicable configuration settings; where no retention period is specified, audio recordings will be retained for a maximum of ninety (90) days from the date of recording, after which they will be automatically and permanently deleted. Customer may adjust the retention period subject to a mutually agreed maximum.
(c) HIPAA Environment. In Sadie’s HIPAA-configured environment, raw audio recordings are not stored. Transcripts generated within the HIPAA environment are redacted to remove personally identifiable information prior to storage. Raw unredacted transcripts are transmitted to the Customer.
4. Types of Personal Data
The specific Personal Data types Processed by Sadie in any given deployment are determined entirely by Customer’s configuration and implementation of the Services. Sadie applies no fixed or universal data schema across all deployments. Depending on Customer’s configuration and use of the Services, Personal Data may include (without limitation):
Business contact information (names, titles, roles, business email addresses, phone numbers)
Account and authentication information
Caller telephone number / caller ID (Sadie does not perform any reverse lookup or identity enrichment)
Where the Outbound Calling Feature is enabled: called-party telephone numbers and any names, contact details, or campaign attributes contained in calling lists submitted by Customer, together with consent status, opt-out and suppression flags, and call attempt, outcome, and disposition records
Device and usage information
Communication content submitted through the Services
Transactional or support interaction details
Audio stream content (processed in real time)
Transcripts and outputs generated through operation of the Services
Call/event metadata and service analytics (e.g., timestamps, routing/outcome indicators, interaction IDs)
Any other Personal Data submitted, transmitted, or stored by Customer within the Services
Sensitive Data:
Customer may choose to submit Sensitive Data, but the Services are not designed to Process Sensitive Data unless expressly agreed in writing. Any Sensitive Data submitted is subject to the restrictions and safeguards described in this DPA. Sensitive Data may also be included in transcripts or outputs generated through operation of the Services; such Processing remains subject to the DPA and Customer’s instructions.
5. Categories of Data Subjects
May include:
Customer’s employees, contractors, and personnel
Customer’s end users or clients
Customer’s prospective leads or contacts
Individuals whose information is processed by Customer through its use of the Services
Any other individuals whose Personal Information Customer submits to the Services
Upstream Customers’ end users/callers and authorized users interacting with the Services
Where the Outbound Calling Feature is enabled: individuals to whom outbound calls are placed at Customer’s direction, including individuals who have not previously contacted Customer and any individual who answers a telephone number submitted by Customer irrespective of whether that individual is the intended recipient
6. Processing Instructions
Sadie will Process Personal Data only:
(a) as necessary to provide the Services;
(b) in accordance with the Agreement and DPA;
(c) as documented by Customer’s written instructions; and
(d) as required by Applicable Privacy Laws.
7. Approved Hosting Regions
Personal Data will be processed and stored only in the following approved hosting region(s). Sadie will not materially change the approved hosting region(s) for Personal Data without prior written notice to Customer and, where required by Applicable Privacy Laws or applicable Upstream Customer commitments known to Sadie, Customer’s prior written approval.
(a) United States
(b) Europe
(c) Australia, specifically for Customers and end-users located in Australia
(d) Canada
8. Frequency of Transfer
Continuous/repeated transfers during the Term, initiated by use of the Services. Onward transfers to authorized sub-processors occur on an ongoing basis as necessary to provide the Service.
Appendix B: Security Measures
Sadie maintains an information security program designed to protect Personal Data against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss, alteration, or disclosure. The following categories of safeguards will be implemented, as appropriate:
1. Organizational Controls
Information security program appropriate to the nature of the Services
Regular risk assessments and security reviews
Policies governing acceptable use, access control, encryption, and incident response
Independent audits or certifications (e.g., SOC 2 Type II as and when available)
Vendor and Sub-processor security evaluations
Personnel training on security and privacy responsibilities
Documented data retention and deletion practices aligned to the agreed retention
2. Access Controls
Role-based and least-privilege access
Authentication and authorization controls
Multi-factor authentication where applicable
Logging of access to systems containing Personal Data
Regular access reviews
Immediate removal of access upon personnel termination or job change
Privileged access management and logging for administrative access, where applicable
3. Physical and Environmental Security
Secure data center facilities with physical access controls
Environmental safeguards (HVAC, power redundancy, fire suppression)
Surveillance, monitoring, and visitor management
Asset disposal and media sanitization policies
4. Network and System Security
Firewalls, intrusion detection/prevention, and network segmentation
Patch management and vulnerability remediation
Anti-malware and endpoint protection
Secure configuration management
Encryption of Personal Data in transit using TLS 1.2 or higher
Encryption of Personal Data at rest using AES-256
5. Operational Controls
Secure software development lifecycle (SDLC) practices
Code review and testing
Backup and recovery procedures
Business continuity and disaster recovery plans
Monitoring and logging of system activity
Regular penetration testing or vulnerability assessments
6. Incident Response
Documented incident response plan
Processes for detection, investigation, containment, and remediation
Notification to Customer without undue delay following confirmation of a Security Incident. Incident communications will include, to the extent known, the nature of the incident, categories and approximate number of affected Data Subjects/records, likely consequences, and mitigation measures taken or proposed.
7. Security Assurance Materials
Upon reasonable written request and subject to confidentiality, Sadie will provide Customer with security assurance materials reasonably necessary to maintain compliance, which may include: (i) a security program overview, (ii) summaries of independent penetration tests or vulnerability assessments (excluding sensitive exploit details), (iii) an incident response overview, and (iv) where available, SOC 2 Type II certification information.
Appendix C: Cross-Border Transfer Mechanisms
1. Definitions. Capitalized terms not defined in this Schedule are defined in the DPA.
1.1 “EU Standard Contractual Clauses” or “EU SCCs” means the Standard Contractual Clauses approved by the European Commission in decision 2021/914.
1.2 In addition:
“Designated EU Governing Law”: Ireland
“Designated EU Member State”: Ireland
2. EU Transfers. Where Personal Data is protected by GDPR and is subject to a Restricted Transfer, the following applies:
2.1 The EU SCCs are hereby incorporated by reference as follows:
(a) Module 2 (Controller to Processor) applies where Customer is a Controller of Personal Data and Sadie is a Processor of Personal Data;
(b) Module 3 (Processor to Processor) applies where Customer is a Processor of Personal Data (on behalf of a third-party Controller) and Sadie is a Processor of Personal Data;
(c) Customer is the “data exporter” and Sadie is the “data importer”; and
(d) by entering into this DPA, each party is deemed to have signed the EU SCCs (including their Annexes) as of the DPA Effective Date.
2.2 For each Module, where applicable the following applies:
(a) the optional docking clause in Clause 7 does not apply;
(b) in Clause 9, Option 2 will apply, the minimum time period for prior notice of Sub-processor changes shall be as set out in the DPA, and Sadie shall fulfill its notification obligations by notifying Customer of any Sub-processor changes in accordance with the DPA;
(c) in Clause 11, the optional language does not apply;
(d) in Clause 13, all square brackets are removed with the text remaining;
(e) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Designated EU Governing Law;
(f) in Clause 18(b), disputes will be resolved before the courts of the Designated EU Member State;
(g) Appendix A to this DPA contains the information required in Annex 1 of the EU SCCs; and
(h) Appendix B to this DPA contains the information required in Annex 2 of the EU SCCs.
2.3 Where context permits and requires, any reference in this DPA to the EU SCCs shall be read as a reference to the EU SCCs as modified in the manner set forth in this Section 2.
3. UK Transfers. Where Personal Data is protected by the UK GDPR and is subject to a Restricted Transfer, the following applies:
3.1 The EU SCCs apply as set forth in Section 2 (EU Transfers) of this Appendix C with the following modifications:
(a) each party shall be deemed to have signed the “UK Addendum to the EU Standard Contractual Clauses” (“UK Addendum”) issued by the Information Commissioner’s Office under section 119 (A) of the Data Protection Act 2018;
(b) the EU SCCs shall be deemed amended as specified by the UK Addendum in respect of the transfer of Personal Data;
(c) in Table 1 of the UK Addendum, the parties’ key contact information is as provided to each party, as follows:
Customer / ‘Data Exporter’ Details
Name:
Contact details for data protection:
Main address:
Activities:
Role: Controller/Processor
Sadie / ‘Data Importer’ Details
Name:
Contact details for data protection:
Main address:
Activities:
Role: Processor/Sub-processor
(d) in Table 2 of the UK Addendum, information about the version of the EU SCCs, modules and selected clauses which this UK Addendum is appended to are located above in this Appendix C;
(e) in Table 3 of the UK Addendum:
(i) the list of parties is located above;
(ii) the description of transfer is located in Appendix A to this DPA;
(iii) Annex II is located in Appendix B to this DPA; and
(iv) the list of Sub-processors is s maintained and made available in accordance with Section 5.4 of the DPA.
(f) in Table 4 of the UK Addendum, both the Importer and the Exporter may end the UK Addendum in accordance with its terms (and the respective box for each is deemed checked); and
(g) in Part 2: Part 2 - Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with section 119 (A) of the Data Protection Act 2018 on 2 February 2022, as it is revised under section 18 of those Mandatory Clauses.