Terms of Use

DATA PROCESSING ADDENDUM

This Data Processing Addendum (the “Addendum”) is entered into by and between VIDA Global Inc. with its principal place of business at 12160 W. Parmer Lane, Suite 130-716, Cedar Park, TX 78613 (“VIDA”) and you, whether personally or on behalf of an entity (“Customer”) (each individually a “Party” and collectively the “Parties”) and forms part of the Terms of Service, or such other agreement governing the direct relationship between the Parties hereto (collectively, the “Terms of Service”). This Addendum is effective as of the effective date of the Terms of Service (the “Effective Date”).

1. Definitions. In addition to capitalized terms defined elsewhere in this Addendum, the following terms shall have the meanings ascribed to them herein.
   
   1. “adequacy decision,” “data exporter,” “process,” “processing,” and “sub-processor,” shall each have the meaning ascribed to it under Data Protection Law.
   2. “Business” and “Controller” shall have the meanings ascribed to in Data Protection Law and shall be used interchangeably herein.
   3. “Consumer” and “Data Subject” shall have the meanings ascribed to in Data Protection Law and shall be used interchangeably herein.
   4. “Covered Data” means the data processed as detailed in the Terms of Service and for the purposes described in the Terms of Service.
   5. “Customer Content” means any data, content, materials, audio, recordings, transcripts, messages, prompts, AI outputs, summaries, files, configurations, integration data, call metadata, or other information submitted to, transmitted through, generated by, or processed by the Services on behalf of Customer.
   6. “Data Protection Law” means all applicable laws and regulations applicable, including, as applicable, laws and regulations of the European Union (“EU”), the European Economic Area (“EEA”) and their member states, Switzerland and the United Kingdom (“UK”), including without limitation, Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“General Data Protection Regulation” or “GDPR”) and EU Directive 2002/58/EC on Privacy and Electronic Communications (“e-Privacy Directive”) or, the superseding e-Privacy Regulation once effective, and the United Kingdom’s General Data Protection Regulation (“UK GDPR”), and as applicable, the laws and regulations of the United States, including without limitation, the California Consumer Privacy Act of 2018 and its amendments including the California Privacy Rights Act (collectively, the “CCPA”), the Virginia’s Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Oregon Consumer Privacy Act (“OCPA”), the Texas Data Privacy and Security Act (“TXDPSA”), the Florida Digital Bill of Rights (“FDBR”), the Montana Consumer Data Privacy Act (“MTCDPA”), the Iowa Consumer Data Protection Act (“IADPA”), the Delaware Personal Data Privacy Act (“DEPDPA”), the Nebraska Data Privacy Act (“NEDPA”), the New Hampshire Privacy Act (“NHPA”), the New Jersey Data Privacy Act (“NJDPA”), the Tennessee Information Privacy Act (“TIPA”), the Minnesota Consumer Data Privacy Act (“MNCDPA”), and the Maryland Online Data Privacy Act (“MDODPA”), and the Indiana Consumer Data Protection Act (“INCDPA”), the Kentucky Consumer Data Protection Act (“KYCDPA”), and the Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”).
   7. “Data Subject Request” means any right afforded to a Data Subject under Data Protection Law, including, but not limited to, the rights of access, correction, deletion, portability, and to opt-out of certain processing activities such as cross-context behavioral or targeted advertising. 
   8. “Member States” means a member of the EU.
   9. “Personal Data” and “Personal Information” shall have the meanings ascribed in Data Protection Law and shall be used interchangeably herein.
   10. “Processor” and “Service Provider” shall have the meanings ascribed to it in Data Protection Law and shall be used interchangeably herein.
   11. “Services” shall have the meaning ascribed to it in the Terms of Service. 
2. Designation. The Parties acknowledge and agree that with regards to the Covered Data, Customer is a ‘Controller’ (and ‘Business’ under CCPA), VIDA is a ‘Controller’ (and ‘Business under CCPA’) when processing Customer data, and VIDA is a ‘Processor’ (and ‘Service Provider’ under CCPA’) when processing Customer’s end-client data.
3. Obligations.
   
   1. Compliance with Law. With respect to the Covered Data, the Parties shall comply with Data Protection Law. Each Party shall promptly inform the other if it is unable to comply with this Addendum or Data Protection Law in performing its obligations under the Terms of Service. If the non-complying Party cannot comply within a reasonable period of time, or is in substantial or persistent breach of this Addendum or Data Protection Law, the complying Party shall be entitled to remediate the non-compliant action and/or terminate the Addendum and the Terms of Service insofar as it concerns processing of Covered Data.
   2. Cooperation and Data Subject Requests. Each Party shall cooperate with the other in complying with Data Protection Law. As it pertains to Covered Data, each Party shall be responsible for responding to enquiries from regulators and for responding to Data Subject Requests and shall implement mechanisms to facilitate such enquiries and requests. With respect to objection or opt-out requests related to the onward transfer or ‘sale’ of Covered Data, each Party shall forward, or make available, to the other Party any applicable Data Subject Requests within fifteen (15) days of receipt by that Party, and comply with any such Data Subject Requests within fifteen (15) days of receipt from the other Party. In the event any request, correspondence, enquiry or complaint is made directly to a Party by a regulator under Data Protection Law related to the Services or Terms of Service between the Parties, then that Party shall promptly inform the other Party of such regulator request, correspondence, enquiry or complaint.
   3. Security Incident. VIDA shall notify the other Party without undue delay (and, in any event, within seventy two (72) hours) upon VIDA or any sub-processor of VIDA becoming aware of unauthorized or unlawful access, use, disclosure, modification, destruction, and loss of Covered Data (a “Security Incident”). 
   4. Government Requests. Unless legally prohibited, each Party shall promptly inform the other Party if it receives a request or demand from a governmental or regulatory body relating to VIDA’s processing of Covered Data and shall fully cooperate with the other Party in connection with any response to such request or demand.
4. Data Processor Obligations. When VIDA is processing Covered Data exclusively as a Processor, the following terms shall apply:
   
   1. Limitations on Processing. Processor shall at all times comply with Controller’s written instructions pursuant to the Terms of Service and this Addendum, and shall only process the Covered Data for the limited purposes specified in the Terms of Service.
   2. AI Processing. VIDA may process Customer Content, including prompts, messages, call audio, transcripts, AI outputs, summaries, metadata, and integration data, to provide, maintain, secure, troubleshoot, support, and improve the Services. VIDA will not use Customer Content or Customer Personal Data to train, fine-tune, or improve VIDA’s or any third party’s general-purpose AI models except where Customer expressly authorizes such use in writing. VIDA contractually prohibits its AI model providers, speech-to-text providers, text-to-speech providers, and similar AI infrastructure providers from using Customer Content or Customer Personal Data to train, fine-tune, or improve their general models, except where Customer expressly authorizes such use in writing.
   3. CCPA.
      
      1. To the extent any Covered Data is deemed “Personal Information” (as such term is defined under the CCPA) and is subject to the CCPA, Service Provider agrees not to: (i) “sell” or “share” the Covered Data as such terms are defined under the CCPA; (ii) retain, use, or disclose Covered Data for any purpose other than for the specific purpose of performing the Services or as otherwise expressly permitted under the Terms of Service including retaining, using or disclosing the Covered Data for a commercial purpose other than the business purposes specified in this Addendum or the Terms of Service, or as otherwise permitted by the CCPA; (iii) retain, use or disclose the Covered Data outside of the direct business relationship with Controller; (iv) combine Covered Data it receives from Controller with Covered Data it receives from or on behalf of another person or collects from its own interactions with consumers, except where required to provide the Services provided it is permitted under the CCPA. 
      2. For the avoidance of doubt, any Personal Information that: (i) Controller uploads directly to the Services; (ii) is received to the Services directly through Controller‘s implementation and/or configuration; or (iii) Controller directs or instructs its partner(s) (e.g., through configuration of the Services) to send to or share with Service Provider for processing on Controller’s behalf for the purpose of providing the Services under the Terms of Service, shall be deemed Covered Data received from Controller. 
      3. Business Purposes. In accordance with the CCPA, Service Provider may engage in the following business purposes:
         
         1. providing, hosting, operating, maintaining, supporting, and securing the Services;
         2. configuring, deploying, operating, and supporting AI agents and related workflows;
         3. processing prompts, messages, call audio, transcripts, AI outputs, summaries, metadata, and integration data as necessary to provide the Services;
         4. providing voice, messaging, telephony, SIP, call routing, transcription, speech synthesis, and related communications functionality;
         5. maintaining or servicing accounts, providing customer service, processing transactions, managing subscriptions, processing payments, issuing invoices, and providing billing support;
         6. detecting, preventing, investigating, and remediating fraud, abuse, security incidents, service misuse, unauthorized access, and violations of the Terms of Service;
         7. debugging, troubleshooting, logging, monitoring, analyzing performance, and repairing errors that impair existing intended functionality;
         8. undertaking internal research, testing, analytics, and development to verify, maintain, improve, upgrade, or enhance the quality, safety, security, reliability, and functionality of the Services;
         9. complying with applicable law, legal process, regulatory obligations, law enforcement requests, audit obligations, and contractual compliance requirements; and
         10. performing other services on behalf of Customer as described in the Terms of Service, this Addendum, the applicable order form, or Customer’s instructions.
   4. Data Protection Impact Assessment and Prior Consultation. Processor shall provide reasonable assistance to Controller with any data protection impact assessments, audits, certifications, or prior consultations with legal or regulatory authorities or other competent data protection authorities, which Controller reasonably considers to be appropriate or required under any Data Protection Law, in relation to processing of Covered Data by Processor.
   5. Sub-Processors.
      
      1. Authorized Sub-Processors. Controller specifically authorizes the Processor to engage its sub-processors from the sub-processors List as set out in Annex III. The Processor will notify Controller of any changes the Processor intends to make to the Processor’s Sub-Processors List by email or at least ten (10) days before the changes take effect. Controller may reasonably object to a change on legitimate grounds relating to data protection within such ten (10) days. If Controller objects to the Processor’s use of a sub-processor and Processor cannot find a suitable replacement that would allow Processor to continue providing the Services in accordance with the Terms of Service and this Addendum, then notwithstanding anything to the contrary in the Terms of Service (including this Addendum), Controller may in its sole discretion terminate the Terms of Service immediately for cause by providing written notice to Processor.
      2. Sub-Processor Obligations. The Processor will enter into a written agreements with each subprocessor that imposes on that sub-processor, in substance, the same obligations as those imposed on the Processor under this Addendum, including implementing appropriate technical and organisational security measures to protect Personal Data consistent with any applicable Data Protection Law.
   6. Return or Deletion of Personal Data. Upon the expiration or termination of the Terms of Service and at Controller’s request, Processor shall securely return to Controller or securely destroy (at Controller’s election), all Covered Data obtained by Processor in acting as a Processor in connection with the Terms of Service (including any Covered Data subcontracted to a third party for processing). This requirement shall not apply to the extent that the Processor is required by any applicable law to retain some or all of the Personal Data, in which event the Processor shall isolate and protect the Personal Data from any further processing except to the extent required by such law until deletion is possible. Processor will provide written confirmation to Controller of its compliance with this provision.
   7. Audit. With a minimum of thirty (30) days’ notice upon the request of the Controller, Processor shall make available to Controller all information in its possession necessary to demonstrate Processor’s compliance with the obligations described in this Addendum and shall allow for, and cooperate with, reasonable assessments by Controller or Controller’s designated assessor.
5. Controller Obligations. When processing Personal Data as a Controller, Controller agrees that it shall:
   
   1. Privacy Notices and Consents. Customer is responsible for providing all required privacy notices, obtaining all required consents, and establishing a valid legal basis for the collection, use, disclosure, and processing of Personal Data in connection with Customer’s use of the Services, including call recording, messaging, outbound communications, AI agent configuration, prompts, scripts, knowledge bases, integrations, and telecom connections. Customer shall not use the Services to process Personal Data in violation of applicable Data Protection Law.
   2. Additional Partner or Provider Obligations. Enter into appropriate contractual arrangements with any additional third party partners or providers, requiring all parties to comply with Privacy Laws including honoring consent or opt-out choices and coordinating with the other Parties as necessary to facilitate such requests within the statutory periods defined by applicable Privacy Laws.
   3. Regulated and Sensitive Data. Customer shall not submit protected health information, special-category data, children’s data, biometric identification data, financial account credentials, government identifiers, or other regulated sensitive data to the Services unless expressly permitted under the Terms of Service, an applicable order form, a Business Associate Agreement, or another written agreement with VIDA.
   4. 5.4. Customer-Provided Third-Party Services. Third-party services, applications, telecom providers, SIP trunks, PBXs, CRMs, websites, APIs, plugins, tools, or integrations that Customer connects to the Services are not VIDA subprocessors where Customer contracts with, controls, or instructs such third parties independently. Customer is responsible for those third-party services and for ensuring Customer has the right to transmit data to and from such services.
   5. Reseller and Downstream Customer Use. Where Customer uses the Services as a reseller, white-label partner, managed service provider, or other intermediary, Customer is responsible for ensuring that its downstream customers and users are authorized to use the Services, receive all required privacy notices, provide all required consents, and are bound by terms that are no less protective of VIDA than this Addendum and the Terms of Service. Customer is responsible for the acts, omissions, configurations, instructions, and data submitted by its downstream customers and users as if they were Customer’s own.
6. Cross Border Transfers.
   
   1. Ex-EEA Transfers. If the Services involves the transfer of Covered Data of Data Subjects in the EEA or the UK, to a country or territory outside of those regions which has not received an applicable adequacy decision, the Parties hereby incorporate, and agree to comply with, the Standard Contractual Clauses set out by the European Commission Decision 2021/914/EU and approved for use in data transfers under the UK GDPR, located at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en#ntc12-L_2021199EN.01003701-E0012 (the “SCCs”). The SCCs will be incorporated by reference and apply as follows:
      
      1. Where VIDA is a “processor”, Module 2 shall apply, and where VIDA is a “Controller” Module 1 shall apply;
      2. The optional docking clause in Clause 7 does not apply;
      3. In Clause 9 of Module 2, Option 2 (general written authorization) applies, and the minimum time period for prior notice of sub-processor changes shall be ten (10) days;
      4. In Clause 11, the optional language does not apply;
      5. All square brackets in Clause 13 are hereby removed;
      6. In Clause 17 (Option 1), the EU SCCs will be governed by the laws of the member state of the Data Exporter;
      7. In Clause 18(b), disputes will be resolved before the courts of member state of the Data Exporter;
      8. Annex I of the EU SCCs shall be deemed completed with the information set out in Annex IA, Annex IB, and Annex IC attached hereto; and
      9. Annex II of the EU SCCs shall be deemed completed with the information set out in Annex II attached hereto.
   2. Ex-UK Transfers. In relation to Covered Data that is subject to the UK GDPR, the SCCs will apply in accordance with Section 6.1 as well as the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses for International Data Transfers located at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf (the “IDTA”). The IDTA will be incorporated by reference and apply as follows:
      
      1. Tables 1, 2 and 3 of the IDTA will be deemed completed with the information set out in the Annexes of this Addendum; 
      2. Table 4 will be deemed completed by selecting “neither party”; and 
      3. Any conflict between the terms of the SCCs and the IDTA will be resolved in accordance with Section 10 and Section 11 of the IDTA.
7. Indemnification. Indemnification under this Addendum shall be governed by and is subject to the terms set forth in Section 26 (Indemnification) of the Terms of Service.
8. Limitation of Liability. Limitation of Liability under this Addendum shall be governed by and is subject to the terms set forth in Section 24 (Limitation of Liability) of the Terms of Service.
9. General Terms.
   
   1. Termination and Survival. This Addendum shall remain in effect for so long as the Terms of Service are in effect and thereafter for so long as VIDA processes Covered Data.
   2. Counterparts. This Addendum may be executed in any number of counterparts and any Party (including any duly authorized representative of a Party) may enter into this Addendum by executing a counterpart.
   3. Ineffective clause. If individual provisions of this Addendum are or become ineffective, the effectiveness of the remaining provisions shall not be affected. The Parties shall replace the ineffective clause with a legally allowed clause, which will accomplish the intended commercial intention as closely as possible.
   4. Conflicts. In case of contradictions between this Addendum and the provisions of the Terms of Service, the provisions of this Addendum shall prevail.
   5. Applicable law and jurisdiction. The applicable law and jurisdiction as set forth in the Terms of Service apply to this Addendum.

‍

ANNEX I

A.   LIST OF PARTIES

Data exporter(s):

Name: Customer
Address: As specified when Customer registers for Services.
Contact person’s name, position, and contact details: As specified when Customer registers for Services.
Activities relevant to the data transferred under these Clauses: The activities specified under Annex I(B) below.
Signature and date: This Annex IA shall automatically be deemed executed when the Terms of Service is executed by the Parties.
Role: Controller

Data importer(s):

Name: VIDA Global Inc.
Address: 12160 W. Parmer Lane, Suite 130-716, Cedar Park, TX 78613
Contact: privacy@vida.io‍

For clarity, VIDA has not appointed this contact as a formal Data Protection Officer unless expressly stated in writing.

Activities relevant to the data transferred under these Clauses: The activities specified under Annex I(B) below.

Signature and date: This Annex IA shall automatically be deemed executed when the Terms of Service is executed by the Parties.

Role: Controller and/or Processor 

B.   DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

Customer, Customer’s employees, contractors, representatives, administrators, authorized users, and other personnel; Customer’s customers, clients, end-clients, end users, callers, callees, consumers, leads, contacts, and other individuals who interact with AI agents, voice services, messaging services, integrations, or other Services; and, where Customer is a reseller, white-label partner, or other intermediary, Customer’s downstream customers and their respective employees, contractors, representatives, administrators, authorized users, customers, clients, end users, callers, callees, consumers, leads, contacts, and other individuals whose Personal Data is submitted to, transmitted through, generated by, or processed by the Services.

Categories of personal data transferred

Account details, user and administrator profile information, authentication and access data, billing and payment information, phone numbers, caller and callee information, call metadata, call audio, call recordings where enabled, transcripts, messages, prompts, AI outputs, AI-generated summaries, agent configuration data, knowledge-base data, workflow and tool configuration data, CRM or integration data provided by Customer, support communications, usage data, logs, diagnostics, and other Customer Content submitted to, transmitted through, generated by, or processed by the Services.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

VIDA does not intentionally require Customer to submit sensitive or special-category data to use the Services. However, depending on Customer’s configuration and use case, Customer or Customer’s end users may submit sensitive personal information, call audio, transcripts, messages, prompts, outputs, or other content through the Services. Such data is processed only as necessary to provide the Services, subject to the Terms of Service, this Addendum, applicable customer instructions, access controls, retention limits, and security measures.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Continuous basis.

Nature of the processing

Covered Data will be processed in accordance with the Terms of Service, including with this Addendum, and may be subject to the following processing activities: collection, recording where enabled, hosting, storage, retrieval, access, use, transmission, routing, transcription, speech synthesis, AI model inference, generation of outputs and summaries, analysis, logging, monitoring, support, debugging, security review, deletion, and disclosure as necessary to provide the Services or as required by law.

Purpose(s) of the data transfer and further processing

Personal Data will be processed to provide, host, operate, secure, monitor, support, maintain, troubleshoot, improve, and bill for the Services, including AI agent functionality, voice and messaging services, telecom and SIP functionality, call routing, transcription, speech synthesis, AI model inference, generation of AI outputs and summaries, integrations, analytics, fraud and abuse prevention, customer support, account administration, payment processing, legal compliance, and contractual compliance.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Customer Content, including call audio, call recordings, transcripts, prompts, messages, AI outputs, summaries, and related service data, will be retained according to Customer’s configuration, the applicable order form, the Terms of Service, this Addendum, or VIDA’s then-current retention policies. Account, billing, tax, legal, security, audit, and compliance records may be retained for longer periods as required or permitted by law. Backups will be deleted in accordance with VIDA’s ordinary backup-retention cycle. VIDA may retain aggregated or de-identified data that is not reasonably capable of identifying Customer, Customer’s end users, or any Data Subject.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

As detailed in this Annex 1B.

C.   COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13

The Supervisory Authority of the member country of data exporter.

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

1. Organizational/Administrative Security Measures. Processor has implemented, and will maintain and update as appropriate throughout its processing of Covered Data:  
   
   1. A written and comprehensive information security program in compliance with applicable data protection laws.
   2. A data loss prevention program that reflects reasonable policies or procedures designed to detect, prevent, and mitigate the risk of data security breaches or identity theft, which shall include at a minimum: 
      
      1. appropriate policies and technological controls designed to prevent loss of Covered Data; and 
      2. a disaster recovery/business continuity plan that addresses ongoing access, maintenance and storage of Covered Data as well as security needs for back-up sites and alternate communication networks.
   3. Policies and procedures to limit access to Covered Data to those who require such access to perform their roles and responsibilities in connection with the Terms of Service, including regular updates to such access based on changes to Processor’s personnel, policies or procedures.
   4. Procedures to verify all access rights through effective authentication methods.
   5. A government agency data access policy that reasonably challenges government access to data, except where such access is required by law, or where there is imminent risk of serious harm to individuals.
   6. Policies and procedures for assessing legal basis for, and responding to, government agency requests for data.
   7. Specific training of personnel responsible for managing government agency requests for access to data, which may include requirements under applicable Data Protection Laws.
   8. Processes to document and record government agency requests for data, the response provided, and the government authorities involved.
   9. Procedures to notify Controller about any relevant request or requirement for government agency access to Controller’s data, unless legally prohibited.
2. Physical Security Measures.
   
   1. Processor has implemented, and will contractually ensure that its hosting providers maintain and update as appropriate throughout its processing of Covered Data, appropriate physical security measures for any facility used to process Covered Data and continually monitor any changes to the physical infrastructure, business, and known threats.
3. Technical Security Measures. Processor shall throughout its processing of Covered Data: 
   
   1. perform vulnerability scanning and assessments on applications and infrastructure used to process Covered Data.
   2. secure its computer networks using multiple layers of access controls to protect against unauthorized access.
   3. restrict access through mechanisms such as, but not limited to, management approvals, robust controls, logging, and monitoring access events and subsequent audits.
   4. identify computer systems and applications that warrant security event monitoring and logging, and reasonably maintain and analyze log files.
   5. use up-to-date, industry standard, commercial virus/malware scanning software that identifies malicious code on all of its systems that process Covered Data.
   6. encrypt Covered Data in transit.
   7. encrypt Covered Data at rest where supported by the applicable systems and uses reasonable and appropriate measures to protect encryption keys and restrict access to encryption keys based on least privilege and applicable service requirements.

‍

ANNEX III

LIST OF SUB-PROCESSORS

Customer authorizes VIDA to engage the subprocessors listed in VIDA’s then-current Subprocessor List, available at: List of Subprocessors. The Subprocessor List is incorporated into this Addendum by reference and may be updated in accordance with Section 4.5 of this Addendum.

‍

Appendix B: IDTA Addendum