Data processing agreement

This Data Processing Agreement ("DPA") is part of the Terms of service between Lamento Trading LLC, #4B, 15th Street, Umm Ramool, Dubai, UAE ("we", the "processor") and the business using Rayloops ("you", the "controller"). It applies whenever we process personal data of your customers, callers or website visitors for you. It follows the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies, the EU GDPR (Article 28).

1. What we process and why

• Data subjects: people who call, chat with or message your business, visit your website while the Rayloops button is on it, or appear in orders from a store you connect (for example Shopify or WooCommerce).
• Personal data: phone numbers, names and contact details people give, call recordings and transcripts, chat messages and files, order details needed to answer about an order (order number, status, items, totals, delivery, the phone or email on the order), and the page and device data described in our Privacy policy. We do not ask for special-category data.
• Purpose: only to provide Rayloops to you: answering and routing calls and chats, looking up orders and products, showing conversations to your team, and the reports you use.
• Duration: while your account is active, then as set out in section 8.

2. Your instructions

We process the data only on your documented instructions, which are these terms and the settings you choose in your dashboard, unless the law requires otherwise (in which case we tell you first, unless the law forbids it). We tell you if we think an instruction breaks data protection law. We do not sell the data or use it for advertising.

3. Confidentiality

Only staff who need the data to run or support the service can reach it, and they are bound by confidentiality.

4. Security

• encryption in transit (TLS) and at rest (encrypted server disks and backups);
• daily encrypted backups, kept for 7 days;
• each business's data kept separate, with every query limited to that business;
• role-based access with per-area permissions, strong passwords and two-step sign-in;
• a tamper-evident activity log of changes and of sensitive reads (recordings, exports and downloads);
• a written incident response procedure.

5. Sub-processors

You allow us to use sub-processors for hosting, telephony, speech recognition and voice, AI language processing, messaging (such as WhatsApp), email and payments. Each is bound by a written contract with data protection terms at least as protective as this DPA. We will tell you before adding or replacing a sub-processor, and you may object on reasonable data protection grounds. We remain responsible for our sub-processors.

6. Transfers

Our servers are in the European Union and some sub-processors process data in other countries. Where data leaves the UAE or the EU we rely on the safeguards the law allows, such as standard contractual clauses.

7. Helping you

• People's requests: we help you answer requests to see, correct, delete or receive personal data. You can delete calls and conversations from your dashboard.
• Breaches: we tell you without undue delay, and within 72 hours, after becoming aware of a breach affecting your data, with what we know and what we are doing, and help you meet your own obligations.
• Assessments: we give you reasonable information for your data protection impact assessments.

8. When the service ends

When your account closes we delete the personal data we process for you within 90 days, or return it if you ask before then, unless the law requires us to keep it (for example billing records).

9. Information and audits

We make available the information needed to show we meet this DPA, and answer reasonable security questionnaires. Contact hello@rayloops.com.

10. Order of terms

If this DPA and the Terms of service conflict on personal data, this DPA wins. Liability follows the Terms of service.