Data Processing Agreement (DPA)

This agreement governs the processing of personal data on behalf of the customer under Art. 28 GDPR between the customer as controller and NEOCLARITY GROUP LTD, Archiepiskopou Makariou III 59, Mouyias Tower, 3rd floor, Office 301, 6017 Larnaka, Republic of Cyprus, reg. no. HE 496886 (the “Provider”), as processor.

It forms part of the contract for the use of Neo CLARITY (service agreement, subscription or Terms of Service, the “Main Contract”) and takes effect when the Main Contract is concluded, without a separate signature. Electronic form is sufficient (Art. 28(9) GDPR).

The Provider makes the Neo CLARITY software available to the customer, with which the customer combines, evaluates and has AI features analyse data from advertising, funnels, appointment booking, CRM and sales calls. In doing so, the Provider processes personal data for which the customer is responsible.

This agreement runs for as long as the Main Contract. Obligations under § 11 (deletion and return) and confidentiality survive it.

Nature and purpose: storing, importing from the sources the customer connects, combining, evaluating and displaying sales, marketing and team data; transcribing call recordings; AI assessment of leads and calls; sending reports and notifications; on the customer’s instruction, transmission to the services the customer has connected (see § 6(5)).

Categories of data subjects:

• the customer’s prospects and leads,
• the customer’s clients and buyers,
• the customer’s employees, freelancers and sales partners (e.g. setters, closers, team members with access),
• other participants in recorded calls,
• visitors to the customer’s websites and funnels.

Categories of personal data:

• contact details: name, email address, phone number,
• answers from forms, questionnaires and appointment bookings,
• source and campaign data: campaign parameters, click IDs, browser identifier, truncated and pseudonymised visit data,
• sales data: appointments, call outcomes, deals, amounts, instalments, payment status,
• call recordings, transcripts and summaries derived from them,
• AI assessments: lead-quality rating, sales-call reviews,
• team members’ performance data: assigned appointments and deals, commissions, call reviews,
• team members’ usage and log data.

Special categories of personal data (Art. 9 GDPR) are not subject to the processing. If the customer designs questionnaires or calls in a way that produces such data (for example health information), the customer ensures the necessary legal basis and informs the Provider in advance.

The Provider processes the data only on documented instructions from the customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case the Provider informs the customer of that legal requirement before processing, unless that law prohibits it.

Instructions follow from the Main Contract, this agreement and the settings the customer makes in Neo CLARITY (such as connecting or disconnecting a source, enabling a feature, deleting data). Further instructions are given in text form to support@neoclarity.io.

If the Provider considers an instruction unlawful, it informs the customer without undue delay and may suspend it until the customer confirms or changes it.

The Provider only uses persons for the processing who are bound to confidentiality or subject to a statutory duty of secrecy. They process the data only on instruction, insofar as this is necessary to provide the service, for support at the customer’s request or to fix faults.

The Provider implements the technical and organisational measures under Art. 32 GDPR described in Annex 1. It may adapt them to technical progress provided the level of protection does not fall. It documents material changes and discloses them to the customer on request.

(1) The customer gives general authorisation to engage further processors. Those engaged when the agreement is concluded are listed in Annex 2 under Sub-processors and are deemed approved.

(2) The Provider informs the customer of any intended addition or replacement at least 30 days in advance by email to the workspace owner’s address. Within that period the customer may object for an important data-protection reason. If the parties find no solution, the customer may terminate the Main Contract extraordinarily with effect from the change; fees already paid for the period after it are refunded pro rata.

(3) The Provider contractually binds every sub-processor to data-protection obligations equivalent to those of this agreement and selects it with due regard to its security measures.

(4) If a sub-processor fails to fulfil its obligations, the Provider remains liable to the customer for its conduct as for its own.

(5) Transmission to services the customer connects with its own account (such as Close, Typeform, Calendly, Meta, Google, Telegram, Fathom) or links to its own AI program through the MCP access is not sub-processing. It takes place on the customer’s instruction; the customer is responsible for its own contractual relationship with those providers. Annex 2 lists them as well.

The customer’s data is stored in the EU (Frankfurt am Main). Some sub-processors process data in the USA or may access it from there. The Provider ensures that the requirements of Art. 44 et seq. GDPR are met, in particular through the EU Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. Annex 2 states the basis for each.

The Provider assists the customer with appropriate measures in responding to requests under Art. 12 to 22 GDPR. The customer can handle many requests itself in Neo CLARITY (view, correct, export, delete leads). If a data subject contacts the Provider directly, the Provider forwards the request to the customer without undue delay and does not answer it itself unless the customer instructs otherwise.

The Provider notifies the customer of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, by email to the workspace owner’s address. The notification contains, as far as known, the information under Art. 33(3) GDPR; missing information follows as soon as available. The Provider takes the measures needed to contain and remedy the breach without delay and supports the customer in its notification duties.

Taking into account the nature of processing and the information available to it, the Provider assists the customer in complying with Art. 32 to 36 GDPR, in particular with a data protection impact assessment and prior consultation of the supervisory authority. Assistance beyond providing existing documents that is not caused by a breach on the Provider’s part may be charged at cost.

After the Main Contract ends, the customer may export its data for another 30 days or request it in a common format (e.g. CSV) by email to support@neoclarity.io. Thereafter the Provider deletes all of the customer’s personal data within a further 30 days unless a statutory retention duty applies. Data in backups is overwritten in the regular rotation cycle.

The customer may delete individual data, connections or the entire workspace itself at any time during the term. On request, the Provider confirms deletion in text form.

The Provider makes available to the customer the information needed to demonstrate compliance with Art. 28 GDPR and allows audits by the customer or an auditor it appoints who is bound to confidentiality. On-site audits are possible with four weeks’ notice, during normal business hours and without disrupting operations, at most once per calendar year unless there is specific cause. Evidence through documents, self-assessments and sub-processors’ certificates takes precedence. Each party bears its own costs of an audit.

The customer is responsible for the lawfulness of the processing it commissions. In particular it ensures that

• every processing has a legal basis and data subjects are informed under Art. 13 and 14 GDPR, including about AI assessments,
• all participants are informed and have consented before any call is recorded. Recording the non-public spoken word without authorisation is a criminal offence in Germany (§ 201 StGB); the Provider processes recordings only on the condition that such consent exists,
• it has obtained the necessary consents and given the necessary information for reporting lead stages back to advertising platforms (Conversions API),
• it observes employee data-protection rules when evaluating its team members’ performance and, where a works council exists, respects its co-determination rights (e.g. § 87(1) no. 6 BetrVG),
• the accounts and groups it connects (such as Telegram groups for reports) are accessible only to persons entitled to see the content.

If the customer notices errors or irregularities in the processing, it informs the Provider without undue delay.

Neither the Provider nor its sub-processors use the customer’s data to train general AI models. Lead ratings and call reviews are recommendations to the customer; Neo CLARITY makes no decisions producing legal effects for data subjects within the meaning of Art. 22 GDPR. Whether and how the customer uses such recommendations is its own decision.

Liability is governed by Art. 82 GDPR and otherwise by the liability rules of the Main Contract. In case of conflict, this agreement prevails over the Main Contract on data-protection matters.

Amendments require text form. Should a provision be invalid, the remainder of the agreement stays valid. The law agreed for the Main Contract applies. The German version is authoritative.

Confidentiality — physical and system access. Neo CLARITY runs no servers of its own. Database and application run in sub-processors’ data centres in the EU (Frankfurt am Main), which are certified to recognised standards (including ISO 27001, SOC 2) and control physical access there. Users sign in with email and password (stored as a cryptographic hash) or via Google; sessions use signed, short-lived tokens with automatic renewal. Only a few, named persons have access to the infrastructure.

Confidentiality — data access. Every record belongs to exactly one workspace. The database itself enforces this separation (row-level security, forced on every table, default: no access). Within a workspace, a role and permission model (owner, admin, operator, viewer and custom roles) controls who sees what; monetary values can be hidden separately. Provider support access to a workspace is time-limited and logged.

Confidentiality — separation. Production, development and testing use separate databases. Development environments receive no customer data, with the sole exception of test data from the Provider’s own workspaces.

Pseudonymisation and encryption. All connections are TLS-encrypted (HSTS). Credentials for connected services are additionally stored encrypted with AES-256-GCM. Data sent to advertising platforms is hashed only (SHA-256). Visits to the customer’s funnel pages are counted by the tracker without cookies by default: the IP address is truncated, made unrecognisable with a key that changes daily and not stored; the intermediate values are deleted after 48 hours.

Integrity — transmission and input. External interfaces (webhooks, scheduled jobs) verify signatures or secret keys. The Provider’s administrative actions are recorded in an append-only log. Changes to data in the workspace are traceable via timestamps and source markers.

Availability and resilience. The database is backed up daily. Errors and outages are captured automatically (error monitoring, monitoring of scheduled jobs). New versions only go live after automated checks (type checks, tests, database rules) and can be rolled back at short notice.

Data minimisation. Call recordings are not stored at the transcription service or are deleted there immediately after transcription. Error reports contain no user identifiers by default; on the server they are additionally stripped of personal content before sending. AI providers receive only the content each task needs.

Review and organisation. Changes to the system are reviewed before release; the effectiveness of the measures is reviewed regularly. Sub-processors are bound under Art. 28 GDPR. Requests and incidents go to support@neoclarity.io.

The current list of sub-processors and of the services the customer connects itself is at Sub-processors. It forms part of this agreement.