Back to HomeDoze SMS

Data Processing Agreement (DPA)

Last Updated: August 13, 2026

This Data Processing Agreement ("DPA") supplements the Terms of Service and Privacy Policy between Doze SMS ("Processor," "we") and the Customer ("Controller," "you") pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK Data Protection Act 2018.

1. Definitions

  • Personal Data: Any information relating to an identified or identifiable natural person ("Data Subject"), including End-User phone numbers, names, and message content.
  • Controller: You (the Customer), who determines the purposes and means of processing Personal Data.
  • Processor: Us (Doze SMS), who processes Personal Data on your behalf to provide the Services.

2. Scope and Purpose of Processing

We process Personal Data solely to provide the Services described in our Terms of Service, including:

  • Receiving and responding to SMS/voice communications from End-Users.
  • Processing AI-driven conversations for scheduling and booking.
  • Storing booking records and conversation history.

3. Obligations of the Processor

We shall:

  • Process Personal Data only on your documented instructions. We will not process data for any purpose other than providing the Services.
  • Ensure that persons authorized to process Personal Data have committed themselves to confidentiality.
  • Implement appropriate technical and organizational security measures, including encryption of data in transit and at rest.
  • Not engage additional sub-processors without your prior knowledge. A current list of sub-processors is available in our Privacy Policy, Section 4.
  • Assist you in responding to Data Subject requests (e.g., access, deletion, portability) through the tools provided in the Services dashboard and our GDPR API endpoint.
  • Delete or return all Personal Data upon termination of the Services, within 30 days, unless retention is required by applicable law.
  • Make available to you all information necessary to demonstrate compliance with this DPA.

4. Sub-processors

You acknowledge and consent to our use of the following sub-processors:

  • OpenAI, LLC (United States) — AI language processing
  • DeepSeek (China) — AI language processing (alternative)
  • Twilio Inc. (United States) — SMS and voice telecommunications
  • Cloud hosting provider (United States / varies) — Infrastructure and data storage

We will notify you of any intended changes to sub-processors, giving you the opportunity to object.

5. International Data Transfers

Where Personal Data is transferred outside the EEA or UK, we rely on:

  • Standard Contractual Clauses (SCCs) as approved by the European Commission, or
  • Other lawful transfer mechanisms under applicable data protection law.

6. Data Breach Notification

We will notify you without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data breach that is likely to result in a risk to the rights and freedoms of Data Subjects.

7. Term and Termination

This DPA shall remain in effect for as long as we process Personal Data on your behalf. Upon termination of the Services, Section 3 (deletion obligations) shall survive.

For DPA inquiries, contact us at support@dozesms.com.