Data Processing Addendum

When this addendum applies

This Data Processing Addendum forms part of the Terms of Service or other agreement (the “Agreement”) between Teleon, Inc. (“Teleon”) and the customer (“Customer”). It applies automatically, without separate signature, whenever Teleon processes Personal Data on the Customer’s behalf.

A counter-signed copy is available on request from legal@teleon.ai. Customers who require a negotiated addendum may raise it on an Order Form; this version is the default and is what governs in the absence of one.

It implements Article 28 of the GDPR and the equivalent provisions of the UK GDPR, the Swiss FADP, the CCPA/CPRA and other applicable data protection law. Where a term of this addendum conflicts with the Agreement, this addendum prevails on data protection matters.

Roles of the parties

Teleon processes Customer Personal Data only on the Customer’s documented instructions. The Agreement, this addendum, the configuration the Customer sets in the console, its policies, classifications, retention settings and residency selection, and the Customer’s use of the API together constitute those instructions. Teleon will tell the Customer if an instruction appears to infringe applicable data protection law, and may suspend performance of that instruction until it is resolved.

Teleon will not process Customer Personal Data for its own purposes, will not sell or share it as those terms are defined by the CCPA/CPRA, will not combine it with data from other sources except as necessary to provide the Service, and will not retain, use or disclose it outside the direct business relationship. Teleon certifies that it understands and will comply with these restrictions.

Subject matter, duration, nature and purpose

Subject matter

Provision of the Teleon trust layer under the Agreement.

Duration

The term of the Agreement, plus the retention and deletion periods in section 9.

Nature and purpose

Ingesting audit-event metadata from the Customer’s Agents; enforcing the Customer’s policies at the gateway, sidecar or middleware; classifying and scoring agent behaviour; tokenizing classified fields in the Privacy Vault; generating trust profiles, scores, badges and signed compliance bundles; storing the signed audit ledger; and operating the data-subject request portal on the Customer’s behalf.

Categories of data subject

End users of the Customer’s products whose interactions pass through its Agents; the Customer’s personnel who use the console; the Customer’s compliance and security staff handling DSRs; individuals identified in a DSR.

Categories of personal data

Special categories

Teleon does not process special categories of personal data under Article 9, or criminal-offence data under Article 10, unless the Customer has enabled a Privacy Vault classification for them and, for protected health information, executed the Business Associate Agreement in section 12. Sending such data without doing so is a breach of the Agreement, and Teleon may suspend to contain it.

Teleon’s obligations

1. Confidentiality. Personnel authorised to process Customer Personal Data are bound by written confidentiality obligations that survive their engagement, and are granted access only as their role requires.
2. Security. Teleon implements the technical and organisational measures in section 8, appropriate to the risk under Article 32.
3. Sub-processors. Engaged only under section 5, under a written contract imposing data protection obligations no less protective than these. Teleon remains fully liable for a sub-processor’s performance.
4. Assistance with data-subject rights. Section 10.
5. Assistance with Articles 32 to 36. Teleon provides the information the Customer reasonably needs for a data protection impact assessment or a prior consultation, taking into account the nature of the processing and what is available to Teleon.
6. Deletion or return. Section 9.
7. Audit. Section 11.
8. Breach notification. Section 7.

Sub-processors

The Customer gives general written authorisation for Teleon to engage sub-processors. The current list is published at /legal/sub-processors and forms part of this addendum. It is the authoritative list; any other list is superseded by it.

Teleon gives at least 30 days’ notice before a new sub-processor begins processing, and publishes the change on the register the same day. The Customer may object on reasonable data protection grounds within that period, in writing to dpo@teleon.ai. Teleon will use reasonable efforts to offer a configuration avoiding the sub-processor; failing that, the Customer may terminate the affected part of the subscription without penalty and receive a pro-rata refund of prepaid fees.

International transfers

Residency

Customer Personal Data of a Customer established in the EU is stored in the EU (eu-west-1); that of other Customers is stored in the US (us-east-1). Some processing, including AI-based evaluation, may take place in the United States.

Standard Contractual Clauses

Where Teleon or its sub-processors process Personal Data protected by the GDPR in a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 by reference, as follows:

• Clause 7, the docking clause, applies.
• Clause 9(a), option 2 applies: general written authorisation, with a minimum of 30 days’ notice of changes.
• Clause 11(a): the optional independent dispute-resolution language does not apply.
• Clause 13 and Annex I.C: the competent supervisory authority is that of the exporter’s establishment, or where the exporter is not established in the EU, of the Member State in which its Article 27 representative is designated.
• Clause 17: the Clauses are governed by the law of Ireland. Clause 18(b): disputes are heard in the courts of Ireland.
• Annexes I, II and III are set out in sections 13 to 15 of this addendum.

For data protected by the UK GDPR, the parties incorporate the UK International Data Transfer Addendum (version B1.0) to the Standard Contractual Clauses. For Swiss data, the Clauses are read with the Federal Data Protection and Information Commissioner substituted as supervisory authority and references to the GDPR read as references to the FADP.

Onward transfers to sub-processors, including Teleon affiliates, are made under the Standard Contractual Clauses or another valid transfer mechanism, together with the measures in Annex II.

Government access requests

If Teleon receives a request from a public authority for Customer Personal Data, it will challenge the request where there are lawful grounds, disclose only the minimum required, and notify the Customer unless legally prohibited.

Personal data breach

Teleon notifies the Customer without undue delay and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data.

The notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a named contact for coordination. Where the full picture is not available within 72 hours, Teleon sends what it has and supplements it as the investigation develops rather than delaying the first notice.

Teleon assists the Customer in meeting its own notification obligations to supervisory authorities and data subjects. Teleon does not notify the Customer’s data subjects directly unless the Customer instructs it to. Security contact: security@teleon.ai.

Technical and organisational measures

These are the measures referred to in Article 32 and reproduced in Annex II. They are Teleon’s current measures and may be updated, provided the level of protection is not reduced.

Deletion and return

1. For 30 days after the Agreement ends, the Customer may export Customer Personal Data through the bundle generator and the API in a documented, machine-readable format.
2. After that window, Teleon deletes Customer Personal Data within 90 days.
3. Records Teleon is required by law to keep are retained encrypted, are not accessible to operational staff, and are deleted when the obligation lapses. Teleon will state on request what is being kept and why.
4. Backups follow their own rotation and are overwritten within 35 days. Data in a backup is not restored to production after a deletion request.

Erasure of tokenized data is cryptographic: the data key is destroyed. Audit records are retained as hashes so that the integrity of the Customer’s audit trail is preserved.

Data-subject requests

Teleon operates a data-subject request portal at dsr.teleon.ai/<tenant> on the Customer’s behalf. Access, rectification, erasure, restriction, portability and objection requests are tracked against an SLA clock visible to the Customer in the console.

Where a data subject contacts Teleon directly about data Teleon processes for a Customer, Teleon does not respond substantively. It routes the request to the Customer, identifies the controller to the data subject, and starts the clock on the Customer’s side.

Erasure executed through the portal destroys the relevant vault data key and propagates to every token derived from it. A signed deletion certificate is issued to the data subject and written to the Customer’s audit ledger, so the Customer can later prove the erasure happened.

Teleon assists the Customer in meeting the statutory response deadlines. Assistance included in the subscription covers requests routed through the portal; requests requiring bespoke engineering are quoted separately and are not withheld while the price is agreed.

Audit rights

Teleon makes available the information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates.

• In the first instance Teleon satisfies this by providing its security documentation, answers to a reasonable security questionnaire, and any third-party audit reports or certifications it holds.
• Where that is genuinely insufficient for the Customer’s regulatory obligation, the Customer may conduct an audit once per twelve months, on 30 days’ written notice, during business hours, under confidentiality, without unreasonable disruption, and at its own cost. A regulator may audit at any time its own powers permit.
• An audit following a Personal Data Breach affecting the Customer is not subject to the annual limit and is at Teleon’s cost.

Requests go to compliance@teleon.ai.

Business Associate Agreement: HIPAA

Where executed, the Customer is a Covered Entity or Business Associate and Teleon is a Business Associate under 45 CFR Parts 160 and 164. Terms used below have the meanings given in those Parts.

Permitted uses and disclosures

Teleon may use or disclose PHI only to perform the Service, as required by law, or for its own proper management and administration where the disclosure is required by law or Teleon obtains reasonable assurances of confidentiality and notice of any breach. Teleon will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by the Covered Entity, and will limit uses and disclosures to the minimum necessary.

Safeguards

Teleon implements the administrative, physical and technical safeguards required by the Security Rule at 45 CFR Part 164 Subpart C, including those in section 8 above, and complies with the Security Rule with respect to electronic PHI.

Reporting

Teleon reports to the Customer any use or disclosure of PHI not permitted by this section, any Security Incident of which it becomes aware, and any Breach of Unsecured PHI, without unreasonable delay and in any event within 30 calendar days of discovery, and within 72 hours where the incident is also a Personal Data Breach under section 7. Reports include the information required by 45 CFR 164.410(c).

Subcontractors

Teleon ensures that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as restrictive as those that apply to Teleon.

Individual rights

Teleon makes PHI in a Designated Record Set available to the Customer as necessary for the Customer to meet its obligations under 45 CFR 164.524 (access), 164.526 (amendment) and 164.528 (accounting of disclosures), and makes its internal practices, books and records available to the Secretary of Health and Human Services for determining compliance.

Termination

On termination, Teleon returns or destroys all PHI it still holds and retains no copies, to the extent feasible. Where return or destruction is infeasible, Teleon extends the protections of this section to that PHI and limits further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it is retained. The Customer may terminate the Agreement if Teleon breaches a material term of this section and fails to cure within 30 days.

Annex I: parties, processing, supervisory authority

A. List of parties

The exporter’s signature and date are those of the Agreement; the importer’s are those of this addendum as published, or of the counter-signed copy where one is issued.

B. Description of transfer

Data subjects

As set out in section 3.

Categories of personal data

As set out in section 3.

Sensitive data

Only where the Customer has enabled a Privacy Vault classification for it, and for PHI only where the Business Associate Agreement in section 12 has been executed. Restrictions: tokenization at the boundary, encryption with per-record data keys, access confined to audited detokenization calls.

Frequency

Continuous, for the duration of the Agreement.

Nature and purpose

As set out in section 3.

Retention

As set out in section 9 and in the retention schedule in the Privacy Policy.

Sub-processor transfers

As published at /legal/sub-processors, for the duration of their engagement.

C. Competent supervisory authority

The supervisory authority of the Member State in which the data exporter is established. Where the exporter is not established in the EEA but is subject to the GDPR under Article 3(2), the supervisory authority of the Member State in which its Article 27 representative is designated.

Annex II: technical and organisational measures

The measures set out in section 8 constitute Annex II to the Standard Contractual Clauses and are incorporated here by reference. They apply to transfers to sub-processors as well as to Teleon.

Annex III: sub-processors

The register published at /legal/sub-processors constitutes Annex III and is incorporated here by reference. The Customer has authorised the sub-processors listed there under Clause 9(a), option 2, with 30 days’ notice of changes.

Liability, order of precedence, and contact

Liability under this addendum is subject to the limitations in the Agreement, except where applicable data protection law does not permit it to be limited, in particular a data subject’s right to compensation under Article 82, and the liability provisions of the Standard Contractual Clauses, which are not limited by the Agreement.

Where a conflict arises, the order of precedence is: the Standard Contractual Clauses first, then this addendum, then the Agreement.

This addendum is governed by the law that governs the Agreement, except that the Standard Contractual Clauses are governed by the law of Ireland as stated in section 6, and except where mandatory data protection law requires otherwise.

Data protection

dpo@teleon.ai

Contracts and counter-signature

legal@teleon.ai

Compliance evidence and audits

compliance@teleon.ai

Security and breach

security@teleon.ai

Data importer

Teleon, Inc., provided on request to legal@teleon.ai