1. Definitions and roles
This document is a draft for founder and legal review. It is not legal advice and does not create a commitment until approved and published.
This template is intended for a customer that determines purposes and means for configured Customer Content and Bavio as a service provider or processor. The correct role depends on deployment and jurisdiction.
2. Scope and duration
Bavio processes account, Workspace, telephony, Conversation, transcript, recording-reference, AI, Lead, Action, Workflow, webhook, and billing-related data to provide the service during [PROCESSING_DURATION].
3. Documented instructions
Bavio processes Customer Content to provide configured services, maintain security, prevent abuse, troubleshoot, and comply with law. Additional instructions must be lawful, documented, and technically feasible.
4. Confidentiality and personnel
Authorized personnel and subprocessors should be bound by confidentiality obligations and access controls appropriate to their role.
5. Security measures
Observed controls include tenant checks, selected RLS, encrypted webhook-secret storage, signed provider callbacks, HTTPS validation, environment-based secrets, and selected idempotency. These are not certification claims.
6. Subprocessors and transfers
Observed provider paths are listed in Subprocessors. Legal names, processing locations, transfer mechanisms, notice, and objection terms are [TRANSFER_MECHANISM] and [SUBPROCESSOR_TERMS].
7. Data subject requests
Bavio will reasonably assist with access, correction, deletion, export, or restriction requests subject to the service, customer instructions, identity verification, and law. Customer coordination is required for caller data.
8. Incidents and cooperation
Incident notification timing, assistance scope, audit evidence, and contact are [INCIDENT_NOTIFICATION_PERIOD], [AUDIT_TERMS], and [DPA_CONTACT].
9. Return and deletion
Return, deletion, backups, provider copies, and post-termination retention are [DELETION_AND_AUDIT_TERMS]. No universal automated deletion window is established by the repository.
10. Schedules
Schedule A: processing details, categories, data subjects, purposes, and duration. Schedule B: security measures. Schedule C: approved subprocessors. Counsel must complete each schedule before signature.