Data Processing Agreement

This English version is provided for information as a free translation. The French version is the official legal version. If there is any conflict, the French version prevails.

Purpose

This Data Processing Agreement, or DPA, applies when Bonmoniq processes personal data on behalf of a Professional Customer in connection with the Service.

It forms an integral part of the Professional Terms of Service and applies only to processing for which the Customer acts as controller and Bonmoniq acts as processor under Article 4 GDPR. Processing for which Bonmoniq is itself controller (accounts, billing, security, business verification, audience measurement) is described in the Privacy Policy and is not covered by this DPA.

Parties

Bonmoniq is represented by Dmitrii Poroshkov, President.

Subject matter and duration

Nature and purpose of processing

Bonmoniq processes Customer Content only to provide the Service and according to the Customer's documented instructions.

Categories of data subjects and personal data

The Customer undertakes not to import special categories of data under Article 9 GDPR, criminal-offence data under Article 10 GDPR or children's data through ordinary Service fields, unless there is prior written agreement and documented additional measures.

Voice features may, by their nature, incidentally capture special categories of data expressed by participants. The Customer then remains the controller and is responsible for identifying an Article 9(2) GDPR condition, informing participants and obtaining any consent required by applicable recording rules. Bonmoniq processes such content only as processor, to provide the Service.

Live call captions start automatically with the call in the Telephony module. Neither the Customer nor an employee can turn them off; there is no separate manual start or captions toggle. Speech recognition operated by Bonmoniq turns both parties' speech into text for live display and uses no external speech-recognition or AI provider. Captioning does not itself record the call or create a saved caption transcript. The initial call announcement informs participants about captions together with the recording announcement; there is no separate mid-call captions announcement. Recording controls remain separate: stopping a recording, including by pressing 9 where offered, does not stop captions. The Customer remains responsible for a lawful purpose, proportionality, participant and staff information, any required consent and the handling of objections and other data protection requests. Automatic captioning and the absence of an off switch do not waive these duties or Bonmoniq's duties as processor. Participants may contact the Customer about the processing, or Bonmoniq using the contacts in the Privacy Policy; no user-controlled captions stop is promised. Caption audio is processed transiently in Service memory. Caption text is buffered in the Service and authorized browsers for live display until technical session cleanup after the call; cleanup is not immediate at hang-up and no fixed period is promised. Captions are not archived as a saved caption transcript or audio file, and the separate transcript retention period does not apply to caption text. Any separate recording, saved transcript or AI conversation retains its own retention rules. Associated information and supervisor-read records contain no caption words and follow the retention appropriate to their purpose.

If a participant objects to captions, or required consent is absent or withdrawn, the Customer must end the call rather than continue that processing. Captions cannot be disabled while continuing the call. Ending the call does not itself delete any separate recording or other retained content; applicable requests follow the Privacy Policy and DPA. This policy does not assert that the Service automatically detects an objection or consent status.

Processor obligations

In accordance with Article 28(3) GDPR, Bonmoniq undertakes to comply with the obligations below.

Documented instructions

Bonmoniq processes personal data only on the Customer's documented instructions, including the Terms, this DPA, Workspace settings (for example turning on recording, turning on supervision of automatic live captions, the retention periods chosen or the selection of a Premium voice) and written Customer requests.

If Bonmoniq believes that an instruction infringes the GDPR, the Loi Informatique et Libertés or another applicable provision, Bonmoniq informs the Customer within 5 business days after identifying the issue.

Staff confidentiality

Bonmoniq limits access to personal data to persons who need access to provide the Service or support. These persons are subject to contractual or statutory confidentiality obligations.

Security measures

Bonmoniq applies the Article 32 GDPR security measures described below.

Sub-processors

The Customer gives Bonmoniq a general authorization to use the sub-processors listed in this DPA to provide the Service.

Bonmoniq notifies the Customer of any addition or replacement of a sub-processor at least 30 days in advance by email, in-Service notification or documented update accessible to the Customer. The up-to-date list is the one in the current version of this DPA, published at /en/legal/dpa with its last-updated date.

The Customer may object to a new sub-processor for a documented reason relating to processing location, lack of a transfer safeguard, addition of data categories or an identified security risk. If the objection is not resolved, the Customer may terminate the affected part of the Service before the change takes effect.

Bonmoniq imposes on each sub-processor data protection obligations equivalent to those in this DPA, in accordance with Article 28(4) GDPR.

Assistance with data subject rights

Bonmoniq assists the Customer, taking into account the nature of processing, in responding to requests to exercise rights under Articles 15 to 22 GDPR.

If a data subject sends Bonmoniq a request concerning data processed on behalf of the Customer, Bonmoniq forwards the request to the Customer when the Customer is identifiable, unless a legal obligation requires otherwise.

Assistance with breach notification

Bonmoniq informs the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting data processed on behalf of the Customer.

The initial notice includes the facts known to Bonmoniq at the time of sending and is completed by successive updates when the investigation confirms new information:

• the nature of the breach;
• approximate categories and volumes of affected data;
• likely consequences;
• measures taken or proposed to address the breach;
• Bonmoniq contact point.

The Customer remains responsible for notifications to the supervisory authority and data subjects when acting as controller, unless otherwise agreed in writing.

Assistance with impact assessments

Bonmoniq provides the Customer with the documentation it holds on Service architecture, sub-processors, processing locations, security measures and confirmed incident history, to help conduct a data protection impact assessment where Article 35 GDPR requires it.

Deletion or return

During the contract and during the period of at most 30 days following a deletion request or the end of the contract, the Customer may export Customer Content; the export archive remains available for 7 days. At the end of that period, Bonmoniq deletes Customer Content from the Service it operates, including its infrastructure hosts. Backups of that Service are erased as they rotate, within at most 90 days. Ending paid product access alone is not a deletion request or termination of the processing of retained Customer Content. The return and deletion period starts on a valid deletion request or formal termination of that processing contract. During blocked ordinary access, return or export may be requested through support without granting a free product tier.

Bonmoniq may retain certain data where French or EU law requires it, including for evidence, accounting, security or legal defence.

Copies sent to Cartesia for optional Premium synthesis follow the specific conditions in the sub-processor table. The 90-day return-request window starts on termination of Bonmoniq's agreement with Cartesia, not on closure of an individual Customer Workspace; the 180-day deletion period follows return of the data, not the synthesis request. No fixed deletion deadline counted from each synthesis request has been verified. Bonmoniq forwards applicable Customer deletion or return instructions without undue delay, follows up with Cartesia and provides the Customer with the available status information. In addition, Bonmoniq's policy is to submit to Cartesia, manually and every 90 days, a request to delete the data retained for Bonmoniq's entire Cartesia organization, because Cartesia does not delete this data automatically and has stated that it can process only one such request per organization every 90 days. That interval limits how often a request can be made; it is not a retention period. Cartesia's support stated on 16 October 2026 that each request covers all inputs and outputs retained in its system when the deletion is processed, and that Cartesia completes the deletion within 90 days after the request is submitted. That period runs from the submission of a request, not from an individual synthesis or the closure of a Workspace, so it does not mean that each copy is deleted within 90 days of its creation. Bonmoniq has not independently verified the completion of any deletion by Cartesia. This cadence does not suspend the forwarding and follow-up of the Customer's instructions described above, and it is not a period during which a data-subject request may wait. The general 30-day active-deletion and 90-day backup periods above are not presented as Cartesia's periods. This distinction does not relieve Bonmoniq of its obligations under Article 28 GDPR or limit data-subject rights.

Audits

Bonmoniq makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR.

The Customer may request a documentary audit once per year, with 30 days' notice. If the documentary audit does not verify a specific Article 28 GDPR point, an on-site audit may be organized under a confidentiality agreement, without access to other customers' data, during business hours and with a scope limited to the uncovered point.

Sub-processor list

Sub-processors marked "conditional" are involved only when the Customer uses the service concerned. For a conditional sub-processor not yet activated for Bonmoniq's traffic, the region configured for Bonmoniq's route is verified before activation.

The role of each carrier depends on the purpose and the product concerned. The carriers Twilio, Telnyx and Sinch also act as independent controllers for operating their network, their traffic and usage data, fraud prevention and their legal obligations, and for any processing their agreement assigns to them as controller; in particular, Sinch's agreement (section 3(a)(iv)) treats the transmission of communications as processing for which Sinch is an independent controller. That processing is not covered by this DPA and is described in the Privacy Policy. The country of a number does not guarantee processing in the European Union: a call or message also passes through the networks serving its origin and destination, so the place of processing depends in particular on that destination, not on the country in which Bonmoniq's carrier account is registered or invoiced.

The Premium provider receives neither the caller's voice nor the call transcript. AI reasoning still runs on models operated by Bonmoniq. Live call captions use speech recognition operated by Bonmoniq, use no external speech-recognition or AI provider and add no sub-processor; the hosting providers and carriers listed above keep their roles. Payment, banking and audience measurement providers are not sub-processors for Customer Content.

For the planned WhatsApp Business connection, Bonmoniq uses Telnyx. The Telnyx row above also covers the messaging and WhatsApp Calling processing that its DPA assigns to processing on Bonmoniq's instructions, once activated. Communications also pass through the WhatsApp platform. Under Telnyx DPA section 4.6, transmission through networks and over-the-top platforms does not make every participant a Telnyx sub-processor. Independent-controller processing follows the Privacy Policy and the applicable providers' terms. This provider choice is not a statement that the integration is already active.

International transfers

This DPA does not, by itself, constitute a transfer to a third country: where the Customer and Bonmoniq are both established in the European Union, no Standard Contractual Clauses are concluded between them for that reason.

Where a sub-processor processes data in a third country or gives access to it from there, Bonmoniq covers that transfer by an adequacy decision (including the EU-US Data Privacy Framework, only where that recipient is certified) or by the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914) in the module matching the parties' roles, generally the processor-to-processor module. The instrument chosen for each sub-processor is stated in the list above or will be stated there, and a copy can be requested at privacy@bonmoniq.com.

Bonmoniq does not present this architecture as full independence from US law. US-established sub-processors, or their US parent companies, may be subject to laws such as the CLOUD Act. Bonmoniq applies data minimisation, encryption in transit and at rest, and runs AI reasoning on models it operates.

Liability and indemnification

Each party is liable for breaches attributable to it under the GDPR, the Loi Informatique et Libertés and the contract.

Bonmoniq is not liable for processing determined by the Customer, data imported by the Customer, unlawful Customer instructions or processing carried out by the Customer outside the Service.

Any limitation of liability agreed in the Terms applies to inter-party contractual liability under this DPA within the limits permitted by French law. No such limitation affects the liability of either party towards data subjects under Article 82 GDPR, and it does not apply where prohibited by law.

Term and termination

This DPA takes effect on the date the Customer accepts the Terms. It remains applicable for the duration of processing carried out by Bonmoniq on behalf of the Customer.

The end of the contract ends the DPA after deletion or return of data, except for statutory retention obligations.

Contact

Governing law and jurisdiction

This DPA is governed by French law and EU law applicable to personal data protection, without prejudice to applicable mandatory rules.

For disputes between professionals relating to this DPA, the Paris Commercial Court has exclusive jurisdiction, subject to mandatory contrary provisions.

---

Last updated: 25 October 2026 For any question regarding this document, contact us at legal@bonmoniq.com.