Cleo Data Processing Agreement

Effective date: October 26, 2026

This Data Processing Agreement (the "Agreement") is part of the Cleo Terms and Conditions of Service (the "Terms") between Ova Performance LLC, a Wyoming limited liability company, with its address at 30 N Gould St, Sheridan, WY 82801, United States, doing business as "Cleo" ("Cleo"), and the customer that accepts the Terms (the "Customer").

It applies automatically when the Customer accepts the Terms. If the Customer needs a signed copy, it can request one at hello@cleodesk.com.

This English version is the official version. The Spanish version is a translation.

1. Definitions

Capitalized words not defined here have the meaning given in the Terms.

• Customer Personal Data: any information about an identified or identifiable person that Cleo processes on behalf of the Customer when providing the Service. For example, the name, number or messages of someone who calls or writes to the Customer's business.
• Data Protection Laws: all privacy and data protection laws that apply to the processing of Customer Personal Data, including, where they apply, the EU General Data Protection Regulation (GDPR), its UK version, the Swiss data protection law, the California Consumer Privacy Act as amended by the CPRA (CCPA) and similar US state laws.
• Controller: the party that decides why and how data is processed. Here, the Customer.
• Processor: the party that processes data on behalf of the controller. Here, Cleo. Under California law, Cleo is a "service provider".
• Subprocessor: a provider Cleo engages that processes Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Standard Contractual Clauses (SCCs): the clauses approved by European Commission Implementing Decision (EU) 2021/914 of June 4, 2021.

2. Scope and roles

2.1. This Agreement applies only to Customer Personal Data. It does not apply to data Cleo processes as a controller, such as the Customer's account data, billing or Service security; those are governed by Cleo's Privacy Policy.

2.2. The Customer is the controller and Cleo is the processor. If the Customer itself acts as a processor for another controller, Cleo is its subprocessor, and the Customer warrants that it has that controller's authorization.

2.3. The details of the processing (what data, about whom, why and for how long) are in Annex 1.

3. Customer obligations

3.1. The Customer is responsible for having a legal basis for Cleo to process Customer Personal Data, and for giving people the notices and obtaining the consents the law requires. This includes the notice that an AI is speaking, call recording notice and consent, and consent to receive text messages, as explained in section 12 of the Terms.

3.2. The Customer's instructions must comply with the law. The Customer must not send Cleo special categories of data or HIPAA-protected health information, except what people say on their own during a conversation.

4. Cleo obligations

4.1. Instructions only. Cleo processes Customer Personal Data only on the Customer's documented instructions. The Terms, this Agreement, the settings the Customer chooses in the Service and its reasonable written requests are those instructions. If the law requires Cleo to process data otherwise, it will tell the Customer first, unless the law prohibits it.

4.2. Unlawful instructions. If Cleo believes an instruction violates Data Protection Laws, it will tell the Customer and may decline to follow it until the Customer confirms or changes it.

4.3. California commitments. Cleo does not:

• sell or "share" (for cross-context behavioral advertising) Customer Personal Data;
• retain, use or disclose it for any purpose other than providing the Service to the Customer, or outside its direct business relationship with the Customer;
• combine it with personal information it receives from others or collects on its own, except as the law allows a service provider.

Cleo will comply with the obligations the CCPA places on service providers, will notify the Customer if it can no longer meet them, and allows the Customer to take reasonable steps to stop unauthorized use.

4.4. Model improvement. Cleo uses Customer Personal Data to train its own models only if an account owner turns on "Help improve Cleo's models", which is off by default, and always after removing personal data. Cleo does not allow its AI providers to train their models on Customer Personal Data.

4.5. Confidentiality. Cleo ensures that people who can access Customer Personal Data are bound by confidentiality and access it only when needed to provide the Service, give support the Customer asked for, investigate security or abuse, or comply with the law.

5. Security

5.1. Cleo applies technical and organizational measures appropriate to the risk to protect Customer Personal Data. The current measures are in Annex 2.

5.2. Cleo may update those measures, as long as they do not materially reduce the overall level of protection.

6. Subprocessors

6.1. General authorization. The Customer authorizes Cleo to engage subprocessors. The types of subprocessors are in Cleo's Privacy Policy, and the list with names is in Annex 3, which Cleo gives the Customer on request.

6.2. Contracts. Cleo signs a contract with each subprocessor with data protection obligations no less protective than those in this Agreement, as they apply to its service.

6.3. Changes. Cleo will notify the Customer by email or in the Service at least 30 days before adding or replacing a subprocessor. In an emergency (for example, to keep the Service running if a provider fails), Cleo may make the change sooner and will notify as soon as possible.

6.4. Objection. The Customer may object to a new subprocessor in writing, on reasonable data protection grounds, within those 30 days. The parties will look for a solution in good faith. If there is none, the Customer may cancel the affected part of the Service, and Cleo will refund what was prepaid for that part and not used.

6.5. Responsibility. Cleo is responsible to the Customer for its subprocessors' compliance, within the limits of the Terms.

6.6. Services the Customer connects. Google, Microsoft, Meta and other services the Customer chooses to connect are not Cleo's subprocessors. They are the Customer's services, governed by their own terms.

7. Individuals' rights

7.1. Taking into account the nature of the processing, Cleo will help the Customer, with reasonable technical and organizational measures, respond to individuals' requests to access, correct, delete, restrict, object to or port their data. The Service already lets the Customer search, export, correct and delete data on its own.

7.2. If a person contacts Cleo directly about data it processes for the Customer, Cleo will tell them to contact the Customer or will pass the request to the Customer. Cleo will not answer the request on its own unless the Customer authorizes it or the law requires it.

8. Security incidents

8.1. Cleo will notify the Customer without undue delay, and where possible within 72 hours, after confirming a Security Incident affecting Customer Personal Data.

8.2. The notice will include, to the extent Cleo knows: what happened, the types and approximate amount of data and people affected, the likely consequences, what Cleo has done or will do to address it, and a contact. If it does not have all the information right away, Cleo will provide it in phases.

8.3. Cleo will take reasonable steps to contain the incident and reduce its effects.

8.4. Cleo's notice is not an admission of fault.

8.5. The Customer is responsible for notifying authorities and individuals where the law requires. Cleo will give it the reasonable information it has to do so.

9. Impact assessments and consultations

Cleo will give the Customer the reasonable information it has about the Service so the Customer can carry out data protection impact assessments or prior consultations with an authority, where the law requires.

10. Deletion and return of data

10.1. While the account is active, the Customer can export and delete its data from the Service.

10.2. When an owner deletes the account, the business can be restored for 30 days. After that, Cleo permanently deletes Customer Personal Data from its active systems.

10.3. Copies in the database restore history are deleted when that history expires, within 30 days at most. Copies held by subprocessors are deleted on their own schedules, described in the Privacy Policy. Until then they remain protected by this Agreement and are not used for anything else.

10.4. Cleo may keep data the law requires it to keep, such as billing or tax records, and only for that purpose.

11. Audits and information

11.1. On request, Cleo will give the Customer the reasonable information needed to show it complies with this Agreement.

11.2. Once a year, at the Customer's request, Cleo will answer a reasonable security questionnaire and provide a written summary of its security measures. Information Cleo provides is confidential.

11.3. There are no on-site audits or access to Cleo's systems, unless a data protection authority requires one, or the SCCs require one and the information above is not enough. In that case: (a) the Customer gives at least 30 days' notice; (b) the scope is agreed in advance; (c) it takes place during business hours, without affecting the Service or other customers' data; (d) it is done by the Customer or an independent auditor bound by confidentiality; (e) no more than once a year, except after a Security Incident; and (f) the Customer pays the cost.

12. International transfers

12.1. Cleo and most of its subprocessors are in the United States. The Customer authorizes Customer Personal Data to be processed in the United States and in the countries where subprocessors operate.

12.2. EEA data. Where a transfer of Customer Personal Data from the European Economic Area to Cleo requires a transfer mechanism, the SCCs apply and are incorporated into this Agreement as follows: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. For the SCCs:

• the Clause 7 option (docking clause) applies;
• in Clause 9, Option 2 (general authorization) applies, with the 30-day notice in section 6.3;
• the Clause 11 option does not apply;
• in Clause 13, the supervisory authority is the one of the Member State where the Customer or its representative is located;
• in Clauses 17 and 18, the law of Ireland applies and the courts of Ireland have jurisdiction;
• the annexes to the SCCs are completed with Annexes 1, 2 and 3 of this Agreement.

12.3. UK data. The International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner's Office (ICO) applies, completed with the information in this Agreement.

12.4. Swiss data. The SCCs apply with the changes Swiss law requires: the authority is the Federal Data Protection and Information Commissioner, and references to "Member State" include Switzerland.

12.5. If Cleo certifies under the EU-US Data Privacy Framework or another valid mechanism, it may rely on it instead of the SCCs.

12.6. If the SCCs and this Agreement conflict, the SCCs control.

13. Liability

Each party's liability under this Agreement is subject to the limits in section 20 of the Terms, except where Data Protection Laws or the SCCs do not allow it to be limited.

14. Term

This Agreement lasts as long as Cleo processes Customer Personal Data and ends when Cleo has deleted it as explained in section 10.

15. Governing law

Except as the SCCs provide, this Agreement is governed by the same law and resolved by the same process as the Terms (Wyoming law and AAA arbitration).

16. Order of precedence

If there is a conflict, the SCCs (where they apply) control first, then this Agreement, then the Terms.

Annex 1. Details of processing

Parties: the Customer (controller or processor) and Cleo (processor or subprocessor), with the contact details in the Terms and the Customer's account.

People whose data is processed:

• customers and prospective customers of the Customer's business who call, text, email or message through WhatsApp, Messenger or Instagram;
• people who fill out the Customer's ad forms;
• members of the Customer's team who receive transferred calls.

Types of data:

• phone numbers, names, emails, Meta usernames or identifiers;
• content of calls (live audio and transcript), texts, emails, messages and files;
• appointments, requests, addresses and notes that come out of the conversation;
• technical delivery data (dates, statuses, message identifiers).

Sensitive data: not sought. It may appear if a person says it on their own.

Recordings: the voice provider keeps the audio and transcript of the calls Cleo answers for up to 2 years. Recordings of transferred calls are deleted from the telephony provider as soon as they are transcribed.

Purpose: answering calls and messages on behalf of the Customer, booking appointments, recording contacts and leads, summarizing conversations, alerting the Customer's team, sending the replies the Customer or its Cleo agent approves, and the other Service features the Customer turns on.

Processing operations: receiving, storing, organizing, transcribing, analyzing with AI to produce replies, displaying to the Customer's team, and deleting.

Frequency: continuous, while the Customer uses the Service.

Duration: while the account is active, plus the periods in section 10 and in the Privacy Policy.

Annex 2. Security measures

• Encryption in transit: all traffic uses HTTPS and TLS, including the IMAP connection with Gmail.
• Encryption at rest: the database encrypts stored data. In addition, connected account credentials, app passwords and two-step verification secrets are encrypted at the application level.
• Passwords: stored only as one-way hashes.
• Isolation: each customer's data is kept separate from other customers.
• Staff access: limited to those who need it, with access logging. The internal operations panel only opens from authorized devices, behind an access check with an email code and a passkey or authenticator app, and asks for an extra verification step for sensitive actions.
• Customer authentication: two-step verification available, attempt limits and sign-in logs.
• Abuse protection: rate limits and signature verification on connections that receive data from providers (for example, Meta and the telephony provider).
• Minimization: transfer recordings deleted after transcription; personal data removed before any training of Cleo's own models.
• Providers: every subprocessor is under contract with data protection obligations.
• Monitoring: error reporting and automatic provider health checks.
• Incident response: a process to investigate, contain and notify, as described in section 8.

Annex 3. Subprocessors

Cleo's Privacy Policy describes the types of subprocessors. The list with names is not public: it is given to the Customer on request at hello@cleodesk.com.

Signatures (only if the Customer asks for a signed copy)

Ova Performance LLC (Cleo)
Name: ______________________
Title: ______________________
Date: ______________________

Customer: ______________________
Name: ______________________
Title: ______________________
Date: ______________________