Data-processing agreement.

1. Parties and roles

The client: [client legal name], [ID or company no.], [address] (the "Client"). The Client is the controller (בעל שליטה under Israeli law) of the personal data in its business.

AERA: Mark Ghazawi, trading as AERA, exempt dealer no. 315971192, Al Sahel 2, Jerusalem 9752059, Israel ("AERA"). AERA is the processor, and in Israeli law the holder, that processes that data for the Client.

This agreement covers the Privacy Protection Law, 5741-1981 (including Amendment 13), the Privacy Protection (Data Security) Regulations, 5777-2017, and, where they apply, GDPR Article 28 and the UK GDPR.

2. What AERA processes, and why

AERA processes the Client's personal data only to provide the services in the Client's order: running AI agents (WhatsApp, voice, email), automations, websites and related support. The details are in Annex 1.

AERA acts only on the Client's documented instructions: the order, this agreement, the agent's approved configuration and the Client's written requests. If AERA believes an instruction breaks the law, it will say so and may pause that processing. If the law requires other processing, AERA will tell the Client first unless the law forbids it.

3. AERA's commitments

• Use the data only for the Client's purposes, never for its own marketing and never to train its own AI models.
• Make sure everyone with access is bound by confidentiality and gets access only as far as they need.
• Apply the security measures in Annex 2, suited to the data and the risk.
• Help the Client answer requests from data subjects (access, correction, deletion, objection), within the time the Client needs to meet its own deadlines.
• Help the Client with impact assessments and regulator questions when they concern AERA's processing.
• Keep a record of the processing it carries out for the Client.

4. Security incidents

AERA will tell the Client without undue delay, and in any case within 72 hours, of any security incident affecting the Client's data. AERA will give what it knows (what happened, what data, how many people, what it is doing) and update as it learns more, so the Client can meet its duties to notify the Privacy Protection Authority, a supervisory authority or the people affected.

5. Sub-processors

The Client authorises AERA to use the sub-processors on the sub-processors page. Each processes the data under its business or service terms, and AERA stays responsible to the Client for their work.

AERA will tell the Client at least 30 days before adding or replacing a sub-processor. The Client may object on reasonable data-protection grounds; if we cannot agree on a solution, the Client may end the affected service without penalty.

6. International transfers

Data may be processed outside Israel by the sub-processors listed, mainly in the USA. Transfers from Israel follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001. For personal data subject to the GDPR, the parties rely on the European Commission's adequacy decision for Israel, and for onward transfers on the Standard Contractual Clauses (Commission Decision 2021/914) or the EU-US Data Privacy Framework where the recipient is certified.

7. Retention, export and deletion

• Agent transcripts (WhatsApp, voice, email) held in AERA's systems and its voice provider are kept 90 days, then deleted. The Client's own WhatsApp app and sheet or CRM keep the Client's copy.
• Export: on request, at any time, AERA exports the Client's data it holds in a common format (CSV or JSON, plus original files) within 30 days.
• Deletion: AERA deletes the Client's data, including with sub-processors, 30 days after the contract ends, unless the Client asks for an export first or the law requires AERA to keep something (for example invoices). AERA confirms deletion in writing on request.

8. The Client's commitments

• Have a lawful basis for the processing and give its customers a privacy notice that says an AI agent answers them, that calls may be recorded, and how their data is used.
• Get any consent the law requires, including for marketing messages (Communications Law s.30A) and call recording.
• Give only lawful instructions and own the accounts the services connect to (for example its WhatsApp Business account).
• Not send special categories of data (health, biometrics and similar) through the services unless agreed in writing with extra safeguards.

9. Information and audits

AERA will give the Client the information needed to show it meets this agreement. The Client may carry out a reasonable audit of AERA's compliance, on 30 days' notice, at most once a year, at the Client's cost, during business hours, under confidentiality and without access to other clients' data. AERA holds no third-party security certification.

10. Term, liability and law

This agreement lasts as long as AERA processes the Client's data. Liability follows the terms. Israeli law governs and the competent courts in Jerusalem have exclusive jurisdiction, except where the Standard Contractual Clauses require otherwise. If this agreement and the terms conflict on data protection, this agreement wins.

11. Annex 1: details of the processing

12. Annex 2: security measures

• Encryption in transit (TLS) for all traffic; providers' encryption at rest where offered.
• Access only for named people who need it, with separate accounts and strong authentication where the provider offers it; access removed when no longer needed.
• Connections to the Client's accounts through official integrations and tokens where the platform offers them.
• If the Client shares a website login on the onboarding form, new submissions store the password only encrypted (AES-256-GCM), only AERA admin accounts with the owner role can view it, and it is deleted when the onboarding record expires after 90 days, or sooner on request. Older submissions are being moved to encrypted storage and the plain copies deleted.
• Approval first: the agent replies to customers automatically only within the configuration and information the Client approved; proposals, invoices and automations are approved by a person before they are sent.
• Logging of administrative actions where the platform supports it; health monitoring of agents.
• Backups and retention limits as set out in section 7.
• A security-incident procedure that meets section 4.
• Measures matched to the security level the Data Security Regulations assign to the database, reviewed at least once a year.

13. Signatures

Client: [name, title, signature, date]

AERA: Mark Ghazawi [signature, date]