Data processing agreement

Scope and roles

This data processing agreement (DPA) is part of the agreement between Liberrex Tunisia S.A ("Liberrex") and the customer that uses Liberrex AI & Agents (the "Customer"). It applies to the personal data Liberrex processes on behalf of the Customer: its contacts, the messages, calls, recordings, transcripts, meetings and documents its agents handle, and the people who use its workspace.

For that data the Customer is the controller and Liberrex the processor, under Tunisian law n° 2004-63 and, where it applies, the EU General Data Protection Regulation (GDPR, article 28). For account and billing data Liberrex is the controller, as described in the privacy policy.

Processing on instructions

Liberrex processes Customer personal data only to provide the service, as described in the Terms of service, and as the Customer configures it in its workspace (agents, channels, retention, knowledge, integrations). These are the Customer's documented instructions. Liberrex tells the Customer if it believes an instruction breaks data protection law.

Liberrex does not sell Customer personal data and does not use it to train models shared with other customers.

Confidentiality

People at Liberrex who can access Customer personal data are bound by confidentiality and access it only when needed to run, support or secure the service.

Security measures

Liberrex keeps technical and organisational measures appropriate to the risk, including:

• encryption of data in transit (TLS) and of stored secrets and credentials;
• separation of each customer's data, and access limited by roles;
• two-step verification for staff and, when the Customer requires it, for its users; audit logs of sensitive actions;
• signed webhooks and protection against requests to internal networks;
• daily backups and tested restores; monitoring and error tracking without message content.

Sub-processors

The Customer authorises Liberrex to use the sub-processors in the list of sub-processors. Liberrex binds each one by a written contract with data protection obligations at least as protective as this DPA and remains responsible for them.

Liberrex announces a new sub-processor at least 30 days in advance on that page and by e-mail to workspace owners. The Customer can object for reasonable data protection reasons at privacy@liberrex.com; if no solution is found, it can end the affected service.

International transfers

When a sub-processor processes Customer personal data outside Tunisia or, for GDPR data, outside the European Economic Area, Liberrex puts in place the safeguards the law requires (for example the European Commission's standard contractual clauses, or an authorisation of the Tunisian data protection authority, INPDP, where needed).

Help with the rights of individuals

The workspace lets the Customer find, export, correct and erase a contact's data and conversations, and export all its organisation's data. When it cannot do so itself, Liberrex helps within 30 days of a request. Requests Liberrex receives directly from an individual are passed on to the Customer.

Personal data breaches

Liberrex informs the Customer without undue delay, and at the latest within 72 hours of becoming aware of it, of a personal data breach affecting Customer personal data, with what is known of its nature, the data and people concerned, its likely consequences and the measures taken. Liberrex helps the Customer meet its own notification duties.

Impact assessments and audits

Liberrex provides the information the Customer reasonably needs for its data protection impact assessments and to show compliance with this DPA.

The Customer, or an independent auditor bound by confidentiality, can audit compliance once a year with 30 days' notice, at its own cost, during business hours and without access to other customers' data.

End of the service

Before the end of the service the Customer can export its organisation's data from its workspace. After the end, Liberrex deletes Customer personal data within 30 days, including from its sub-processors, except where the law requires it to keep some (for example invoices). Backups are overwritten in their normal cycle.

The Customer's responsibilities

The Customer makes sure it may lawfully have its data processed, informs the people it contacts (including that they speak with an AI agent and, where calls are recorded, that they may be recorded) and obtains any consent required, for example to clone a voice.

Contact

Questions about this DPA and data protection requests: privacy@liberrex.com. This DPA follows the governing law and disputes clause of the Terms of service; if it conflicts with them on personal data, this DPA prevails.