Standard contractual clauses pursuant to Article 28(3) of Regulation 2016/679 (the General Data Protection Regulation) for the purposes of the data processor's processing of personal data. Clauses 1 to 15 follow the template of the Danish Data Protection Agency (Datatilsynet) unchanged. Annexes A to D are completed for Valiss' delivery of Valiss Manager, Valiss AI Copilot and AI phone.
Clause 1. The parties
| The data controller | The data processor |
|---|---|
| [Customer name] CVR [no.] [Address] Denmark | Trust Box ApS (Valiss) CVR 37588822 Lyngbyvej 83 A, 2100 Copenhagen Ø Denmark |
Each party is referred to as a "party" and together as the "parties". The parties HAVE AGREED on the following standard contractual clauses (the "Clauses") in order to meet the requirements of the GDPR and to ensure the protection of the rights of the data subject and the fundamental rights and freedoms of natural persons.
Clause 2. Preamble
2.1 These Clauses set out the rights and obligations of the data processor when processing personal data on behalf of the data controller.
2.2 These Clauses have been designed to ensure the parties' compliance with Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation).
2.3 In the context of the provision of Valiss Manager, Valiss AI Copilot and AI phone under the main agreement between the parties, the data processor processes personal data on behalf of the data controller in accordance with these Clauses.
2.4 The Clauses take precedence over any similar provisions in other agreements between the parties.
2.5 Four annexes are attached to these Clauses, and the annexes form an integral part of the Clauses.
2.6 Annex A contains details about the processing of personal data, including the purpose and nature of the processing, the type of personal data, the categories of data subjects and the duration of the processing.
2.7 Annex B contains the data controller's conditions for the data processor's use of sub-processors and a list of sub-processors authorised by the data controller.
2.8 Annex C contains the data controller's instructions with regard to the data processor's processing of personal data, the minimum security measures to be implemented by the data processor, and how audits of the data processor and any sub-processors are to be performed.
2.9 Annex D contains provisions on other activities that are not covered by the Clauses.
2.10 The Clauses, including the annexes, shall be kept in writing, including electronically, by both parties.
2.11 These Clauses do not relieve the data processor of obligations imposed on the data processor by the General Data Protection Regulation or any other legislation.
Clause 3. The rights and obligations of the data controller
3.1 The data controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR (see Article 24 of the GDPR), the applicable EU or Member State data protection provisions and these Clauses.
3.2 The data controller has the right and obligation to make decisions about the purposes and means of the processing of personal data.
3.3 The data controller is responsible, among other things, for ensuring that the processing of personal data that the data processor is instructed to perform has a legal basis.
Clause 4. The data processor acts according to instructions
4.1 The data processor shall process personal data only on documented instructions from the data controller, unless required to do so by EU or Member State law to which the data processor is subject. These instructions shall be specified in Annexes A and C. Subsequent instructions can also be given by the data controller throughout the duration of the processing of personal data, but such instructions shall always be documented and kept in writing, including electronically, in connection with the Clauses.
4.2 The data processor shall immediately inform the data controller if an instruction, in the data processor's opinion, infringes the GDPR or the applicable EU or Member State data protection provisions.
Clause 5. Confidentiality
5.1 The data processor shall only grant access to the personal data being processed on behalf of the data controller to persons under the data processor's authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and only on a need to know basis. The list of persons to whom access has been granted shall be kept under periodic review. On the basis of this review, access to personal data can be withdrawn if access is no longer necessary, and personal data shall consequently not be accessible anymore to those persons.
5.2 The data processor shall at the request of the data controller demonstrate that the persons under the data processor's authority are subject to the abovementioned confidentiality.
Clause 6. Security of processing
6.1 Article 32 of the GDPR stipulates that, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the data controller and data processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
The data controller shall evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. Depending on their relevance, the measures may include the following:
- pseudonymisation and encryption of personal data
- the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services
- the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
- a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
6.2 According to Article 32 of the GDPR, the data processor shall also, independently from the data controller, evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. To this effect, the data controller shall provide the data processor with all information necessary to identify and evaluate such risks.
6.3 Furthermore, the data processor shall assist the data controller in ensuring compliance with the data controller's obligations pursuant to Article 32 of the GDPR, by inter alia providing the data controller with information concerning the technical and organisational measures already implemented by the data processor pursuant to Article 32 of the GDPR along with all other information necessary for the data controller to comply with the data controller's obligation under Article 32 of the GDPR.
If subsequently, in the assessment of the data controller, mitigation of the identified risks requires further measures to be implemented by the data processor than those already implemented by the data processor pursuant to Article 32 of the GDPR, the data controller shall specify these additional measures to be implemented in Annex C.
Clause 7. Use of sub-processors
7.1 The data processor shall meet the requirements specified in Article 28(2) and (4) of the GDPR in order to engage another processor (a sub-processor).
7.2 The data processor shall therefore not engage another processor (sub-processor) for the fulfilment of these Clauses without the prior general written authorisation of the data controller.
7.3 The data processor has the data controller's general authorisation for the engagement of sub-processors. The data processor shall inform in writing the data controller of any intended changes concerning the addition or replacement of sub-processors with at least 30 days' notice, thereby giving the data controller the opportunity to object to such changes prior to the engagement of the concerned sub-processor(s). Longer time periods of prior notice for specific sub-processing services can be provided in Annex B. The list of sub-processors already authorised by the data controller can be found in Annex B.
7.4 Where the data processor engages a sub-processor for carrying out specific processing activities on behalf of the data controller, the same data protection obligations as set out in the Clauses shall be imposed on that sub-processor by way of a contract or other legal act under EU or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the Clauses and the GDPR.
The data processor shall therefore be responsible for requiring that the sub-processor at least complies with the obligations to which the data processor is subject pursuant to the Clauses and the GDPR.
7.5 A copy of such a sub-processor agreement and subsequent amendments shall, at the data controller's request, be submitted to the data controller, thereby giving the data controller the opportunity to ensure that the same data protection obligations as set out in the Clauses are imposed on the sub-processor. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement shall not require submission to the data controller.
7.6 If the sub-processor does not fulfil its data protection obligations, the data processor shall remain fully liable to the data controller as regards the fulfilment of the obligations of the sub-processor. This does not affect the rights of the data subjects under the GDPR, in particular those foreseen in Articles 79 and 82 of the GDPR, against the data controller and the data processor, including the sub-processor.
Clause 8. Transfer of data to third countries or international organisations
8.1 Any transfer of personal data to third countries or international organisations by the data processor shall only occur on the basis of documented instructions from the data controller and shall always take place in compliance with Chapter V of the GDPR.
8.2 In case transfers to third countries or international organisations, which the data processor has not been instructed to perform by the data controller, are required under EU or Member State law to which the data processor is subject, the data processor shall inform the data controller of that legal requirement prior to processing unless that law prohibits such information on important grounds of public interest.
8.3 Without documented instructions from the data controller, the data processor therefore cannot within the framework of the Clauses:
- transfer personal data to a data controller or a data processor in a third country or in an international organisation
- transfer the processing of personal data to a sub-processor in a third country
- have the personal data processed in a third country
8.4 The data controller's instructions regarding the transfer of personal data to a third country, including, if applicable, the transfer tool under Chapter V of the GDPR on which they are based, shall be set out in Annex C.6.
8.5 The Clauses shall not be confused with standard data protection clauses within the meaning of Article 46(2)(c) and (d) of the GDPR, and the Clauses cannot be relied upon by the parties as a transfer tool under Chapter V of the GDPR.
Clause 9. Assistance to the data controller
9.1 Taking into account the nature of the processing, the data processor shall assist the data controller by appropriate technical and organisational measures, insofar as this is possible, in the fulfilment of the data controller's obligations to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR.
This entails that the data processor shall, insofar as this is possible, assist the data controller in the data controller's compliance with:
- the right to be informed when collecting personal data from the data subject
- the right to be informed when personal data have not been obtained from the data subject
- the right of access by the data subject
- the right to rectification
- the right to erasure ("the right to be forgotten")
- the right to restriction of processing
- the notification obligation regarding rectification or erasure of personal data or restriction of processing
- the right to data portability
- the right to object
- the right not to be subject to a decision based solely on automated processing, including profiling
9.2 In addition to the data processor's obligation to assist the data controller pursuant to Clause 6.3, the data processor shall furthermore, taking into account the nature of the processing and the information available to the data processor, assist the data controller in ensuring compliance with:
- the data controller's obligation to without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority, the Danish Data Protection Agency (Datatilsynet), unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons
- the data controller's obligation to without undue delay communicate the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons
- the data controller's obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a data protection impact assessment) prior to the processing
- the data controller's obligation to consult the competent supervisory authority, Datatilsynet, prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the data controller to mitigate the risk.
9.3 The parties shall define in Annex C the appropriate technical and organisational measures by which the data processor is required to assist the data controller as well as the scope and the extent of the assistance required. This applies to the obligations foreseen in Clause 9.1 and 9.2.
Clause 10. Notification of personal data breach
10.1 In case of any personal data breach, the data processor shall, without undue delay after having become aware of it, notify the data controller of the personal data breach.
10.2 The data processor's notification to the data controller shall, if possible, take place within 24 hours after the data processor has become aware of the personal data breach, to enable the data controller to comply with the data controller's obligation to notify the personal data breach to the competent supervisory authority, cf. Article 33 of the GDPR.
10.3 In accordance with Clause 9.2(a), the data processor shall assist the data controller in notifying the personal data breach to the competent supervisory authority, meaning that the data processor is required to assist in obtaining the information listed below which, pursuant to Article 33(3) of the GDPR, shall be stated in the data controller's notification to the competent supervisory authority:
- the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned
- the likely consequences of the personal data breach
- the measures taken or proposed to be taken by the data controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
10.4 The parties shall define in Annex C all the elements to be provided by the data processor when assisting the data controller in the notification of a personal data breach to the competent supervisory authority.
Clause 11. Erasure and return of data
11.1 On termination of the provision of personal data processing services, the data processor shall be under obligation to return all the personal data to the data controller in a common, machine-readable format (the service's data export) and delete existing copies, unless EU or Member State law requires storage of the personal data.
The following EU or Member State law requires storage of the personal data after the termination of the provision of personal data processing services: the rules of the Danish Bookkeeping Act on retention of accounting records for five years, as regards invoices and payment information relating to the data controller's subscription. The data processor processes this information as an independent data controller, and it is not covered by these Clauses.
The data processor commits to exclusively process the personal data for the purposes and duration provided for by this law and under the strict applicable conditions.
Clause 12. Audit and inspection
12.1 The data processor shall make available to the data controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and the Clauses and allow for and contribute to audits, including inspections, conducted by the data controller or another auditor mandated by the data controller.
12.2 Procedures applicable to the data controller's audits, including inspections, of the data processor and sub-processors are specified in Annexes C.7 and C.8.
12.3 The data processor shall be required to provide the supervisory authorities, which pursuant to applicable legislation have access to the data controller's and data processor's facilities, or representatives acting on behalf of such supervisory authorities, with access to the data processor's physical facilities on presentation of appropriate identification.
Clause 13. The parties' agreement on other terms
13.1 The parties may agree other clauses concerning the provision of the personal data processing service specifying e.g. liability, as long as they do not contradict directly or indirectly the Clauses or prejudice the fundamental rights or freedoms of the data subject and the protection afforded by the GDPR. Such clauses are set out in Annex D.
Clause 14. Commencement and termination
14.1 The Clauses shall become effective on the date of both parties' signature.
14.2 Both parties shall be entitled to require the Clauses renegotiated if changes to the law or inexpediency of the Clauses should give rise to such renegotiation.
14.3 The Clauses shall apply for the duration of the provision of personal data processing services. For the duration of the provision of personal data processing services, the Clauses cannot be terminated unless other clauses governing the provision of personal data processing services have been agreed between the parties.
14.4 If the provision of personal data processing services is terminated, and the personal data is deleted or returned to the data controller pursuant to Clause 11.1 and Annex C.4, the Clauses may be terminated by written notice by either party.
Clause 15. Contact persons
15.1 The parties may contact each other using the following contact persons.
15.2 The parties shall be under obligation continuously to inform each other of changes to contact persons.
| The data controller | The data processor | |
|---|---|---|
| Name | [Name] | Kenneth Whitmore |
| Position | [Position] | Project lead, Valiss (privacy and security breaches) |
| Phone | [Phone] | +45 44 22 12 12 |
| [Email] | hello@valiss.co |
Annex A. Information about the processing
A.1 The purpose of the data processor's processing of personal data on behalf of the data controller
The purpose is to deliver the Services agreed in the main agreement. Depending on the main agreement, this includes: (a) if the Service includes AI phone, an AI assistant that answers calls to the data controller around the clock, recognises the caller against the data controller's lists if the Service includes list lookups, gives directions, sends links and information by SMS, transfers to the data controller's staff or on-call staff and sends alert SMS; (b) if the Service includes chat, a chat on the data controller's website that answers questions based on the knowledge the data controller has approved; (c) if the Service includes email, answering incoming email and sending messages from the Service; (d) if the Service includes Valiss AI Copilot, an internal assistant and a CRM assistant for the data controller's staff that answer from the same knowledge and can look up lists, conversations and summaries; and (e) Valiss Manager, where the data controller's staff see conversations, summaries, sentiment assessment, keywords and usage and manage knowledge, lists and users.
A.2 The data processor's processing of personal data on behalf of the data controller primarily concerns (the nature of the processing)
The processing consists of receiving phone calls, chat messages and emails, real-time processing of speech (speech to text and text to speech), transcription, lookups in the lists the data controller uploads, generation of answers with voice and language models in EU regions at the sub-processors listed in Annex B, sending SMS and email, transferring calls, recording and storing transcripts, summaries, sentiment assessment and keywords in Valiss Manager, display to the data controller's staff, and deletion under Annex C.4. The processing is automated. The data processor makes no decisions with legal effect for the data subjects and does not use the content for anything other than delivering the Service, including not for training AI models or marketing.
A.3 The processing includes the following types of personal data about the data subjects
Guests, customers and others who call, chat or write: phone number, name, email address, what the person says and writes (processed in real time and stored as transcript, chat log or email), what the assistant answers, sent SMS messages and emails (content, recipient, time), time and duration of calls, language, summary, sentiment assessment (positive, neutral, critical) and keywords derived from the conversation. If the Service includes list lookups: the fields the data controller's lists contain, typically arrival or booking date, departure date, unit or service, reservation or order number. If the Service includes disclosure of codes: information that a code has been sent, without the code itself beyond what is necessary. Audio from calls is not stored, cf. Annex C.4, unless the data controller instructs recording in writing.
The data controller's staff and on-call staff: name, work email, phone number, role and login details (password only as a hash) in Valiss Manager and Valiss AI Copilot; the questions staff ask Copilot, and the answers; the phone number of the on-call staff or emergency number that receives transfers and alert SMS.
Technical information: IP address and browser type in operational and security logs for website chat and Valiss Manager, timestamps, log of sent SMS messages and emails (recipient, category, status).
Special categories: not processed intentionally. If a data subject volunteers sensitive information in a conversation, it is processed solely as part of the conversation and deleted under Annex C.4. The data controller instructs its staff on what may be entered in Copilot and placed in lists.
A.4 The processing includes the following categories of data subjects
The data controller's guests, customers and users and other persons who contact the data controller by phone, chat or email, including persons enquiring on behalf of another person or a company. The data controller's staff and on-call staff. Persons mentioned in lists or in conversations (for example fellow travellers, relatives and employers).
A.5 The data processor's processing of personal data on behalf of the data controller may be performed when the Clauses commence. The processing has the following duration
The processing lasts for as long as the main agreement is in force, including during the setup and test period before Launch and for add-ons and test installations from the moment they are taken into use. On termination the data is handed over and deleted under Clause 11 and Annex C.4, no later than 30 days after termination.
Annex B. Sub-processors
B.0 The data chain at a glance
| Storage | Processing | Training | Encryption |
|---|---|---|---|
| Everything is stored in the EU. Databases, transcripts, lists, files and backups are located in data centres in the EU (Amsterdam, with backups under EU jurisdiction). Nothing is stored in the USA. | Speech and text are processed in the EU. Voice and all language model calls are processed in EU regions at the providers listed in B.1. Valiss' own SIP server and control layer run in the EU. | No training on the customer's data. Neither Valiss nor the sub-processors use conversations, lists or messages to train AI models. This is locked in the providers' API terms and in Clause 4 and Annex C.1. | AES-256 at rest, TLS in transit. All databases and backups are encrypted at rest with AES-256. All traffic in the chain is encrypted with TLS 1.2 or newer, and voice with SRTP. Passwords are stored only as salted hashes. |
The certifications in B.1 are the providers' own published information and may change. They do not replace the data processing agreement; the data processor verifies them annually under Annex C.8 and provides copies of the reports on request. The data processor's vendor process: EU first, agreement before data, least privilege, notice of changes.
B.1 Authorised sub-processors
On commencement of the Clauses, the data controller has authorised the use of the sub-processors below for the processing activity described. Trust Box ApS is the contracting party in all agreements with the sub-processors. The standard configuration is marked; for each customer the list is completed with the providers the customer's Service actually uses.
| Sub-processor | Country, registration and region | Role in the chain | When | Certifications |
|---|---|---|---|---|
| Railway Corp. | USA. All processing and storage in the EU region EU West (Amsterdam, the Netherlands) | Hosting of Valiss Manager, the Assistant's control layer, Valiss' own SIP server (LiveKit, self-hosted), the website chat and Copilot, including databases and daily backups. Railway's own platform operational logs (timestamps, status codes, error messages without personal data) may be processed in the USA. | Always | SOC 2 Type II, SOC 3 |
| Google Cloud EMEA Limited | Ireland. Region eu and europe-west | Speech-to-speech model for AI phone (real-time processing of voice and generation of answers), transcription of conversations, and language models for summary, sentiment assessment, keywords, chat and Copilot (Gemini via Vertex AI). No training on the content and no retention of the content at Google after the answer has been delivered. | Standard for voice and language models | ISO 27001, ISO 27017/18, ISO 27701, ISO 42001, SOC 1/2/3 |
| Cloudflare, Inc. | USA. Storage exclusively in the EU (R2 with EU jurisdiction) | Storage of encrypted backups of the databases (R2, AES-256, data does not leave the EU) as well as DNS and CDN for the Service's domains. Processes the content of the backups in encrypted form and technical connection data (IP address, timestamp) on lookups of the domains. | Always | ISO 27001, ISO 27701, SOC 2 Type II, PCI DSS |
| Twilio Inc. (incl. Twilio SendGrid) | USA. Transfer under SCC | SMS gateway: sending alert SMS and SMS with links, confirmations and resent information. Processes the recipient number and SMS content during sending; the content is not stored at Twilio beyond the delivery log. Email (SendGrid): sending emails from the Service (recipient address, subject and content during sending). | If the Service sends SMS or email | ISO 27001, ISO 27017/18, SOC 2 Type II, PCI DSS |
| FlyNumber | USA. Transfer under SCC | Telecom provider: the Danish phone number that is called, and the SIP trunk that carries the call from the telephone network to Valiss' own SIP server in the EU. Processes the calling number, the called number and call metadata (time, duration); the audio passes in transit and is not stored. Signalling and audio between FlyNumber and Valiss' SIP server are encrypted (SIP over TLS and SRTP). | If the Service includes AI phone | No published certification |
The data processor may not, without the data controller's written authorisation, use a sub-processor for a processing activity other than the one described and agreed, or use another sub-processor for this processing activity. Providers the data processor uses for other customers, including OpenAI, Anthropic, xAI, Mistral AI, ElevenLabs, Cartesia and Telnyx, are not used for the data controller unless they appear in this list or have been notified and authorised under B.2. If the Service includes Valiss AI Copilot, Copilot runs with the "Keep me in the EU" setting switched on, and it may not be switched off without a written instruction and notice under B.2. The full list of providers the data processor uses, with country, transfer mechanism and certifications, is maintained in the Trust Center.
B.2 Prior notice for the authorisation of sub-processors
The data processor notifies the data controller in writing (to the contact person's email) at least 30 days before a new sub-processor is taken into use or an existing one is replaced. If the data controller does not object within the period, the change is deemed authorised. If the data controller makes a reasoned objection, and the parties cannot find a solution, the data controller may terminate the main agreement with 1 month's notice without paying for the remaining contract term. The list in force at any time is provided on request and maintained by the data processor.
The data processor already now informs that the voice and language model provider may at a later time be supplemented or replaced with another provider if this gives better quality or lower response time for the data controller's users. Such a change is notified under this provision, takes place only with EU data residency or a valid transfer mechanism under Annex C.6, and only with API terms that exclude training on the content.
Annex C. Instruction pertaining to the processing of personal data
C.1 The subject of and instruction for the processing
The data processor's processing of personal data on behalf of the data controller takes place by the data processor performing the following, to the extent the Service includes the channel or function in question:
- a) Receives calls to the cloud number, processes the caller's speech in real time, looks the person up in the lists the data controller has uploaded, and answers in the person's own language.
- b) Verifies the person against the list (for example name, phone number, date and unit) before information that requires verification is disclosed. Never discloses codes in chat or to unverified persons, cf. the code policy in C.2.
- c) Sends SMS with links, confirmations or resent information to the person's number, and alert SMS to the data controller's on-call staff. Transfers calls to the data controller's staff or on-call staff according to the rules the data controller has set.
- d) Stores transcript, summary, sentiment assessment and keywords for each conversation, chat and email in Valiss Manager and displays them to the data controller's staff according to their roles.
- e) Answers questions in the chat on the data controller's website and in email based on the knowledge the data controller has approved, and refers to the phone when asked for information that requires verification.
- f) Makes Valiss AI Copilot available to the data controller's staff, including lookups in lists, conversations and summaries, and stores staff conversations in the data controller's own installation.
- g) Sends emails from the Service (login, operational messages, summaries) and logs the sending without the content.
- h) Calculates usage (minutes, messages) and aggregated statistics for the data controller.
- i) Performs administrator actions the data controller requests in writing (create and block users, correct knowledge, export and delete data), and logs them.
- j) Deletes information under the deletion routine in C.4 and hands over and deletes everything on termination.
The data processor does not use the content for training AI models, for marketing or for any purpose other than delivering the Service, and ensures the same at the sub-processors through their API terms. In case of doubt as to whether an action is covered by the instruction, the data processor asks the data controller in writing before the action is performed.
C.2 Security of processing
The level of security shall reflect that the processing covers ordinary personal data about an ongoing number of guests, customers or users (phone numbers, names, contact and booking data and conversation content) and about a limited number of employees, and that the Service, if it includes this, can disclose information that gives access to the data controller's premises or accounts. The confidentiality of conversation content and the correct verification of persons before disclosure of such information are the two matters of greatest importance to the data subjects. There is no systematic processing of sensitive data. On this basis the parties have agreed a level of security that protects the confidentiality of the content at the level of the data controller's own systems ("high" for confidentiality and integrity, "normal" for availability).
The data processor shall hereafter be entitled and under obligation to make decisions about the technical and organisational security measures that are to be applied to create the necessary and agreed level of data security. The data processor shall however, in any event and at a minimum, implement the following measures that have been agreed with the data controller:
- Code policy. If the Service includes disclosure of access codes or similar: codes are only sent by SMS to the phone number on the data controller's list, or given over the phone, and only after verification of the person against the list. Codes are never disclosed in chat or by email and are not read out to a person who has not been verified. Codes are not stored in the transcript beyond what is necessary to document that a code has been sent.
- Encryption. All traffic in the chain is encrypted: between the telecom provider and Valiss' SIP server (SIP over TLS and SRTP), between the SIP server and the EU region of the voice and language models, between the Service and the other sub-processors, between browser and Valiss Manager and between the Service and the database, with TLS 1.2 or newer. Databases, files and backups are encrypted at rest with AES-256 at Railway and Cloudflare. Passwords for Valiss Manager are stored only as salted hashes.
- EU. All personal data is stored and processed in the EU: databases and SIP server in Railway EU West (Amsterdam), backups in Cloudflare R2 with EU jurisdiction, voice and language models in EU regions at the providers in Annex B. Only the sending of SMS and email and the telecom provider's signalling pass through providers outside the EU, cf. Annex C.6.
- Access control. The data controller's staff have personal logins with roles in Valiss Manager and Copilot. The data processor's own administrators have personal accounts, and access to operational tools requires personal login and a second factor. Access is reviewed at least quarterly, and access is closed when it is no longer necessary.
- Segregation. The data controller's knowledge, lists, conversations and users are logically segregated from other customers' data in Valiss Manager, and Copilot runs as a separate installation with its own database.
- Logging. Actions on the data controller's data performed by the data processor's administrators are logged with time, user, action and affected object and retained for 2 years. Sent SMS messages and emails are logged with recipient, category, time and status. Errors are logged without conversation content.
- Backups. The databases are backed up daily at the hosting provider in the EU region, and the copies are retained for 30 days. Restoration from the latest copy can take place within 24 hours after an incident.
- Monitoring. The Service is monitored around the clock with automatic alerts to the data processor on errors and outages. Usage caps and rate limiting protect against abuse of phone, SMS and chat.
- Audio. The voice is processed in real time and is not stored as an audio file at the data processor. Only the transcript is stored. Recording can only be activated on written instruction from the data controller, cf. Annex D.5.
- Review. The data processor reviews security at each major release and at least once a year (access, sub-processors, dependencies, this instruction) and documents it in the report under C.7. Known vulnerabilities in dependencies are fixed within 30 days, critical ones within 7 days.
- Physical security. The processing takes place exclusively in the sub-processors' data centres, which are certified under ISO 27001 and/or SOC 2 Type II. The data processor stores no personal data from the Service on its own premises or own equipment, apart from what is temporarily displayed on screen during support. The data processor's employees work on equipment with full disk encryption and automatic screen lock.
C.3 Assistance to the data controller
The data processor shall insofar as this is possible, within the scope and the extent of the assistance specified below, assist the data controller in accordance with Clause 9.1 and 9.2 by implementing the following technical and organisational measures:
The data processor assists the data controller in responding to requests from data subjects (access, rectification, erasure, restriction, data portability and objection) within 10 business days of a written request. The assistance consists of finding and handing over, correcting or deleting the information about a data subject that the data controller cannot handle itself in Valiss Manager, typically by searching on phone number, email or name across transcripts, chat logs, message log and lists. The data processor furthermore assists with information about the processing for the data controller's data protection impact assessment and for any prior consultation of Datatilsynet, and with information about a security breach (Clause 10). Requests from data subjects that the data processor receives directly are forwarded to the data controller without undue delay and are not answered by the data processor.
The data processor makes the following available for the assistance: export of the data controller's data in a machine-readable format (JSON or CSV) comprising knowledge, lists, transcripts, chat logs, summaries, message log and users; deletion of individual conversations and of individual data subjects' information on request; administrator log and delivery log; and a written description of the processing (this annex). In the event of a security breach the data processor provides the information set out in Clause 10.3, together with log extracts and a timeline, if possible within 24 hours after the breach has been established, with follow-up as soon as there is news. Assistance beyond 2 hours per calendar year is invoiced under Annex D.3.
C.4 Retention period and deletion routine
| Information | Retention and deletion |
|---|---|
| Audio from calls | Not stored. Processed in real time and discarded once the conversation has been transcribed. If the data controller activates recording in writing, recordings are deleted automatically after 30 days. |
| Transcripts, chat logs, emails, summaries, sentiment and keywords | Deleted or anonymised automatically 12 months after the conversation. The data controller may set a shorter period in writing. Aggregated statistics without personally identifiable information (counts, peak times, topics) are retained for the term of the main agreement. |
| Lists (arrival, booking or order lists) | Each person's row is deleted automatically 30 days after the date the row relates to (for example departure date). An uploaded list is replaced by the next, and the old file is deleted on upload. |
| SMS and email log | Content of sent messages is deleted after 12 months together with the conversation. Delivery log (recipient, category, time, status) is retained for 12 months. |
| Valiss AI Copilot | Staff conversations are retained until the user deletes them; deleted conversations remain 30 days in the recycle bin and are then permanently deleted. User accounts are deleted when the data controller requests it. |
| Administrator log | 2 years. |
| Technical logs (IP, errors) | No more than 90 days. |
| Backups | 30 days, after which deleted content is also gone from the copies. |
| At the voice and language model provider | The content is not retained after the answer has been delivered. No training on the content. Processing takes place in the EU region. |
| At the SMS, email and telecom provider | Only delivery and call logs (numbers, time, status) under the provider's own terms; no content and no audio is stored. |
On termination of the Service the data processor hands over all personal data to the data controller as a complete export (JSON or CSV and any files) and then deletes the data controller's data in Valiss Manager, Copilot's installation and database and the backups no later than 30 days after termination, cf. Clause 11. The data processor confirms the deletion in writing.
C.5 Processing location
Processing of the personal data under the Clauses cannot be performed at other locations than the following without the data controller's prior written authorisation:
- Railway (hosting, databases, SIP server, backups): the EU region EU West (Amsterdam, the Netherlands). Railway's own platform logs without personal data may be processed in the USA.
- Voice and language models (standard Google Cloud, Vertex AI): region eu and the europe-west regions (Belgium, the Netherlands, Finland).
- Cloudflare (backups, DNS and CDN): R2 with EU jurisdiction, data centres in the EU. Connection data on lookups of the domains may be processed at Cloudflare's nearest network point.
- Twilio (SMS and email): USA and EU, only during sending.
- FlyNumber (phone number and SIP trunk): signalling and audio in transit between the Danish telephone network and Valiss' SIP server in the EU; nothing is stored.
- The data processor itself: no storage on its own premises. Support is performed from Denmark and, via encrypted access to Valiss Manager without local storage, from the countries where the data processor's permanent employees work. The access does not constitute a transfer, as nothing is stored there, and it covers only what is displayed on screen during support. The countries are disclosed on request.
C.6 Instruction on the transfer of personal data to third countries
All personal data is stored and processed in the EU, cf. Annexes B and C.5. The data processor may transfer personal data to third countries only to the extent necessary for the following three functions, and only to these sub-processors: Twilio (USA): recipient number and content of SMS and email during sending; FlyNumber (USA): calling number, called number and call metadata on incoming calls, as well as audio in transit; Railway (USA): platform logs without personal data. The data processor may not otherwise transfer personal data to third countries without the data controller's prior written instruction.
The transfers take place on the basis of the European Commission's standard contractual clauses (Decision (EU) 2021/914, Module 3, processor to processor), which are entered into in the data processor's agreements with the sub-processors mentioned, supplemented by the data processor's transfer impact assessment, which is provided to the data controller on request. The EU-US Data Privacy Framework is not used as an independent basis. The data processor is working to replace the SMS and telephony providers with providers in the EU and notifies the data controller when a transfer ceases.
If the data controller does not in the Clauses or subsequently provide documented instructions pertaining to the transfer of personal data to a third country, the data processor shall not be entitled within the framework of the Clauses to perform such transfer.
C.7 Procedures for the data controller's audits, including inspections, of the processing of personal data being performed by the data processor
The data processor prepares once a year at its own expense a written report on compliance with these Clauses (self-assessment), describing the technical and organisational measures implemented under Annex C.2, changes to sub-processors, security incidents in the period and the result of the data processor's audits of the sub-processors (C.8). The report is sent to the data controller no later than 1 March for the preceding calendar year, the first time for the calendar year in which the Clauses came into force.
The data controller may challenge the scope or methodology of the report and may in such cases request a further elaboration or additional documentation, for example extracts of the administrator log, configuration of the Service or copies of the sub-processors' audit reports. Based on the report, the data controller may request further measures to ensure compliance with the GDPR and these Clauses.
The data controller or a representative of the data controller shall in addition have access to perform an inspection of the data processor's processing, including the systems used for the processing, with at least 30 days' written notice, no more than once per calendar year, unless a security breach or an order from a supervisory authority gives grounds for more. The inspection is carried out as a documented review (screen sharing of Valiss Manager, configuration and logs) and, where relevant, as a meeting. As the processing takes place exclusively in the sub-processors' data centres, the inspection does not include physical access to data centres; reference is made to C.8.
Any costs the data controller incurs for the inspection are borne by the data controller itself. The data processor's time beyond 4 hours per inspection is invoiced under Annex D.3.
C.8 Procedures for audits, including inspections, of the processing of personal data being performed by sub-processors
The data processor audits the sub-processors once a year at its own expense by obtaining and reviewing their most recently available independent audit reports or certifications (SOC 2 Type II and/or ISO 27001, cf. the overview in Annex B) and their published lists of sub-processors, and by checking that the data processing agreements with them are still in force and cover the processing that takes place. The parties agree that the following types of reports may be used: SOC 2 Type II, SOC 3, ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 issued by an independent auditor or certification body, as well as EU Cloud Code of Conduct declarations.
The result of the audit is included in the annual report under C.7. Copies of the reports are provided to the data controller on request, to the extent the sub-processor's terms permit it. The data controller may challenge the scope or methodology of the audit and may request that the data processor obtain further documentation from the sub-processor. Based on the result of the audit, the data controller may request further measures, including replacement of a sub-processor.
Physical inspection of the sub-processors' data centres is not possible for either the data processor or the data controller; the parties accept the independent reports as documentation of the physical security.
Annex D. The parties' terms of agreement on other subjects
D.1 Main agreement. These Clauses supplement the main agreement between the parties together with the Valiss Terms of Service and the Product Terms in the versions the main agreement specifies. In case of conflict, these Clauses take precedence as regards the processing of personal data.
D.2 Instructions that may be unlawful. If the data processor considers that an instruction infringes the GDPR or other data protection legislation, the data processor immediately notifies the data controller in writing and may suspend execution of the instruction until the data controller has confirmed or changed it. If the data controller maintains the instruction, the data controller bears full responsibility for the consequences, and the data processor may terminate the main agreement with 30 days' notice.
D.3 Payment for assistance. Assistance under Annex C.3 and inspections under C.7 are included in the subscription within the hours stated. Time beyond that is invoiced under § 5.8 of the Terms of Service, subject to the data controller's prior written acceptance.
D.4 Liability. The parties' liability in damages towards each other, including for breach of these Clauses, follows the main agreement and § 14 of the Terms of Service, including the cap in § 14.3, to the extent compatible with the data protection rules. Neither party can limit its liability towards data subjects or supervisory authorities. Each party bears any fines a supervisory authority imposes on that party. The data controller indemnifies the data processor against claims from data subjects, supervisory authorities and third parties to the extent the claim results from the data controller's instructions, a missing legal basis or failure to inform data subjects, or the data controller's own choices under D.5.
D.5 The data controller's own choices. The data controller is responsible for the choices its staff make in the Service, including which employees are given access to Valiss Manager and Copilot, which fields the lists contain, which knowledge the assistants answer from, and whether call recording is activated. Call recording is activated only on written instruction, and the data controller is in that case responsible for informing about the recording. The "Keep me in the EU" setting in Copilot may not be switched off without written instruction and notice under Annex B.2. The data controller is responsible for informing guests, customers and users that phone and chat are answered by an AI assistant, and about the processing of their data in the data controller's privacy policy.
D.6 Notification of breaches. Notification under Clause 10 is sent to the data controller's contact person by email and phone. The data processor's contact point for security breaches is hello@valiss.co and +45 44 22 12 12.
D.7 Duration. These Clauses terminate automatically when the main agreement terminates and the handover and deletion under Clause 11 have been confirmed in writing.
D.8 Versions. This is Valiss' standard data processing agreement version 1.0 of October 2026. Annexes A to D are completed for each customer and may deviate from the standard where the customer's Service makes it necessary. The signed version takes precedence over this template. The agreement exists in Danish and English; in case of discrepancy, the Danish version prevails.