Data Processing Agreement

Template — request a signed copy from hello@runita1.com

This is a template DPA. It has not been reviewed by legal counsel and should not be relied upon as legal advice. Have an Alberta tech lawyer review before use with clients who have European customers or significant Canadian privacy obligations.

1. Parties

This Data Processing Agreement ("DPA") is between RunIta1 ("Processor") and the subscribing business ("Controller", identified in the RunIta1 subscription).

2. Subject Matter

RunIta1 processes personal data on behalf of the Controller for the purpose of providing AI-assisted phone reception, email auto-reply, and appointment scheduling services.

3. Nature and Purpose of Processing

Processing activities include: receiving and responding to phone calls, reading and replying to emails, recording appointments, storing call transcripts and email logs, sending SMS reminders. Processing is carried out only on documented instructions from the Controller.

4. Categories of Data Subjects

End customers of the Controller business — callers, email senders, and appointment bookers.

5. Categories of Personal Data

Phone numbers, email addresses, names, appointment details, conversation content (transcripts and summaries).

6. Processor Obligations

RunIta1 will: • Process personal data only on Controller's instructions • Ensure staff with access to personal data are bound by confidentiality • Implement appropriate technical and organizational security measures • Assist Controller in responding to data subject access requests • Delete or return personal data on Controller request or at contract end • Notify Controller of any personal data breach within 72 hours of becoming aware

7. Sub-Processors

RunIta1 uses the following sub-processors: Supabase (database), Anthropic (AI processing), Bland.ai (voice), Twilio (SMS), Resend (email), Cal.com (scheduling), Vercel (hosting). RunIta1 will notify the Controller of sub-processor changes with 14 days notice.

8. Data Retention

Personal data processed under this agreement is retained for 12 months and then automatically deleted. Controller may request earlier deletion at any time.

9. Governing Law

This DPA is governed by the laws of the Province of Alberta, Canada.