Data Processing Agreement

Between SepNets — a sole proprietorship operated by Arthur Meltser, Authorized Dealer (עוסק מורשה) no. 307067561, info@sepnets.io, https://sepnets.io — the Processor, and the subscribing customer — the Controller. This agreement is part of the SepNets Customer Terms and is accepted with them; terms defined there (Service, Customer Data) have the same meaning here.

1. Roles and instructions

1.1 The Controller determines the purposes and means of processing its Customer Data; the Processor processes it only to provide the Service, per the Customer Terms, the applicable addendum and the Controller's configuration (order details and dashboard settings).

1.2 The Processor processes Customer Data on the Controller's behalf only — no own purposes (service operation and security as ancillary duties permitted), no sale or rental of Customer Data, and no use of Customer Data to train general AI models for third parties. Data sent to OpenAI through the API is not used to train OpenAI's models.

1.3 If an instruction appears to violate privacy law, the Processor informs the Controller, and the parties agree on a compliant alternative.

2. Confidentiality

Processor personnel with access to Customer Data are bound by confidentiality; access is granted only as needed.

3. Subprocessors

3.1 The current subprocessors relied on to provide the Service:

3.2 The Controller receives 30 days' notice of new or replaced subprocessors (email or dashboard notice) and may object on reasonable data-protection grounds and terminate the affected part of the Service without penalty.

3.3 The Processor imposes data-protection obligations on subprocessors no weaker than this agreement.

4. Security measures

Under the Israeli Data Security Regulations, 2017, the Processor operates at least Basic-level controls and applies Medium-level practices to customer databases:

• access control, unique accounts and least privilege; activity logging;
• encryption of Customer Data in transit (TLS), including call audio;
• daily encrypted backups of the Mia platform, retained 30 days;
• written security procedures and documented incident response;
• periodic access reviews and personnel training;
• supervision of subprocessors;
• re-assessment of the security level as data volumes or data sensitivity grow, including appointment of a security officer when a statutory threshold is met.

5. Cross-border transfers

5.1 The primary infrastructure (Mia databases, recordings, email and encrypted backups) is self-hosted in Germany (EU); transfers from Israel to the EU rest on the EU–Israel adequacy framework.

5.2 The US subprocessors listed in section 3 (OpenAI, Twilio, Google/Firebase, Firecrawl, Cloudflare and the Fleet platform provider) process Customer Data outside Israel. The basis is this agreement and equivalent contractual commitments with those providers, given that the transfer is necessary to provide the Service the Controller ordered. The Processor maintains a transfer inventory and assists the Controller with data-subject requests concerning transfers.

6. Personal-data breach

6.1 The Processor notifies the Controller without undue delay after confirming a breach affecting Customer Data, describing what happened, the data and individuals affected, and the mitigation taken.

6.2 The Controller bears the statutory duty to report a severe security incident to the Privacy Protection Authority; the Processor assists with the information needed for that report and for any Authority-directed notification to individuals.

6.3 All incidents are documented, regardless of reporting thresholds.

7. Data-subject requests

The Processor notifies the Controller of a request received from the Controller's data subjects (callers, chat users, drivers), does not respond directly except to redirect, and assists the Controller in fulfilling access, correction, deletion and direct-mail-removal requests within a reasonable time (the Controller's own statutory deadline is 30 days).

8. Retention and deletion

• Mia call recordings, transcripts and AI summaries: a fixed 90 days from the call, then automatic deletion.
• Chat and SMS messages handled by Mia: kept while the subscription is active; no shorter fixed period exists for message content today.
• Customer data-export files: kept 7 days for download, then deleted.
• End of subscription: after a 7-day grace period (during which the customer may cancel or download an export), all business data is deleted — in every case within 30 days of termination.
• Fleet GPS history: deleted automatically after 10 days (a fixed period in the platform for every customer).
• End of a Fleet subscription: business data is deleted within 30 days of the customer's written request, handled manually together with the platform provider.
• Backups: daily encrypted backups retained 30 days — deleted data disappears from backups within about 35 days.
• Accounting and invoicing records: kept as required by Israeli bookkeeping law, in any case no longer than 7 years, and disclosed only as the law allows.

There is no customer-adjustable retention setting for call recordings, transcripts and summaries.

9. Audit

On 30 days' notice, no more than once a year (unless a breach occurred), the Controller may review the Processor's security documentation and completed questionnaires; an on-site audit is available only for a material breach or a regulatory demand, at the Controller's cost.

10. Liability

A breach of this agreement is a breach of the Customer Terms; liability follows the Customer Terms' limitation-of-liability section. The Processor is in any case liable for damage caused where it processed Customer Data outside the Controller's instructions without the Controller's direction.

11. Duration and termination

This agreement applies for the duration of the subscription and ends with it; sections 8, 9 and 10 survive termination.