Data Processing Agreement (DPA)

Last Updated: 6/23/2025

This Data Processing Agreement (“Agreement” or “DPA”) is entered into by and between:

BrandWave Media LLC, a Florida limited liability company, operating the Agentli.ai platform (“Processor”),

and

You, the client entity or organization subscribing to the Services (“Controller”),

together the “Parties,” for the purpose of ensuring compliance with applicable data protection laws, including but not limited to the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, and the California Consumer Privacy Act (“CCPA”).

This DPA forms part of and is subject to the terms of the primary Service Agreement or Terms of Use between the Parties.

1. Definitions

  • “Personal Data” means any information relating to an identified or identifiable natural person.

  • “Processing” means any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.

  • “Controller” means the party that determines the purposes and means of processing Personal Data.

  • “Processor” means the party that processes Personal Data on behalf of the Controller.

  • “Sub-processor” means a third party engaged by the Processor to assist in processing Personal Data.

2. Subject Matter and Duration

This Agreement governs the Processor’s handling of Personal Data on behalf of the Controller during the course of providing the CRM, AI voice agent, automation, and related services under the main Service Agreement.

This DPA remains in effect for as long as the Processor processes Personal Data on behalf of the Controller.

3. Nature and Purpose of Processing

The Processor may process Personal Data solely for the following purposes:

  • Hosting and managing CRM data

  • Handling communication and engagement through AI voice agents

  • Providing marketing automation, lead routing, and reporting

  • Managing platform integrations and service performance

  • Complying with legal or regulatory obligations (if applicable)

No data will be processed beyond the scope of this agreement without prior written consent from the Controller.

4. Categories of Data Subjects

  • Leads and prospects entered into the CRM

  • Clients and customers of the Controller

  • Website or landing page form respondents

  • Contacts reached by AI voice agents or automation tools

5. Types of Personal Data

The following types of data may be processed:

  • Contact information (name, phone number, email)

  • Business information (company name, location, industry)

  • Call recordings and transcriptions (where permitted by law)

  • CRM interaction history and lead notes

  • Booking and communication data

No special categories of personal data (e.g., health, race, religion, political views) are intentionally collected.

6. Obligations of the Processor

The Processor agrees to:

  • Process Personal Data only on documented instructions from the Controller

  • Maintain appropriate technical and organizational safeguards to protect Personal Data

  • Ensure that employees and authorized agents are subject to confidentiality obligations

  • Assist the Controller in responding to data subject requests or regulatory inquiries

  • Notify the Controller of any Personal Data breach without undue delay

  • Delete or return all Personal Data upon request or termination, subject to legal retention requirements

7. Sub-Processors

The Controller authorizes the use of the following Sub-processors that the Processor may engage in order to provide the Services. These Sub-processors may process Personal Data on behalf of the Controller, subject to contractual confidentiality and data protection obligations:

  • Sub-Processor - GoHighLevel LLC | Service - CRM platform infrastructure | Location - USA

  • Sub-Processor - Twilio Inc. | Service - Communication APIs (SMS/Voice) | Location - USA

  • Sub-Processor - Vapi.ai | Service - Voice agent framework | Location - USA

  • Sub-Processor - Zapier Inc. | Service - Automation and data syncing tool | Location - USA

  • Sub-Processor - Celonis, Inc. (Make.com) | Service - Workflow automation platform | Location - USA

  • Sub-Processor - Synthflow AI | Service - AI voice agent interface/infrastructure | Location - USA

  • Sub-Processor - Google LLC | Service - Analytics, reCAPTCHA, G Suite | Location - USA

  • Sub-Processor - Stripe Inc. | Service - Payment processing (if applicable) | Location - USA

The Processor shall provide prior notice to the Controller of any intended addition or replacement of Sub-processors. The Controller shall have the right to object on reasonable grounds related to data protection within ten (10) business days of receiving such notice.

8. Data Transfers

The Controller acknowledges and agrees that Personal Data may be transferred to and processed in jurisdictions outside of their own, including the United States, where data protection laws may differ. The Processor shall ensure such transfers comply with applicable safeguards (e.g., Standard Contractual Clauses).

9. Liability and Indemnification

Each party shall be responsible for its own compliance with applicable data protection laws. The Controller agrees to indemnify and hold harmless the Processor against any claims, losses, or damages arising from:

  • Improper or illegal instructions provided by the Controller

  • Controller’s failure to obtain proper consent from Data Subjects

  • Breach of applicable data protection obligations by the Controller

Processor’s total liability under this Agreement shall be limited to the fees paid to Processor in the twelve (12) months preceding the claim.

10. Termination and Data Return

Upon termination of the Services or upon written request, Processor shall delete or return all Personal Data in its possession unless otherwise required by law to retain it.

11. Governing Law and Jurisdiction

This Agreement shall be governed by and construed in accordance with the laws of the State of Florida, United States. Any disputes shall be resolved in the courts located in Broward County, Florida.

12. Miscellaneous

  • This DPA may be executed electronically and in counterparts.

  • If any provision is found unenforceable, the remainder shall remain in effect.

  • In case of conflict with the main Service Agreement, this DPA shall prevail as it relates to data protection obligations.

This Agreement shall be governed by and construed in accordance with the laws of the State of Florida, United States. Any disputes shall be resolved in the courts located in Broward County, Florida.

11. Contact Us

If you have any questions or concerns regarding this Data Processing Agreement (DPA), please contact:
BrandWave Media LLC

Email: [email protected]

Website: https://agentli.ai