How foyai processes personal data for you.
Parties and scope
This Data Processing Addendum (the "DPA") forms part of the agreement between Foyai SAS and the Customer for the foyai service: the foyai Terms of Service, or another written agreement between them (the "Agreement"). It applies whenever Foyai processes Customer Personal Data on the Customer's behalf while providing the Service.
Foyai SAS, a société par actions simplifiée with share capital of €10,000, registered with the Registre du Commerce et des Sociétés of Bergerac under number 108 680 687, with its registered office at 46 route du Monteil, 24680 Lamonzie-Saint-Martin, France ("Foyai"); and the customer that has accepted the Agreement ("Customer").
1. Definitions
1.1 "Data Protection Laws" means the General Data Protection Regulation (EU) 2016/679 (the "GDPR"); the French Loi Informatique et Libertés; the UK GDPR and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection; US state privacy laws such as the California Consumer Privacy Act (the "CCPA"); and any other data protection law that applies to the processing under this DPA.
1.2 "Customer Personal Data" means personal data that Foyai processes on Customer's behalf in providing the Service, as described in Annex 1.
1.3 "Service" means the foyai application and the buyer rooms Customer creates and publishes with it.
1.4 "Subprocessor" means a third party that Foyai engages to process Customer Personal Data.
1.5 "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data.
1.6 "Standard Contractual Clauses" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914.
1.7 "Controller", "processor", "data subject", "personal data", "processing", and "supervisory authority" have the meanings given in the GDPR.
2. Roles
2.1 Customer is the controller of Customer Personal Data, or a processor acting for its own controller, and Foyai is its processor.
2.2 Foyai is an independent controller of the personal data it processes for its own purposes: Customer's account, sign-in, and billing details; support and sales communications; visitors to foyai.com; and information about how the Service is used, which Foyai uses to secure, run, and improve it. Foyai's privacy policy covers that data, and this DPA does not.
3. Customer's responsibilities
3.1 Customer is responsible for having a lawful basis for the processing, for giving data subjects the information that Data Protection Laws require, including the people who visit Customer's rooms, and for the accuracy of Customer Personal Data.
3.2 Customer will not use the Service to process special categories of personal data under Article 9 GDPR or personal data relating to criminal convictions and offences under Article 10 GDPR.
3.3 Customer's instructions to Foyai will comply with Data Protection Laws.
4. Processing on Customer's instructions
4.1 Foyai processes Customer Personal Data only on Customer's documented instructions, including with regard to transfers to a third country, unless EU or Member State law requires Foyai to do otherwise. In that case, Foyai will tell Customer about that requirement before processing, unless the law prohibits it.
4.2 Customer's instructions are: the Agreement and this DPA; Customer's use and configuration of the Service, including what its users connect, draft, publish, share, and delete; and any other written instructions that Foyai agrees to.
4.3 Foyai will tell Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.
4.4 Annex 1 describes the subject matter, duration, nature, and purpose of the processing, and the categories of personal data and data subjects.
5. Confidentiality
Foyai ensures that everyone it authorizes to process Customer Personal Data has committed to confidentiality or is under an appropriate legal obligation of confidentiality, and has access only as needed to provide the Service.
6. Security
6.1 Foyai implements and maintains the technical and organizational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 GDPR.
6.2 Foyai may update these measures, provided that the overall level of protection of Customer Personal Data is not reduced.
6.3 Customer is responsible for the security choices within its control, including which of its team members have access to the Service, the access settings of each room, and who it shares room links with.
7. AI processing
7.1 Foyai uses AI models, provided by the Subprocessors listed in Annex 3, for features of the Service such as drafting rooms from call transcripts and Attio records.
7.2 Foyai does not use Customer Personal Data to train or improve AI models, and does not allow its Subprocessors to do so.
7.3 Content drafted with AI is presented to Customer's users for review, and is shown to buyers only after a user publishes it.
8. Subprocessors
8.1 Customer gives Foyai a general authorization to engage Subprocessors. The current Subprocessors are listed at foyai.com/subprocessors (Annex 3).
8.2 Foyai will give at least 30 days' notice before adding or replacing a Subprocessor, by updating that list and emailing Customer's workspace administrators.
8.3 Customer may object to a new Subprocessor on reasonable data protection grounds within that notice period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Service and receive a refund of any prepaid fees for the period after termination, as its sole remedy for the objection.
8.4 Foyai imposes on each Subprocessor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and remains fully liable to Customer for each Subprocessor's performance of those obligations.
8.5 Tools that Customer chooses to connect to the Service, such as its Attio workspace, Google Drive and Google Slides, Slack, and call recorders, are not Subprocessors. Data moves between the Service and those tools on Customer's instruction, and those providers process it under Customer's own terms with them.
9. International transfers
9.1 Foyai is established in France. The Service's application servers run in the United States, and Subprocessors process Customer Personal Data in the locations listed at foyai.com/subprocessors.
9.2 When Foyai transfers Customer Personal Data to a Subprocessor outside the European Economic Area, the United Kingdom, or Switzerland, Foyai ensures that the transfer is covered by an adequacy decision, including the EU–US Data Privacy Framework and its UK and Swiss extensions where the Subprocessor is certified under them, or by the Standard Contractual Clauses (Module 3, processor to processor) entered into with the Subprocessor, together with any supplementary measures that are needed.
9.3 When Customer is located outside the European Economic Area and Foyai's transfer of Customer Personal Data to Customer is a transfer subject to Chapter V GDPR, the Standard Contractual Clauses (Module 4, processor to controller) are incorporated into this DPA by reference, with Foyai as data exporter and Customer as data importer. For that module, the governing law and courts are those set out in section 16.3, and Annexes 1 to 3 of this DPA complete the appendix to those clauses.
10. Assistance
10.1 Taking into account the nature of the processing, Foyai will assist Customer by appropriate technical and organizational measures, insofar as this is possible, to respond to requests from data subjects exercising their rights under Data Protection Laws.
10.2 If Foyai receives such a request directly about Customer Personal Data, it will pass the request to Customer without undue delay and will not respond to it, except to direct the data subject to Customer, unless the law requires otherwise.
10.3 Taking into account the nature of the processing and the information available to it, Foyai will give Customer reasonable assistance with its obligations under Articles 32 to 36 GDPR: security of processing, notification of personal data breaches, data protection impact assessments, and prior consultation with a supervisory authority.
11. Security Incidents
11.1 Foyai will notify Customer of a Security Incident without undue delay, and in any event within 48 hours, after becoming aware of it.
11.2 The notice will describe, as far as is then known: the nature of the Security Incident; the categories and approximate number of data subjects and records concerned; its likely consequences; and the measures taken or proposed to address it. Information that is not available at first will follow as it becomes available.
11.3 Foyai will take reasonable steps to contain the Security Incident and limit its effects. Foyai's notice is not an admission of fault or liability.
11.4 Foyai will send notices to Customer's workspace administrators by email, or to another contact that Customer gives Foyai in writing.
12. Return and deletion
12.1 Customer can delete individual rooms, and its whole workspace, in the Service at any time.
12.2 When the Service ends, or earlier on Customer's written request, Foyai will delete Customer Personal Data within 30 days, unless EU or Member State law requires Foyai to keep it. If Customer asks before deletion, Foyai will first return a copy of the Customer Personal Data held in the Service in a commonly used, machine-readable format.
12.3 Copies held in backups and logs are deleted as they expire on their normal schedules, and in any event within 90 days. Until then, they remain protected by this DPA and are not otherwise processed.
12.4 Data that the Service has already written to Customer's own tools, such as its Attio workspace, is under Customer's control and stays there until Customer removes it.
13. Information and audits
13.1 Foyai will make available to Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, including by answering Customer's reasonable security and privacy questionnaires.
13.2 If that information is not enough to demonstrate compliance, or a supervisory authority requires it, Customer, or an independent auditor bound by confidentiality who is not a competitor of Foyai, may audit Foyai's compliance with this DPA. Audits require at least 30 days' written notice, take place no more than once in any 12-month period unless a Security Incident or a supervisory authority requires otherwise, are conducted during normal business hours without unreasonable disruption, and are at Customer's expense.
13.3 Audits do not extend to Subprocessors' facilities. Where it is able to, Foyai will share the Subprocessors' own audit reports or certifications.
14. US state privacy laws
Where the CCPA or a similar US state law applies, Foyai acts as Customer's service provider or processor. Foyai will not: sell or share Customer Personal Data, as those terms are defined in the CCPA; retain, use, or disclose it for any purpose other than providing the Service, or outside the direct business relationship between the parties; or combine it with personal data received from other sources, except as those laws permit. Foyai will tell Customer if it can no longer meet these obligations, and certifies that it understands and will comply with them.
15. Liability
Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent that Data Protection Laws do not permit such limitation.
16. Term, order of precedence, and governing law
16.1 This DPA remains in effect for as long as Foyai processes Customer Personal Data under the Agreement.
16.2 If this DPA conflicts with the Agreement, this DPA prevails with respect to the processing of Customer Personal Data. If it conflicts with any Standard Contractual Clauses that apply, the Standard Contractual Clauses prevail.
16.3 This DPA is governed by French law. The courts of Paris have exclusive jurisdiction over any dispute arising out of or relating to it, unless Data Protection Laws or applicable Standard Contractual Clauses require otherwise.
16.4 Foyai may update this DPA to reflect changes in Data Protection Laws or in the Service by giving Customer's workspace administrators at least 30 days' notice. No update will reduce the protection of Customer Personal Data. A copy of this DPA signed by both parties can be changed only in writing signed by both parties.
17. Acceptance
This DPA becomes part of the Agreement when Customer accepts the foyai Terms of Service, without needing a signature. If Customer would like a copy signed by both parties, Foyai will provide one signed on its behalf for Customer to countersign. Email support@foyai.com.
Annex 1: Details of the processing
CRM content: deal, company, and person records, and notes that relate to individuals.
Calls: titles, dates, participants, and transcripts, which can include anything said on a call.
Room activity: the email address entered to access a room; the sections, files, and slides viewed and for how long; links clicked; videos played; action-plan steps completed; approximate location (city, region, and country) derived from the IP address, which is not stored; and a random browser identifier.
User details: what Customer's users add for buyers (title, phone number, LinkedIn profile, booking link, photo, and bio), their Google account email and the Drive files they select, and their Slack user ID.
Room content: any personal data contained in content that Customer's users add to rooms.
Annex 2: Technical and organizational measures
Encryption.
- The application and all rooms, including rooms on a customer's own domain, are served only over HTTPS.
- Connection tokens for Attio, Google, and Slack, webhook secrets, and call-recorder API keys are encrypted at rest with AES-256-GCM.
- The database and file storage are hosted by providers that encrypt data at rest.
Access to Customer's tools.
- Access to Customer's Attio workspace is limited to the permissions that Customer's Attio administrator approves, and the administrator can revoke it at any time.
- Access to Google Drive is limited to the files a user selects.
- Call recorders connect with API keys that Customer creates and can revoke.
Room access controls.
- Every room link contains a random code that cannot practically be guessed, and repeated requests for links that don't exist are rate-limited.
- Room pages instruct search engines not to index them, and do not pass the full room link to other sites.
- Customer chooses each room's access setting: an open link, an email domain check, a verified email, allowed domains and listed emails only, or the room's stakeholders only.
- Email verification links are single-use and expire after 15 minutes.
- Rooms can be given an expiry date, unpublished, or archived at any time. Buyers see only the published version of a room, and buyers have no accounts or passwords.
Internal access.
- Access to production systems is limited to Foyai personnel who need it, who are bound by confidentiality and use individual accounts with multi-factor authentication.
- Public endpoints of the Service are rate-limited.
Data minimization.
- Call transcripts are read when needed and kept only where Customer adds them to a room.
- Room visitors' IP addresses are not stored; only an approximate location is kept.
- Data is retained as described in Annex 1.
AI.
- AI models are used through commercial APIs whose terms prohibit training on the data sent to them.
- Every AI draft is reviewed by a user before a buyer can see it.
Availability, monitoring, and incidents.
- Errors in the application and rooms are monitored continuously.
- The database keeps a continuous history for point-in-time restore over the last 7 days, and a daily snapshot is kept for 30 days.
- Security Incidents are handled and notified as set out in section 11.
Subprocessors. Foyai reviews each Subprocessor's security before engaging it and binds it to written data protection terms (section 8.4).
Annex 3: Subprocessors
The current list of Subprocessors, with what each one does and where it processes data, is at foyai.com/subprocessors. Changes follow section 8.