Data Processing Agreement
If your organization is subject to GDPR, CCPA, or similar data protection regulations, Convirza can execute a formal Data Processing Agreement (DPA) with you. This page explains our role, what the DPA covers, and how to request one.
Our Role as Data Processor
When you use Convirza, your organization is the data controller. You determine the purpose and means of processing - which calls to record, which data to collect, how long to retain it. Convirza acts as a data processor: we process call recordings, transcripts, and associated metadata strictly on your behalf and according to your instructions.
We do not sell your data. We do not use your call recordings to train models for other customers. Your data is used to deliver the services you have contracted for, and for no other purpose.
GDPR - Data Processing Addendum
For customers operating in the European Union or processing personal data of EU residents, Convirza offers a Data Processing Addendum that meets the requirements of Article 28 of the GDPR. The addendum covers the subject matter and duration of processing, the nature and purpose of the processing, the type of personal data processed, and the obligations and rights of both parties.
Our DPA includes provisions for subprocessor management, data subject rights support, breach notification, and deletion of personal data at the end of the contract. A copy is available on request.
CCPA - Service Provider Terms
For customers subject to the California Consumer Privacy Act, Convirza operates as a service provider as defined under CCPA. We do not sell or share personal information we receive from customers for our own business purposes. We process that information solely to provide contracted services.
CCPA-compliant data processing terms are available within our DPA. Contact us to request them.
How to Request Your DPA
Email privacy@convirza.com with your company name and a brief description of your use case (for example: EU customer data, healthcare, California consumer data). We will respond within two business days with the relevant agreement for your review.
If you have specific requirements - custom retention terms, jurisdiction-specific clauses, or addenda required by your legal team - include that context in your initial message and we will route it appropriately.