This DPA applies when Evnao processes personal data contained in Customer Data on behalf of the Customer to provide the Service. For that Customer Data, the Customer is the controller or processor, as applicable, and Evnao is its processor or subprocessor. Evnao is a separate controller for personal data it collects directly for account administration, billing records it receives, website operation, security, fraud prevention, legal compliance, and its own customer support.
Evnao processes Customer Data only on documented instructions in the Terms, this DPA, the Customer's product configuration, and lawful support requests, unless applicable law requires otherwise. Processing may include collecting, storing, organizing, retrieving, transmitting to authorized providers, generating support output, backing up, exporting, and deleting data for the duration of the Customer's use of the Service and the applicable retention period.
Evnao does not use Customer Data to train or fine-tune Evnao's own general-purpose generative-AI models. Limited operational telemetry may be used to secure, troubleshoot, measure, and improve the Service; this is not model training.
The Customer authorizes the current managed-platform subprocessors below:
Customer-selected Meta, Telegram, Shopify, Zendesk, Calendly, and custom HTTPS connections are engaged on the Customer's instruction and are not automatically enabled for every workspace. Evnao will require subprocessors to protect Customer Data under terms appropriate to their role and will provide reasonable notice of a material new managed-platform subprocessor where practicable.
During an active subscription, available dashboard exports and verified privacy requests provide ways to obtain covered data. On a valid workspace-deletion instruction or termination, Evnao removes eligible Customer Data from active systems according to its deletion workflow and retention schedules. Encrypted backups age out under their plan or platform schedule. When a whole workspace is deleted, destroying its tenant backup key makes that workspace's remaining encrypted backup payloads cryptographically inaccessible.
Deletion is subject to technical sequencing, legal holds, tax and accounting obligations, fraud and security records, and data a provider must retain under its own applicable terms. Details are in the User Data Deletion Policy .
The Customer instructs Evnao to transfer Customer Data where needed to operate the Service and authorized integrations. Where a restricted transfer requires a legal mechanism, the parties will use an applicable mechanism, which may include the EU Standard Contractual Clauses and the UK Addendum. Data subject to Jordan's Personal Data Protection Law will be transferred in accordance with applicable Jordanian requirements.
Where applicable, Evnao acts as a service provider or contractor for Customer Data. Evnao will not sell or share that Customer Data for cross-context behavioral advertising and will not retain, use, or disclose it outside the business purposes and instructions described in the agreement, except as permitted by law.
On reasonable written request and subject to confidentiality, Evnao will provide information reasonably necessary to demonstrate compliance with this DPA. One audit per year may be requested unless a confirmed incident or law reasonably requires more. Remote review and available reports are used before an on-site audit. The Terms govern liability; this DPA controls if its data-processing terms conflict with the Terms.
By using Evnao to process Customer Data, the Customer instructs Evnao to perform the processing described in this DPA.