This Data Processing Addendum ("DPA") forms part of the Master Services Agreement (the "Agreement") between Faroflow AI Ltd., a company incorporated in Israel (Company registration no. 517343885) ("Processor" or "Faroflow AI"), and the customer identified in an applicable Order Form ("Controller" or "Customer"). Where no Master Services Agreement has been executed, this DPA forms part of the Customer Terms of Use.
1. Subject Matter and Duration
- This DPA governs Faroflow AI's processing of personal data on behalf of the Customer.
- Processing will last for the duration of the Agreement, unless otherwise required by law.
2. Roles of the Parties
- Customer is the Controller of personal data.
- Faroflow AI is the Processor that processes personal data only on documented instructions from Customer.
3. Nature and Purpose of Processing
Faroflow AI processes personal data solely to provide the services described in the Agreement, including:
- Enabling AI-powered customer interactions
- Hosting conversation logs as configured by the Customer
- Providing analytics, billing, and support
Faroflow AI does not:
- Sell personal data
- Use personal data for independent purposes
- Collect media uploads or sensitive data unless explicitly provided by Customer
4. Types of Data and Data Subjects
- Data subjects: End users of Customer (e.g. individuals interacting with Customer's AI agent).
- Types of data: Text interactions and business contact details; no biometric, payment card, or health data unless Customer chooses to input such data.
5. Processor Obligations
Faroflow AI shall:
- Process personal data only on documented instructions from Customer.
- Implement appropriate technical and organizational measures to protect data.
- Ensure staff are bound by confidentiality.
- Assist Customer in responding to data subject rights requests (access, correction, deletion, etc.).
- Notify Customer without undue delay of any personal data breach.
- Make available information needed to demonstrate compliance (including audits, subject to reasonable notice).
6. Sub-Processors
- Customer authorizes Faroflow AI to engage sub-processors to deliver the Service.
- Faroflow AI will maintain a public list of sub-processors at www.faroflow.com/legal/subprocessors and notify Customer of material changes.
- Faroflow AI ensures sub-processors are bound by written agreements providing equivalent protections.
7. International Transfers and Remote Access
- Hosting. The Services are hosted on infrastructure located in the European Union and the United States, as set out in our Sub-Processors list.
- Remote access from Israel. Faroflow AI Ltd. is established in Israel. Our personnel in Israel access personal data remotely in order to operate, support and maintain the Services. Personal data is not copied to or stored in Israel. Our personnel are our own employees acting under our instructions and bound by confidentiality; they are not sub-processors.
- Basis for EEA and UK transfers to Israel. Israel benefits from a European Commission adequacy decision, and from the corresponding UK adequacy regulations. Transfers of personal data from the EEA or the UK to Faroflow AI Ltd. in Israel are made on the basis of those adequacy decisions, and no Standard Contractual Clauses are required.
- Transfers to sub-processors. Transfers to sub-processors located outside the EEA or the UK (for example in the United States) are safeguarded by Standard Contractual Clauses, the UK Addendum, or an equivalent mechanism under applicable law.
- Fallback. If an adequacy decision relied on above ceases to apply, the parties shall without undue delay put in place Standard Contractual Clauses or another lawful transfer mechanism.
8. Customer Responsibilities
Important Customer Obligations:
- Customer is responsible for ensuring lawful collection of personal data and providing required notices to end users.
- Customer must not transmit special categories of data (health, biometric, etc.) unless explicitly agreed in writing.
9. Return or Deletion of Data
Upon termination of the Agreement, Faroflow AI will delete or return Customer personal data within a reasonable period, unless retention is required by law.
10. Governing Law and Jurisdiction
- This DPA is governed by the laws of the State of Israel.
- Disputes shall be subject to the exclusive jurisdiction of the competent courts of Tel Aviv-Jaffa, Israel.