Legal

Data Processing Agreement

This agreement sets out how LOFTION SIA processes personal data on your behalf when you use Zvani, as Article 28 of the General Data Protection Regulation (GDPR) requires. It is part of the Terms of Service and applies from the moment you accept them; no separate signature is needed. If you need a signed copy for your records, write to info@zvani.lv.

1. Roles

1.1. You (the customer) are the controller of the personal data in your calls, contacts and documents ("customer data"). LOFTION SIA is your processor.

1.2. For your account, billing and our own website we are a controller; that processing is described in the Privacy Policy, not here.

1.3. Words such as personal data, processing, data subject and personal data breach have the meaning given in the GDPR.

2. Instructions

2.1. We process customer data only on your documented instructions: these terms, your settings in Zvani (agents, prompts, modules, integrations, retention) and what you ask in writing. That includes transfers to third countries described in section 7.

2.2. We do not process customer data for our own purposes, do not sell it and do not use it to train AI models. We may use aggregated figures that identify no one (for example minutes used) to run and improve the service.

2.3. If we believe an instruction breaks data protection law, we tell you. If the law requires us to process data otherwise, we tell you first unless the law forbids it.

2.4. You are responsible for the lawfulness of the processing you instruct: having a legal basis, informing data subjects, obtaining consent where it is needed, choosing what is collected and how long it is kept, and answering data subjects. Features of Zvani that help with this are tools you choose to use; they do not move these obligations to us. Any information we give about data protection law is general and not legal advice.

3. Confidentiality and staff

Only people who need it to run, support or secure Zvani have access to customer data. They are bound by confidentiality, and access to calls in a customer workspace by our staff happens only to support you or when required to investigate abuse or a fault.

4. Security

We apply the technical and organisational measures in Annex 2, which take into account the state of the art, the cost and the risks to callers. We may improve them but will not lower the overall level of protection.

5. Subprocessors

5.1. You authorise us to use the subprocessors listed on the Subprocessors page. We bind each of them by contract to data protection obligations no weaker than this agreement, and remain responsible to you for them.

5.2. We announce a new or replaced subprocessor on that page and by email to workspace owners at least 30 days in advance. You may object on reasonable data protection grounds within that time; if we cannot address the objection, you may end the contract before the change, and we refund any prepaid, unused amounts.

5.3. Integrations you switch on yourself — your webhooks, your APIs and databases, your MCP servers, your Google Calendar, your SMS provider — are your choice and your recipients, not our subprocessors.

6. Helping you

6.1. Requests from data subjects. Zvani lets you find, export and erase a caller's calls in the panel. If a caller writes to us, we pass the request to you and do not answer it ourselves unless you ask us to.

6.2. Breaches. We notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting customer data, with what we know, and update you as we learn more, so that you can meet your own 72-hour obligation.

6.3. Impact assessments and authorities. We give you the information you reasonably need for a data protection impact assessment or a consultation with a supervisory authority.

7. Transfers outside the EEA

Customer data is stored in the European Union. Some subprocessors, mainly the AI and telephony providers, may process it in the United States or elsewhere. Such transfers rely on the EU–US Data Privacy Framework where the recipient is certified and otherwise on the European Commission's Standard Contractual Clauses (2021/914), with supplementary measures where needed. Details per subprocessor are on the Subprocessors page.

8. Retention, return and deletion

8.1. Call recordings are deleted automatically 90 days after the call. Transcripts, summaries and analyses stay until you erase the call or the workspace. You can erase a single call, with its recording, at any time.

8.2. When the contract ends you can export your data during the 30 days your archived workspace is kept. After that we delete customer data from the live systems; backups that contain it expire within a further 30 days. We keep only what the law obliges us to keep, and confirm deletion in writing on request.

9. Information and audits

We make available the information needed to show compliance with Article 28, answer your security questionnaires once a year without charge, and allow audits by you or an independent auditor bound by confidentiality, with 30 days' notice, during business hours and without access to other customers' data. You bear the cost of an audit unless it reveals a material breach on our part.

10. Liability and term

The liability terms of the Terms of Service apply to this agreement. It lasts as long as we process customer data for you.

Annex 1. Details of the processing

Subject matter and durationProviding Zvani to you, for the term of the contract and until deletion under section 8.
Nature and purposeReceiving and placing phone calls with an AI agent; speech recognition and synthesis; recording, transcribing, summarising, scoring and searching calls; transferring calls and passing messages to your staff; booking, looking up and sending information through integrations you enable; notifying your team (email, push, Telegram) about calls.
Data subjectsPeople who call your numbers or whom your agents call; people named in calls, contact lists and documents you upload; your staff who handle calls.
Categories of dataPhone numbers; voice recordings; what was said (transcripts); names, contact details, order, booking and other details given in the call; AI-generated summaries, intents, sentiment from the words spoken and quality scores; notes and remarks by your staff; contact lists and documents you upload.
Special categoriesNot intended. Callers may disclose them, for example health information when calling a clinic; you configure agents to collect only what is needed.
FrequencyContinuous, for every call.
RetentionRecordings 90 days; other call data until erased by you or with the workspace; see section 8.

Annex 2. Technical and organisational measures

  • Location. Servers, databases, recordings and backups in the EU; the subprocessors page names each provider and where it processes data.
  • Encryption. TLS for all traffic to the panel, the API and our providers; storage and backups in access-controlled provider infrastructure, reachable only with credentials held by named staff.
  • Access. Each workspace is isolated by tenant; roles (owner, admin, member, viewer) and per-member scopes limit what each person sees; API keys are scoped and stored only as hashes; passwords are hashed with bcrypt; sign-in attempts are rate-limited; sessions expire after 12 hours.
  • Operations. Administrative access to servers is limited to named staff with key-based authentication; production changes are tested before release and can be rolled back.
  • Availability. Daily database backups kept 30 days; monitoring and alerts on failures.
  • Minimisation. Automatic deletion of recordings after 90 days; erasure of individual calls; no use of customer data for model training.
  • Incidents. A documented process to contain, assess and notify personal data breaches.

Annex 3. Subprocessors

The current list, with what each one does, where and on what transfer basis, is on the Subprocessors page.