Data processing agreement

1. Parties and scope

This data processing agreement applies between Ocean Wave Agency ("OWA", the processor), Karel Rogierstraat 18/102, 2000 Antwerp, Belgium, company number BE 1033.727.614, and every client of OSOWA ("the client", the controller).

It forms part of the general terms of OWA (article 16) and applies as soon as the client signs up for OSOWA. In case of conflict with the general terms, this data processing agreement prevails as regards the processing of personal data. A separately signed data processing agreement prevails over this text.

For the personal data that OWA processes for itself, such as the details of the client as a contact person and for invoicing, OWA is the controller. The privacy policy of OWA applies to that.

2. Subject matter and duration

OWA processes personal data on behalf of the client in order to deliver OSOWA: the software of OWA at app.oceanwaveagency.com, with the modules the client has chosen.

The processing lasts as long as the client uses OSOWA, and afterwards until the data has been deleted as set out in section 13.

3. Nature and purpose of the processing

OWA stores, organises and sends data so that the client can use OSOWA for:

• Customer management: contacts, leads, opportunities, notes and tasks
• Messaging: sending and receiving email, text messages, WhatsApp and social media messages
• Telephony: making and forwarding calls, and recording or transcribing calls when the client switches that on
• Calendar: letting people book appointments and sending reminders
• Payments: quotes, invoices and payment links through the payment account the client connects
• Forms, websites, funnels, reviews and automations
• AI features: answering, summarising or suggesting messages and conversations, only when the client switches those features on

OWA processes the data only for those purposes and not for its own purposes. OWA does not use the client's data to train its own AI models, and where a supplier offers the choice, OWA chooses settings in which client data is not used for training.

4. Data subjects

• Customers, leads and prospects of the client
• Contact persons at suppliers and partners of the client
• Employees and other users of the client who have access to OSOWA
• Visitors of the websites, forms and booking pages the client builds with OSOWA

5. Types of personal data

• Identification and contact details: name, email address, phone number, address, company and role
• Content of communications: emails, text, WhatsApp and chat messages, and call recordings and transcripts when the client switches them on
• Appointments, notes, tasks, tags and pipeline status
• Transaction data: quotes, invoices and payment status. Full card numbers are processed only by the payment service provider
• Technical data: IP address, device, time of opening or clicking, form submissions and visits to the client's websites
• Consents and unsubscribes for marketing

The client does not process in OSOWA any special categories of personal data within the meaning of article 9 GDPR, such as health data, nor data on criminal convictions (article 10 GDPR), unless OWA agrees to this in advance and in writing.

6. Instructions of the client

OWA processes the data only on documented instructions of the client. Those instructions are this data processing agreement, the general terms, the settings the client chooses in OSOWA and what the client asks in writing or by email.

If OWA considers that an instruction infringes the GDPR or another data protection rule, OWA informs the client immediately. OWA may then suspend the execution until the client confirms or changes the instruction.

If the law requires OWA to process data outside the instructions, OWA informs the client in advance, unless the law prohibits that.

7. Confidentiality

Only people who work for OWA and need the data for the service or support get access. They are bound by confidentiality, also after their assignment ends.

8. Security

OWA takes technical and organisational measures that fit the risk, including:

• Encrypted connections between browser, apps and servers
• Access with personal accounts, roles and permissions the client sets per user, and two-factor authentication where available
• Hosting in professional data centres of the platform supplier, with encryption of stored data and backups
• Separation between clients: every client works in its own environment
• Access by OWA only for support or maintenance, as limited as possible
• Keys and passwords of connected systems are not stored in websites or messages
• Follow-up of security updates and incidents together with the suppliers

OWA adapts these measures when the risks or the technology require it, without lowering the level of protection.

9. Sub-processors

The client gives OWA general authorisation to engage sub-processors. These are the current sub-processors:

• HighLevel Inc. (United States): the software platform OSOWA runs on, with hosting, customer management, messaging, calendar, automation and AI features
• The suppliers HighLevel itself uses for this, among others Google Cloud (hosting and storage), Twilio (calls and text messages), Mailgun (email) and OpenAI (AI features). HighLevel keeps the full list
• Google (Google Workspace): email and documents of OWA, when the client asks for support and shares data in doing so

Services the client connects with its own account, such as its own Google, Microsoft, Meta, WhatsApp Business or Stripe account, are suppliers of the client and not sub-processors of OWA. The arrangements between the client and that supplier apply to those services.

OWA announces an addition or replacement of a sub-processor at least 30 days in advance by email. The client may object on reasonable grounds within that period. If the parties find no solution, the client may cancel the subscription free of charge with effect from the date the change takes effect.

OWA imposes in writing on every sub-processor the same data protection obligations as in this data processing agreement, and remains responsible towards the client for their performance.

10. Transfers outside the European Economic Area

Some sub-processors are established in, or work from, the United States. OWA ensures that every transfer relies on an appropriate safeguard: the EU-US Data Privacy Framework where the sub-processor is certified under it, or the standard contractual clauses of the European Commission with the supplementary measures that are needed. On request OWA provides more information about these safeguards.

11. Assistance to the client

Taking into account the nature of the processing and the information available to OWA, OWA assists the client with:

• Requests from data subjects, such as access, rectification, erasure, restriction, portability and objection. The client can carry out most of these itself in OSOWA
• The security of the processing (article 32 GDPR)
• Notifying a data breach to the supervisory authority and to data subjects (articles 33 and 34 GDPR)
• A data protection impact assessment and a prior consultation of the supervisory authority (articles 35 and 36 GDPR)

If OWA receives a request directly from a data subject, OWA forwards it to the client and does not answer it itself, unless the client asks it to.

Assistance beyond what OSOWA itself makes possible may be charged at the applicable hourly rate, after prior notice.

12. Data breaches

If OWA becomes aware of a personal data breach affecting the client's data, OWA notifies the client without undue delay and at the latest within 48 hours after becoming aware of it, by email to the client's address. OWA provides the information it has: what happened, which data and data subjects are concerned, the likely consequences and the measures taken or proposed. What is not yet known, OWA adds as soon as it is known.

The client decides whether the breach must be notified to the supervisory authority and to the data subjects.

13. End of the processing

After the agreement ends, the client may request an export of its data within 30 calendar days. After that, OWA deletes the data from OSOWA, unless the law requires it to be kept. Copies in the suppliers' backups disappear according to their regular backup cycle and are no longer used until then.

14. Information and audits

OWA makes available the information needed to demonstrate compliance with this data processing agreement, such as a description of the measures and certificates or audit reports of suppliers where available.

The client, or an independent auditor it appoints who is bound by confidentiality, may carry out an audit after at least 30 days' notice, at most once a year, during office hours and at the client's expense. These limits do not apply to an audit after a data breach or at the request of a supervisory authority.

An audit of a sub-processor takes place through the information and reports that sub-processor makes available.

15. Responsibility of the client

The client warrants the lawfulness of the processing it instructs: a valid legal basis, the information to data subjects in its own privacy policy, consent for marketing where required, and honouring unsubscribes and do-not-call registers.

16. Contact

Questions about this data processing agreement or about data protection in OSOWA? Mail owa@oceanwaveagency.com.