Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between Prime LLC ("Processor" or "Company") and the user of the Service ("Controller" or "Client").

This DPA applies to the processing of Personal Data by Prime LLC on behalf of the Client in the course of providing the Service.

1. Definitions

• "Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data and privacy, including but not limited to the GDPR (General Data Protection Regulation) and applicable UAE data protection laws.
• "Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject") that is processed by the Processor on behalf of the Controller.
• "Sub-processor" means any third party appointed by or on behalf of the Processor to process Personal Data.

2. Roles and Responsibilities

2.1. Roles

The parties acknowledge and agree that with regard to the processing of Personal Data, the Client is the Controller and Prime LLC is the Processor.

2.2. Client's Instructions

Prime LLC shall process Personal Data only in accordance with the documented instructions of the Client, which include the Terms of Service, this DPA, and the functional operation of the Service, unless required to do otherwise by applicable law.

3. Details of Processing

3.1. Subject Matter

The subject matter of the processing is the provision of the AI agent service as described in the Agreement.

3.2. Nature and Purpose

The nature and purpose of the processing are to enable the AI agent to interact with the Client's customers, analyze conversations, and provide business insights.

3.3. Categories of Data Subjects

The Data Subjects are the Client's customers or end-users who interact with the AI agent.

3.4. Types of Personal Data

The Personal Data processed includes conversation history (text, voice, images), social media profile information (name, handle), and derived behavioral/psychological data.

4. Security Measures

Prime LLC shall implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:

• Encryption of data in transit (SSL/TLS) and at rest (AES-256).
• Role-based access controls (RBAC) to limit personnel access.
• Regular security audits and vulnerability assessments.

5. Sub-processing

5.1. Authorization

The Client generally authorizes Prime LLC to engage Sub-processors to process Personal Data. A list of current Sub-processors is available in our Privacy Policy.

5.2. Obligations

Prime LLC shall enter into a written agreement with each Sub-processor imposing data protection terms no less protective than those contained in this DPA.

6. Data Subject Rights

Taking into account the nature of the processing, Prime LLC shall assist the Client by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Client's obligation to respond to requests for exercising the Data Subject's rights (e.g., right of access, rectification, erasure).

7. Personal Data Breach

Prime LLC shall notify the Client without undue delay after becoming aware of a Personal Data Breach affecting the Client's Data. The notification shall describe the nature of the breach, the likely consequences, and the measures taken or proposed to be taken to address the breach.

8. International Transfers

The Client acknowledges that Personal Data may be transferred to and processed in the United States and other countries where Prime LLC or its Sub-processors operate. Prime LLC shall ensure that such transfers comply with applicable Data Protection Laws.

9. Deletion of Data

Upon termination of the Service or as per our data retention policy, Prime LLC shall delete Personal Data as follows:

• Raw Conversation Content (Text & Media): Deleted from active systems 24 hours after the interaction.
• Derived Data, Profile Pictures & Transaction Details: Retained for a period of one (1) year to allow for re-processing and service improvement, after which it is deleted, unless applicable law requires storage.

10. General Provisions

In the event of any conflict between the terms of this DPA and the Terms of Service, the provisions of this DPA shall prevail with regard to the data protection aspects.