Data Processing Agreement

Last updated: November 9, 2026

This Data Processing Agreement (DPA) forms part of the Terms of Service and the Terms of Sale. It applies when LVO L.L.C-FZ processes, on behalf of a customer, the personal data of the people who chat with that customer (its leads and contacts), in accordance with Article 28 of the GDPR. For customers subject to the California Consumer Privacy Act (CCPA/CPRA), this DPA also sets out the terms under which LVO L.L.C-FZ acts as a service provider.

1. Roles

• The customer is the data controller (or "business"): it determines why and how its leads' data is processed, and warrants that it has a lawful basis to do so.
• LVO L.L.C-FZ is the processor (or "service provider"): it processes this data solely to provide the service and on the customer's documented instructions (its configuration in the application). It does not sell the data, does not share it for cross-context behavioral advertising, and does not retain, use or disclose it for any purpose other than providing the service.

2. Nature and purpose of the processing

• Purpose: receiving and sending messages, AI reply generation, qualification, CRM, follow-ups, matching of booked appointments.
• Data subjects: the customer's leads and contacts on Instagram, WhatsApp, Messenger and TikTok.
• Data: messaging identifiers, usernames, phone numbers, content of messages and comments, notes, tags, appointments.
• Duration: for the duration of the subscription, then deletion within 90 days after the workspace is closed, unless the customer requests otherwise.

3. Commitments of LVO L.L.C-FZ

• process the data only on the customer's instructions;
• ensure the confidentiality of the personnel authorized to access it;
• implement appropriate security measures (access restricted per organization, encryption of connections and API keys, separation of each customer's data);
• assist the customer in responding to data subject requests and in meeting its security obligations;
• notify the customer of any data breach affecting it without undue delay, and no later than 72 hours after becoming aware of it;
• delete or return the data at the end of the contract, at the customer's choice;
• make available the information needed to demonstrate compliance with these commitments.

4. Sub-processors

The customer authorizes the use of the sub-processors listed in the Privacy Policy (hosting, database, email delivery, file storage, connection to the messaging platforms, AI providers OpenAI and Anthropic, used through Replaize's account). Any new sub-processor is announced to the customer, who may object by canceling its subscription.

5. Transfers

Transfers outside the European Union and the United Kingdom rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) or on an adequacy decision.

6. Contact

For any question or to obtain a signed copy of this agreement: contact@replaize.com.