Data Processing Agreement

Last updated: October 26, 2026

This Data Processing Agreement (“DPA”) forms an integral part of the agreement between SYNTRANOVA AL LTD, registration no. HE 485824, Nikis 1, Anthoupoli, 2350 Nicosia, Cyprus (“Ravoqen”, “Processor”) and the business customer (“Customer”, “Controller”) under the Terms of Service, wherever Ravoqen processes personal data on the Customer’s behalf. It is accepted together with the Terms and applies before any such processing begins. It implements Article 28 of Regulation (EU) 2016/679 (“GDPR”).

1. Subject matter and duration

Ravoqen processes Customer Data to provide the Service described in the Terms, for the duration of the agreement and until deletion or return under section 11.

2. Nature and purpose of processing

Receiving, answering and transcribing calls and messages; generating AI responses and summaries; booking and managing appointments; capturing leads; storing conversations, recordings and knowledge-base content; sending notifications; outbound calls and messages initiated by the Customer; reporting; support and security of the Service.

3. Categories of data subjects and personal data

Data subjects: the Customer’s callers, leads, prospects, clients, guests, patients where applicable, other end customers, and the Customer’s staff mentioned in the configuration.
Personal data: names, phone numbers, email addresses, voice recordings, call and chat transcripts, message content, appointment and booking details, conversation metadata (time, duration, channel, outcome), and any information included in knowledge-base content.
Special categories: not intended. Processed only where expressly agreed in writing and where the Customer has an applicable lawful basis under Article 6 GDPR and a valid condition under Article 9(2) GDPR; the Customer remains responsible for that assessment.

4. Customer instructions

Ravoqen processes Customer Data only on the Customer’s documented instructions, which consist of the agreement, this DPA, the configuration of the Service and written instructions given by the Customer, including with regard to transfers to third countries, unless EU or Member State law requires otherwise; in that case Ravoqen informs the Customer before processing unless the law prohibits it. Ravoqen informs the Customer if, in its opinion, an instruction infringes data protection law.

5. Confidentiality

Ravoqen ensures that persons authorised to process Customer Data are bound by confidentiality obligations and access the data only as needed to provide the Service.

6. Security

Ravoqen implements appropriate technical and organisational measures under Article 32 GDPR, including: TLS 1.2/1.3 encryption in transit; access restricted to authorised personnel with logging; encrypted storage of integration credentials; daily encrypted off-site backups in the EU; separation of each customer’s data in the application; monitoring and security patching. The Customer is responsible for the security of its accounts and for configuring the Service appropriately.

7. Subprocessors

The Customer gives Ravoqen general written authorisation to engage subprocessors. The Customer authorises the subprocessors listed in the subprocessor register at the time this DPA becomes effective.
The register (identity, address, function, location and transfer mechanism of each subprocessor) is available to the Customer at all times in the dashboard under Legal & Compliance → Subprocessors. It is confidential business information as set out in section 14 of the Terms, without limiting any disclosure required by law, regulators or data-subject rights.
Ravoqen gives the Customer at least 30 days’ advance written notice of any new or replacement subprocessor, by email to the account owner and in the dashboard, identifying the proposed subprocessor and describing the relevant processing. Ravoqen keeps a record of each notice.
The Customer may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if Ravoqen cannot offer a reasonable alternative, the Customer may terminate the affected part of the Service, with a pro-rata refund of fees prepaid for the period after termination.
Ravoqen imposes data protection obligations on each subprocessor that are equivalent in substance to this DPA and remains liable to the Customer for the subprocessor’s performance.

8. Assistance with data-subject requests

Taking into account the nature of the processing, Ravoqen assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects. Ravoqen forwards to the Customer without undue delay any request it receives concerning Customer Data and does not respond to it itself, except on the Customer’s instruction.

9. Personal data breaches

Ravoqen notifies the Customer of a personal data breach affecting Customer Data without undue delay after becoming aware of it, and provides reasonable information and assistance necessary for the Customer to comply with Articles 33 and 34 GDPR, including the nature of the breach, likely consequences and measures taken or proposed.

10. DPIA and prior consultation

Ravoqen provides reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to Ravoqen.

11. Deletion or return

Upon termination or expiry of the Service, the Customer may export Customer Data during 30 days. Thereafter Ravoqen will delete or return Customer Data in accordance with the Customer’s documented instructions and this DPA, unless applicable law requires continued storage. Data is deleted from active systems after the export period; copies in encrypted backups are overwritten as backups expire, within at most 6 months. During the Service, call recordings and transcripts are deleted automatically after 12 months unless the Customer sets a shorter period.

12. Audits and information

Ravoqen makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by it, subject to reasonable advance notice (at least 30 days), confidentiality, and at the Customer’s cost, normally not more than once a year unless required by a supervisory authority or following a personal data breach.

13. International transfers

Customer Data is stored in the European Union. Where a subprocessor processes Customer Data outside the EEA, Ravoqen ensures an appropriate transfer mechanism under Chapter V GDPR, such as an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or the Standard Contractual Clauses, together with supplementary measures where needed. The mechanism for each subprocessor is shown in the subprocessor register.

14. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms, except where the law does not permit such limitation. In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails.

15. Governing law

This DPA is governed by the laws of the Republic of Cyprus.

Operator. Ravoqen is a brand operated by SYNTRANOVA AL LTD · Nikis 1, Anthoupoli, 2350 Nicosia, Cyprus · Company registration no. HE 485824 (Registrar of Companies, Cyprus) · VAT CY60296296V · contact@ravoqen.com