These terms apply where Cognivo FZ LLC processes personal data on behalf of a business customer ("Customer") in providing Epicurus Pro, and form part of the Terms and conditions. They are intended to meet Article 28 of the UK GDPR.
1. Roles
The Customer is the controller and we are the processor of personal data in content the Customer and its users put into or connect to the Service.
2. Instructions
We process personal data only on the Customer's documented instructions, including as set out in these terms and through use of the Service, unless the law requires otherwise.
3. Confidentiality and security
Our staff are bound by confidentiality. We maintain appropriate technical and organisational measures, including encryption in transit, access controls, two-factor authentication, audit logging and UK hosting.
4. Sub-processors
The Customer authorises our current sub-processors: DigitalOcean (hosting, UK), OpenAI (AI processing), Twilio (telephony and messaging), Stripe (payments), Brevo (email delivery), Cloudflare (network security) and integration providers the Customer chooses to connect. We will give notice of new sub-processors, and the Customer may object on reasonable grounds.
5. Assistance
We will help the Customer respond to data subject requests, and with security, breach notification, impact assessments and consultations, taking into account the nature of processing.
6. Personal data breaches
We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer data.
7. Transfers
Where personal data is transferred outside the UK, we will ensure appropriate safeguards are in place.
8. Deletion and return
On termination, the Customer can export its data for 30 days. We then delete Customer personal data, unless the law requires us to keep it.
9. Audits
We will make available information reasonably needed to demonstrate compliance with these terms, and allow for reasonable audits on notice.
10. Details of processing
Subject matter and duration: provision of the Service for the term of the agreement. Nature and purpose: hosting, syncing, AI processing, telephony and messaging on the Customer's instructions. Data subjects: Customer users, their contacts, correspondents and call participants. Categories: contact details, communications content, call recordings and transcripts, calendar data and usage data.