Calling and Data Processing Agreement

The purpose of this Agreement is to set each party's role regarding the personal data of End Users processed through the Services, what the Customer warrants before calling, what Ryvo does as Processor, and who answers to third parties and authorities.

Capitalized terms not defined here have the meaning given in the Terms of Service and the Privacy Notice.

"Call"

Any voice conversation, inbound or outbound, over the telephone network, WhatsApp or the web widget, that a Customer's Voice Agent holds with an End User through the Services.

"End User"

The individual on the other side of the Call: a lead, a prospect, a customer of the Customer, a debtor, a patient or any third party.

"End User Data"

The personal data processed in or about a Call: phone number, name, voice, recording, transcript, outcome, variables the Customer uploads and anything the person says.

"Recording"

The audio of a Call that Ryvo keeps when the Customer turns recording on for the agent, and its transcript.

"Customer's privacy notice"

The privacy notice the Customer makes available to its End Users under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) or the law that applies in the End User's country.

"Lists"

The phone numbers and contact data the Customer uploads to or connects with the Services so an agent calls them, through a campaign, the API, an integration or one at a time.

"Call Jurisdiction"

The country and, where relevant, the state of the End User's phone number. It decides which law governs the Call, not the Customer's country nor Ryvo's.

• The Customer is the Controller. It decides why to call, whom, with which script, with which data and what to do with the outcome. It holds the relationship with the End User, must have a legal basis to contact them and makes the Customer's privacy notice available to them.
• Ryvo is the Processor. Ryvo processes End User Data solely on the Customer's behalf and according to its documented instructions: each agent's configuration, the Lists, the scripts, the connected integrations and the recording and retention settings. Ryvo does not decide purposes nor use that data for its own purposes other than providing, securing and improving the Services as described in the Privacy Notice.
• Sub-processors. To provide the Services, Ryvo relies on telephony, transcription, speech synthesis, language model, storage and messaging providers. The current list, with country and purpose, is published in the Privacy Notice. The Customer authorizes those sub-processors and any Ryvo adds under the same guarantees.

By accepting this Agreement and, again, each time it connects a number, places a Call or launches a campaign, the Customer represents and warrants that:

• It has its own privacy notice and it covers the Calls. The Customer's privacy notice states, at least, that conversations may be handled by an artificial intelligence assistant, that voice may be recorded and transcribed, the purposes of processing, that data is shared with Ryvo and its sub-processors as processors, whether it is used for automated decisions or profiling, and how to exercise ARCO rights. It is published or available where the End User can find it.
• It has a legal basis to contact every person in its Lists. It obtained the data lawfully and for a purpose compatible with the Call: an existing commercial or contractual relationship, consent, a request from the person, or whatever basis the law of the Call Jurisdiction allows. It does not upload purchased, scraped or unverifiable lists.
• It honors opt-out registries. For advertising or promotional Calls in Mexico, it screens its Lists against Profeco's Public Registry to Avoid Advertising (REPEP) and, where applicable, Condusef's Public Registry of Users (REUS), and excludes anyone who asked not to be contacted. It applies the equivalent in any other Call Jurisdiction.
• It complies with the rules of the activity it automates. Permitted hours, caller identification, maximum contact frequency, mandatory content and prohibitions. In particular: collections are subject to Condusef's rules when managing credits of financial institutions and to the Federal Consumer Protection Law in every case; advertising, to the Federal Consumer Protection Law; health data and other sensitive data, to the express consent the LFPDPPP requires.
• It decides how the person is informed, according to the Call Jurisdiction. In Mexico the law does not require a prerecorded message at the start of the Call: a participant in a conversation may record it, and what the LFPDPPP requires is that the End User can access the privacy notice. The Customer configures in each agent whether the recording and the assistant are disclosed, when and in which words, and that is its decision and its responsibility. For numbers in other countries, the Customer complies with local law, including the all-party consent and artificial voice disclosure rules of the United States (TCPA and state laws). Ryvo may enable, per jurisdiction, the notices that local law makes mandatory, without that shifting to Ryvo the responsibility to comply with it.
• It does not process data of minors or sensitive data without the basis the law requires. If a Call reaches a minor or collects sensitive data without express consent, the Customer stops the processing and asks Ryvo to delete it as described in the Privacy Notice.
• It answers for the script and the agent's identity. The script is truthful, does not mislead about who is calling or why, does not impersonate any person or institution and does not infringe third-party rights.

• Processes only on instructions. Ryvo processes End User Data according to the configuration the Customer gives the Services and to this Agreement. If an instruction breaks the law, Ryvo tells the Customer and may refuse to carry it out.
• Keeps confidentiality. Ryvo staff access End User Data only when support or operations require it and under a confidentiality obligation that survives termination.
• Applies security measures. Encryption in transit and at rest, access control per account and per role, activity logging, separation between accounts and the other measures described in the Privacy Notice, proportional to the risk of the processing.
• Limits and oversees its sub-processors. Only under the guarantees of this Agreement and only to the extent needed to provide each part of the Service. Ryvo answers to the Customer for the processing a sub-processor performs on Ryvo's behalf.
• Cooperates with ARCO rights. If an End User exercises a right before the Customer, Ryvo gives the Customer, from the portal or on request, the information and means in its hands to handle it on time.
• Notifies breaches. If Ryvo becomes aware of a security breach affecting the Customer's End User Data, it notifies the Customer without undue delay with what it knows at that moment and cooperates in containment and in any notices the law requires.
• Retains and deletes as agreed. Recordings and transcripts are kept for the period that corresponds to the Customer's plan and settings, and at most for the period set in the Privacy Notice. When the account ends, Ryvo deletes or returns End User Data according to its retention policy, except what it must keep by legal obligation.

• The Customer turns it on, per agent. No agent records until the Customer decides so in its configuration. Recording is an instruction from the Controller.
• The notice belongs to the Customer. The Customer configures whether the agent discloses the recording, at which point of the conversation and in which words, according to clause 4 and the Call Jurisdiction.
• Ryvo stores it encrypted and scoped to the account. Only the Customer and authorized Ryvo staff can listen to it, for the period in clause 5. The Customer can delete a Recording from the portal or ask Ryvo to do so.
• The lawfulness of recording is the Customer's. Ryvo provides the tool and the configurable notices; that recording is lawful in each Call Jurisdiction and with each End User is warranted by the Customer.

Ryvo provides a technology tool. The Customer defines its use and assumes the corresponding legal responsibility. Therefore:

• The Customer is solely responsible for the lawfulness of its Lists, the legal basis to contact each End User, its privacy notice, the consents the law requires, the content of the script, the activity it automates and compliance with the law of each Call Jurisdiction.
• The Customer shall hold Ryvo, its partners, its staff and its sub-processors harmless from any claim, complaint, proceeding, penalty, fine, damage or expense, including reasonable legal fees, arising from a breach by the Customer of this Agreement or the law, or from a Call made with its account, including claims by End Users and by data protection, consumer protection, financial or telecommunications authorities.
• Ryvo's liability toward the Customer is governed by the limits in clause 11 of the Terms of Service. Nothing in this Agreement limits a liability the law does not allow to be limited.
• Ryvo is not responsible for the content of conversations, for the decisions the Customer makes based on them, nor for what an End User says or does during a Call.

Ryvo may suspend an account's Calls, in whole or in part and with notice to the Customer, when it receives a substantiated complaint from an End User or an authority, a request from a competent authority, signs of a prohibited use under clause 8 of the Terms of Service, or when the account's traffic puts at risk the network, other customers or Ryvo's relationship with its telephony providers. Suspension does not release the Customer from paying for what was already consumed. Termination of this Agreement follows that of the Terms of Service.

• How it is accepted. From the Ryvo portal, by ticking the box and pressing the acceptance button. Only the account owner or an account administrator can do so, and by doing so declares that they have authority to bind the company that holds the account.
• What is recorded. As evidence of acceptance, Ryvo keeps the accepted version, the date and time, the user who accepted, the IP address, the browser identifier and the language in which the document was viewed. That electronic acceptance has the value of consent and of a signature under the electronic commerce provisions of Mexico's Commercial Code.
• Versions. Each version of this Agreement carries a number and a date on this page. A new version must be accepted again before the account can keep connecting numbers or launching Calls and campaigns; meanwhile, agents already connected keep answering inbound calls.
• Relationship with the other documents. This Agreement supplements the Terms of Service and the Privacy Notice. In case of conflict regarding the processing of End User Data, this Agreement prevails.

Questions about this Agreement, cooperation requests to handle ARCO rights or breach notices: team@ryvo.so. LEADWAY CRM SOFTWARE BY LEVA, Monterrey, Nuevo León, Mexico.