Data processing agreement

Effective date: 9 June 2026

This Data Processing Agreement (hereinafter "DPA") is concluded under Article 28 of the General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR") between the user of Linca, the AI phone assistant (hereinafter the "Controller" or "User"), and SLAI labs s.r.o., with registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, Company ID: 24010065, email: jiri@linca.io (hereinafter the "Processor").

It governs the processing of Callers' personal data that the Processor carries out on behalf of the Controller when providing Linca.

1. Definitions

Terms – the Terms and Conditions of Linca.
Privacy Policy – the Information on Personal Data Processing for Users.
Information for Callers – the Information on Personal Data Processing for Callers.
Caller – a natural person who calls the Controller's telephone number and is answered by Linca.
Caller Data – personal data of Callers processed when Linca handles a call: telephone number, name, call time and duration, temporary audio stream, temporary transcript and Call Summary.
Call Summary – the AI-generated text summary of a call that Linca delivers to the Controller.
Sub-processor – a third party engaged by the Processor to process Caller Data.

2. Scope and Precedence

This DPA forms part of the Terms. The User accepts it by creating a Linca account.
Where this DPA and the Terms conflict regarding the processing of Caller Data, this DPA prevails.
For the User's own personal data (account data, device data, analytics, support), the Processor acts as controller. That processing is described in the Privacy Policy and is not covered by this DPA.

3. Description of Processing

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.

4. Obligations of the Controller

The Controller is responsible for the lawfulness of the processing of Caller Data, in particular for having a legal basis under Article 6 GDPR.
The Controller ensures that Callers are informed about the processing. The Processor supports this by announcing to each Caller that they are speaking with an AI assistant and by publishing the Information for Callers. The Controller must not set up Linca in a way that conceals the use of an AI assistant from Callers.
The Controller must not set up Linca so that it asks Callers for special categories of personal data (Article 9 GDPR) or for data of children.
Requests from Callers for access to or erasure of their Call Summary may be handled by the Processor directly, on behalf of the Controller; the Processor informs the Controller. The Processor forwards all other requests to the Controller without undue delay.

5. Obligations of the Processor

Instructions. The Processor processes Caller Data only on documented instructions from the Controller. The instructions consist of this DPA, the Terms and the User's settings in the application. If the Processor considers an instruction to infringe the GDPR or other data protection law, it informs the Controller without undue delay.
Confidentiality. The Processor ensures that persons authorised to process Caller Data are bound by confidentiality.
Security. The Processor implements the technical and organisational measures set out in Annex II and keeps them up to date (Article 32 GDPR).
No processing for own purposes. The Processor does not use Caller Data for its own purposes. Service improvement uses only anonymised data that can no longer be linked to a Caller and is not personal data.
Records and cooperation. The Processor keeps records of processing activities carried out on behalf of the Controller and cooperates with the supervisory authority on request.

6. Sub-processors

The Controller gives a general authorisation for the engagement of the Sub-processors listed in Annex III.
The Processor announces any intended addition or replacement of a Sub-processor at least 14 days in advance in the application or by email. The Controller may object within this period on reasonable data protection grounds. If the parties do not agree, the Controller may terminate the Terms.
The Processor imposes on each Sub-processor, by contract, the same data protection obligations as set out in this DPA, and remains fully liable to the Controller for the performance of the Sub-processor's obligations.

7. Assistance to the Controller

Taking into account the nature of the processing, the Processor assists the Controller with appropriate technical and organisational measures in responding to requests from Callers exercising their rights under Chapter III GDPR.
The Processor assists the Controller in ensuring compliance with the obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment and prior consultation), taking into account the information available to the Processor.

8. Personal Data Breach

The Processor notifies the Controller of a personal data breach concerning Caller Data without undue delay, and no later than 48 hours after becoming aware of it.
The notification contains the information required by Article 33(3) GDPR, as far as it is available. Information that is not yet available is provided without undue delay as it becomes available.
The Processor assists the Controller with the notification to the supervisory authority and, where required, with the communication to the affected Callers.

9. Transfers Outside the EEA

The Processor transfers Caller Data outside the European Economic Area only under the safeguards of Chapter V GDPR: an adequacy decision (including the EU–US Data Privacy Framework) or Standard Contractual Clauses approved by the European Commission, supplemented where needed by a transfer impact assessment and additional measures.
The transfer mechanism for each Sub-processor is stated in Annex III. Copies of the Standard Contractual Clauses can be requested at jiri@linca.io.

10. Audit

The Processor makes available to the Controller all information necessary to demonstrate compliance with this DPA. In the first instance, this is done by providing documentation and answers to written questions.
The Controller, or an independent auditor mandated by the Controller and bound by confidentiality, may audit the Processor at most once in any 12 months, with at least 30 days' written notice, during business hours and without disrupting the Processor's operations. The Controller bears the costs of the audit.
The limits in paragraph 2 do not apply where an audit is required by a supervisory authority or follows a personal data breach.

11. Duration, Return and Deletion

This DPA applies for as long as the User's account exists.
After the account is closed, the Processor deletes all Caller Data within 30 days, and deletes it from backups within a further 30 days, unless Union or Member State law requires its retention.
On request made before the account is closed, the Processor returns the Call Summaries to the Controller in a machine-readable format before deletion.

12. Liability

The liability of the parties under this DPA is governed by Article 82 GDPR and, to the extent permitted by law, by the limitation of liability in Article 10 of the Terms.

13. Final Provisions

This DPA is governed by the laws of the Czech Republic.
The Processor may change this DPA under the procedure in Article 16 of the Terms. The User is informed at least 14 days before a change takes effect and may terminate the Terms if they disagree.
The Czech version of this DPA is decisive.

Annex I – Description of Processing

Item	Description
Subject matter	Answering calls on the Controller's telephone number and delivering Call Summaries to the Controller.
Duration	For as long as the User's account exists, plus the deletion period in Article 11.
Nature of processing	Real-time speech-to-text conversion of the Caller's audio stream, generation of a temporary transcript, generation of the Call Summary, filtering of special categories of data, storage and delivery of the Call Summary, sending of transactional SMS to Callers.
Purpose	Handling the Controller's incoming calls so the Controller knows who called and why, as described in the Information for Callers.
Categories of data subjects	Callers – natural persons who call the Controller's telephone number.
Types of personal data	Telephone number, first name and last name, call time and duration, temporary audio stream (in memory only), temporary transcript, Call Summary.
Special categories of data	Not intended. Call Summaries are automatically filtered to remove special categories of data before storage.
Retention	Audio: not stored. Temporary transcript: deleted immediately after the Call Summary is generated. Call Summary: until deleted by the Controller or the account is closed.

Annex II – Technical and Organisational Measures

Encryption of data in transit (TLS) and at rest.
Role-based access control to production systems and audit logs of access.
Audio streams processed in memory only and never written to disk.
Temporary transcripts deleted immediately after the Call Summary is generated.
Automatic filtering of special categories of data from Call Summaries before storage.
Regular vulnerability monitoring and updates of the systems.
Confidentiality obligations of all persons with access to Caller Data.
Sub-processors bound by data processing contracts with equivalent obligations.
Incident response procedure that ensures the notification in Article 8.
Backups deleted within 30 days of expiry.

Annex III – Sub-processors

Sub-processor	Country	Purpose	Transfer mechanism
Twilio Ireland Ltd. and Telnyx Ireland Ltd.	Ireland / USA	Telephony infrastructure and call routing	EU–US Data Privacy Framework
ElevenLabs, Inc.	USA	Real-time speech-to-text conversion	Standard Contractual Clauses
Google Ireland Ltd.	Ireland / EU	Cloud hosting, databases, generation of Call Summaries	Processing in the EU; EU–US Data Privacy Framework
ProfiSMS s.r.o.	Czech Republic	Transactional SMS to Callers	Processing in the EU

Changelog:

v1.0 (9 June 2026): First publication