This Data Processing Agreement ("DPA") is between Dyva, Inc. ("Processor," "Dyva," "we") and you ("Controller," "you") -- the entity using Dyva's services, including API access (the "Principal Agreement"). This DPA applies whenever Dyva processes Personal Data on your behalf.
This is a legally binding data processing agreement that satisfies the requirements of GDPR Article 28, the UK GDPR, the Swiss Federal Act on Data Protection, and other applicable data protection laws. We wrote it in plain language because clarity is more important than sounding like a law textbook. The obligations are real regardless.
These terms have specific meanings in this DPA. Capitalized terms not defined here have the meanings assigned in the Principal Agreement or the GDPR.
2.1 Subject Matter. Dyva processes Personal Data to provide the services described in the Principal Agreement -- AI conversations, character interactions, voice processing, memory and knowledge base features, analytics, and related platform functionality.
2.2 Duration. Processing continues for the duration of the Principal Agreement, plus whatever additional time is needed to complete data return or deletion under Section 10 of this DPA.
2.3 Nature and Purpose. We collect, store, retrieve, process, analyze, transmit, and delete Personal Data as necessary to operate the Dyva platform on your behalf. This includes generating AI responses, maintaining conversation memory, processing voice input/output, providing analytics, and supporting the features you have enabled.
2.4 Categories of Data Subjects. End users of your Client Application, website, or service who interact with Dyva-powered features.
2.5 Types of Personal Data. The specific data depends on which features you use, but may include:
Dyva commits to the following. These are not aspirational -- they are binding obligations:
Your responsibilities as the Controller:
Dyva implements the following technical and organizational measures to protect Personal Data. These measures are proportionate to the risk and are subject to continuous improvement:
6.1 Authorized Sub-processors. By accepting this DPA, you authorize Dyva to use the following Sub-processors. We are transparent about who touches your data:
6.2 Changes to Sub-processors. We will notify you at least 14 days before adding or replacing a Sub-processor, via email to the address associated with your account. If you object on reasonable data protection grounds, we will work with you in good faith to address the concern. If we cannot resolve it, you may terminate the affected portion of the Service without penalty.
6.3 Sub-processor Obligations. Every Sub-processor is bound by a written agreement imposing data protection obligations at least as protective as those in this DPA. We do not hand off your data without equivalent safeguards. Dyva remains fully liable for each Sub-processor's compliance with the obligations under this DPA.
7.1 Right to Audit. You have the right to audit our compliance with this DPA. You may conduct one audit per calendar year with at least 30 days' written notice. Audits must be conducted during normal business hours, subject to reasonable confidentiality requirements, and must not unreasonably disrupt our operations or compromise the security of other customers' data.
7.2 Audit Scope. Audits may cover: (a) our technical and organizational security measures; (b) our Sub-processor management; (c) our data processing activities under this DPA; and (d) our compliance with your documented instructions.
7.3 Alternative Evidence. In lieu of an on-site audit, Dyva may provide: (a) relevant security certifications or third-party audit reports (e.g., SOC 2 Type II, when available); (b) results of penetration testing; or (c) detailed written responses to your reasonable audit questions. We prefer this approach because it is faster, less disruptive, and gives you the same assurance.
7.4 Cost. Each party bears its own costs for audits. If you require an on-site audit beyond one per year, you will reimburse Dyva's reasonable costs for facilitating it.
8.1 Notification Timeline. We will notify you of a Data Breach affecting Personal Data processed under this DPA within 72 hours of becoming aware of it. No delays, no excuses. If we cannot provide full details within 72 hours, we will provide what we have and supplement it as more information becomes available.
8.2 Notification Content. Our breach notification will include, to the extent available at the time:
8.3 Cooperation. We will cooperate fully with your breach investigation and response efforts. This includes: (a) providing additional information as it becomes available; (b) taking commercially reasonable steps to contain and remediate the breach; (c) preserving relevant evidence; and (d) assisting with notifications to supervisory authorities and Data Subjects where required.
8.4 What Is Not a Breach. For clarity, unsuccessful security incidents (blocked attacks, failed login attempts, port scans) that do not result in unauthorized access to Personal Data are not Data Breaches under this DPA.
9.1 Dyva's Location. Dyva is based in the United States. Personal Data processed under this DPA is stored and processed primarily in the United States.
9.2 Transfer Mechanisms. When Personal Data originating from the European Economic Area (EEA), United Kingdom, or Switzerland is transferred to the United States, we rely on:
By accepting this DPA, you execute the Standard Contractual Clauses with Dyva as the data importer and you as the data exporter. The details in Sections 1 and 2 of this DPA serve as the Annex I information required by the SCCs.
9.3 UK and Swiss Transfers. For UK transfers, the SCCs apply as amended by the UK International Data Transfer Addendum. For Swiss transfers, the SCCs apply as adapted for the Swiss Federal Act on Data Protection. References to GDPR are read as references to the applicable local law.
9.4 Supplementary Measures. In addition to the SCCs, Dyva implements the technical security measures described in Section 5 as supplementary measures to ensure an adequate level of data protection for transferred data.
10.1 Your Options. When the Principal Agreement ends, you have 30 days to request either: (a) return of all Personal Data in a commonly used, machine-readable format (JSON, CSV, or equivalent); or (b) secure deletion of all Personal Data with written confirmation.
10.2 Default Action. If you do not make a request within 30 days, we will securely delete all Personal Data. We will confirm deletion in writing.
10.3 Legal Retention. We may retain Personal Data only to the extent required by applicable law (tax records, legal holds, regulatory requirements). Any retained data remains subject to the confidentiality and security obligations of this DPA until it is deleted.
10.4 Sub-processor Data. We will ensure that all Sub-processors delete or return Personal Data in accordance with this section.
11.1 Liability Cap. Each party's total aggregate liability under this DPA is subject to the liability limitations and exclusions set forth in the Principal Agreement.
11.2 Data Subject Rights. Nothing in this DPA limits either party's liability to Data Subjects under applicable data protection law. GDPR fines and Data Subject compensation claims are not subject to contractual liability caps where prohibited by law.
11.3 Indemnification. Each party will indemnify the other for damages arising from its breach of this DPA, to the extent such damages are not excluded by the liability limitations in the Principal Agreement.
This DPA is governed by the laws specified in the Principal Agreement. Exception: where data protection law requires otherwise (for example, GDPR-related claims are governed by the law of the applicable EU/EEA Member State, and UK GDPR claims by English law). For the Standard Contractual Clauses, the governing law is as specified in the SCCs themselves.
Data protection inquiries: [email protected]
Legal matters: [email protected]
Security incidents: [email protected]
For Data Subject access requests or deletion requests submitted by your end users, contact us at [email protected] with the subject line "DSAR" and we will respond within 5 business days.
Helpful?