Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Crystal Vision Holdings LLC, a Florida limited liability company ("Processor") and the Customer ("Controller"). It governs Processor's processing of Personal Information on Controller's behalf.

1. Roles

For Personal Information of Callers and Customer's end users, Controller is the controller/business and Processor is the service provider/processor. Processor will process Personal Information only to provide the service and as instructed by Controller.

2. Scope of Processing

• Categories of data subjects: Controller's callers, end users, employees, and contacts
• Categories of personal information: name, phone number, email, voice recordings, transcripts, booking details, communication metadata
• Purpose: provide the AI receptionist service
• Duration: the term of the subscription

3. Subprocessors

Controller authorizes Processor to use the subprocessors listed at bookedsmarter.com/legal/subprocessors. Processor will give at least 30 days' notice before adding or replacing a subprocessor. Controller may object in writing within 15 days on reasonable data-protection grounds; if the parties cannot resolve the objection, Controller may terminate the affected portion of the service.

4. Security

Processor maintains administrative, technical, and physical safeguards designed to protect Personal Information, including:

• Encryption in transit (TLS 1.2+)
• An access-controlled managed database
• Role-based access control with least-privilege
• Audit logging of administrative actions
• Annual review of security controls
• Personnel security training

5. Breach Notification

Processor will notify Controller without undue delay and in any event within 72 hours of confirming a Personal Information breach affecting Controller's data. Notification will include the nature of the breach, categories and approximate number of records, likely consequences, and remediation measures.

6. Data Subject Rights

Processor will assist Controller in responding to data-subject requests (access, deletion, correction, opt-out of sale/share) by providing reasonable technical and organizational measures.

7. Audits

Once per 12-month period and at Controller's expense, Controller may request a SOC 2 Type II report or equivalent third-party audit summary covering Processor's security controls. On-site audits are not provided in v1.

8. Deletion

On termination, Processor will delete or return Customer Data within 60 days, except as required by law to retain.

9. Order of Precedence

In a conflict between this DPA and the Terms of Service regarding processing of Personal Information, this DPA controls.

10. Contact