Data processing (GDPR)

This annex to the terms of sale is the data processing agreement required by article 28 of the General Data Protection Regulation (GDPR). It applies when Kroov (EVA AI TECHNOLOGIES, 5 rue Ellenhard, 67000 Strasbourg, France) processes personal data on behalf of the customer, as controller, as part of the service. It takes effect with the contract and lasts as long as it does, then until the data is erased.

• Support assistant (Nina): receiving, sorting, AI analysis of and replies to messages from the customer's own customers (email, WhatsApp, Gmail, Outlook, Google reviews). Data subjects: the customer's customers and prospects. Data: name, email address, phone number, messages, attachments, replies.
• Phone assistant (Sam): calls made at the customer's request, voice conversation processed in real time by AI, transcript and summary. Data subjects: the people called. Data: name and number, content of the conversation, transcript, summary, request not to be called again. Audio is not recorded.
• Content, knowledge bases and memory: storage, indexing and use by the assistants of the documents and information the customer places there, which may contain data about its contacts.
• Publishing and integrations: sending content and messages to the accounts the customer connects.

The customer refrains from entrusting sensitive data (health, opinions, criminal offence data…) unless necessary and on an appropriate legal basis.

Kroov:

• processes the data only on the customer's documented instructions, which are the contract, the workspace settings and the requests made in the application; it informs the customer if an instruction seems to infringe the GDPR;
• ensures that persons authorised to process the data are bound by confidentiality;
• implements the security measures described below;
• assists the customer, as far as possible, in answering data subject requests, ensuring security, notifying breaches and carrying out an impact assessment;
• notifies the customer of any personal data breach concerning it as soon as possible, and no later than 48 hours after becoming aware of it, with the information available;
• at the end of the contract, or when the workspace is deleted, erases the data (the customer may export it beforehand), unless the law requires it to be kept; backups are deleted on rotation within 14 days;
• makes available to the customer the information needed to demonstrate compliance, and allows audits, at most once a year with 30 days' notice, at the customer's expense, by an auditor bound by confidentiality.

The customer authorises Kroov to use the sub-processors whose up-to-date list, with the service provided, the country and the safeguard covering each transfer, is available in the app (Settings › Security & data, "Sub-processors" section) and sent on request at support@kroov.ai. Kroov informs the customer of any addition or replacement at least 30 days in advance; the customer may object on legitimate grounds and, failing agreement, terminate without charge. Kroov imposes equivalent data protection obligations on each and remains liable to the customer.

When a sub-processor processes data outside the European Union, the transfer relies on an adequacy decision (EU–US Data Privacy Framework for certified companies) or on the European Commission's standard contractual clauses.

The customer:

• has a legal basis for each processing it entrusts to Kroov, and informs the data subjects, in particular its customers about the use of an AI support assistant;
• only calls, through the phone assistant, people it is entitled to contact, does no automated canvassing, and honours objection requests;
• sets the retention period of transcripts and files according to its needs;
• tells Kroov without delay about any data subject request that requires its help.

• Hosting in the European Union, encrypted traffic (HTTPS).
• Access tokens of connected accounts encrypted (AES-256-GCM), keys in a secret manager.
• Access control on every request, according to workspace membership, role and data visibility.
• Audit log of sensitive actions, kept for 13 months.
• Files in private storage, served through temporary links.
• Rate limiting, signature checks on incoming notifications.
• No audio recording of calls; adjustable retention periods and automatic purges.
• Encrypted database backups, deleted on rotation.