This Data Processing Agreement (DPA) is an integral part of the Terms of Service between the Customer (“Controller”) and Stagee (“Processor”). It applies whenever Stagee processes personal data on behalf of the Customer. Required under Article 28 GDPR and aligned with CNPD guidance.
1. Definitions
- Capitalized terms have the meaning given in the GDPR.
- Controller: the Customer. Processor: Stagee. Sub-processor: another entity engaged by Stagee.
- Data Subject: the natural person whose data is processed - here, mainly the end-caller.
2. Subject matter and duration
This DPA governs the processing of personal data by Stagee on behalf of the Customer within the scope of using the Stagee platform. Duration matches the Terms of Service.
3. Nature, purpose, and categories of data
Stagee processes personal data to answer calls, understand requests via ASR and NLU, register reservations, answer FAQs, transfer calls, and provide records in the portal.
Data subjects: end-callers and restaurant staff.
Categories of personal data: call audio (recorded and stored in a private Cloudflare R2 bucket with EU jurisdiction, 90-day retention with automatic deletion), transcribed conversation text, reservation data (name, party size, date, time, preferences, allergies), caller phone number (stored only as irreversible cryptographic hash), and technical metadata.
We do not process special categories (Article 9 GDPR) by design. Allergies are only recorded in the booking notes when the caller mentions them in the context of making a reservation.
4. Processor obligations
- Process data only on the Customer's documented instructions.
- Ensure confidentiality of authorized personnel.
- Implement appropriate technical and organizational measures (Section 7).
- Not engage sub-processors without authorization (Section 5).
- Assist with data subject requests (Section 6).
- Notify breaches without undue delay (Section 8).
- Return or delete data at end of contract (Section 10).
- Provide information to demonstrate compliance.
5. Sub-processors
5.1 General authorization
The Customer authorizes Stagee to engage the sub-processors listed at sub-processors.
5.2 New sub-processors
30 days' email notice to active customers. The Customer may object. If a reasonable objection cannot be resolved, the Customer may terminate without additional cost.
5.3 Liability chain
We ensure sub-processors are bound to equivalent obligations through written contracts. Stagee remains liable to the Customer for sub-processor acts and omissions.
6. Data subject rights
Requests go to the Controller (the restaurant). If a request reaches Stagee directly, we forward it to the correct restaurant without delay and assist the restaurant to respond within 30 days. We do not respond directly to data subjects unless the Customer explicitly authorizes us or we are legally required to.
7. Technical and organizational measures
- Encryption in transit (HTTPS/TLS 1.2+) and at rest (AES-256).
- Application-layer field encryption for sensitive fields.
- Call audio in private Cloudflare R2 bucket (EU jurisdiction), accessible only via short-lived signed URLs.
- Per-restaurant isolation via organization_id.
- Phone numbers as irreversible HMAC-SHA256 hashes with restaurant-specific salt.
- Restricted admin access with mandatory two-factor authentication (2FA).
- Append-only audit log of all administrative actions.
- Database backups being configured. RTO target 24h.
- Annual reassessment. ISO 27001 / SOC 2 on the roadmap at appropriate scale.
8. Personal data breach
On detection: notification to the affected Customer without undue delay, no later than 24 hours after becoming aware. We provide nature, categories and approximate number of subjects and records affected, likely consequences, and mitigation. We cooperate with the Customer's CNPD notification (72-hour rule) and, where applicable, notification to data subjects.
9. International transfers
Sub-processors outside the EU/EEA: transfers via European Commission SCCs (Article 46 GDPR). Current main case: Resend (US-based). Speech-to-text (Soniox, AssemblyAI), language (Google Gemma, OpenAI) and text-to-speech (Cartesia) models run in the EU through LiveKit Inference. Additional measures: minimization, encryption, annually reviewed Transfer Impact Assessment (TIA). LiveKit hosted in Frankfurt (EU); Vercel and the database (Supabase) in Ireland (EU); Cloudflare R2 with EU jurisdiction. Cartesia and Telnyx DPAs are incorporated in their respective Terms of Service.
10. Return or deletion at end of contract
Stagee makes an export available to the Customer for 30 days in structured format, then deletes all personal data except where legally required to retain (billing, accounting). A written deletion certificate is available on request.
11. Audit
The Customer has the right to audit. We share documentary information on our measures at any time. On-site audits require 30 days' notice, during business hours, without disrupting operations. Costs are the Customer's unless the audit reveals material breach. For most cases, summaries of internal audits and compliance reports are shared.
12. Limitation of liability
Limited as per Section 9 of the Terms of Service, except for: fines imposed on the Customer by CNPD or another supervisory authority for a violation directly caused by Stagee's material breach of this DPA, and damages caused by willful misconduct or gross negligence.
13. Final provisions
In case of conflict between this DPA and the Terms of Service, this DPA prevails on data protection matters. Portuguese law; venue: Porto. Privacy contact: hello@stagee.ai.