Data processing agreement (DPA)
This English translation is provided for convenience only. In the event of any discrepancy, the Spanish version prevails and is the only legally binding text.
Version 1.0 · Last updated: 25 October 2026
This agreement (Art. 28 of Regulation (EU) 2016/679, "GDPR", and Spanish Organic Law 3/2018) forms part of the Terms and conditions and is accepted when signing up for or subscribing to DevRoam. On data protection matters it prevails over the Terms.
1. Parties
Controller: the business that subscribes to DevRoam ("Customer"). Processor: NICOLAS CIERI, NIE Z2248368P, Avenida España 230, Local Derecha, 29680 Estepona (Málaga), Spain, trading as DevRoam ("DevRoam"). Contact: privacidad@devroam.com.
2. Subject matter, nature and purpose
DevRoam processes personal data on the Customer's behalf solely to provide the subscribed service: answering inbound calls with an AI voice assistant, managing appointments and messages, sending confirmations, reminders and notifications by WhatsApp, email or push notification, collecting booking deposits if the Customer enables them, and showing all of this to the Customer in the app and its integrations.
3. Duration
For as long as the Customer's account is active (including the free trial) and, afterwards, only for the time needed to return or delete the data under clause 12.
4. Categories of data subjects and data
- Data subjects: people who call, message or book with the Customer (its customers, patients or prospects) and members of the Customer's team that it adds.
- Data: phone number, name and, if provided, email; voice during the call; transcript and, only if the Customer enables it, call recording; appointment details (service, staff member, date, notes, party size) and messages; content of messages sent; technical call data (time, duration, outcome).
- Special categories: DevRoam does not request them, but a data subject may mention them (for example, the reason for a medical appointment). The Customer decides whether its configuration collects them and is responsible for having a legal basis.
5. Customer (controller) obligations
- Have a legal basis for the processing and inform data subjects (including about recording, if enabled).
- Give lawful, documented instructions; the app configuration and these Terms are its instructions.
- Handle data subject requests, with DevRoam's assistance.
6. DevRoam (processor) obligations
- Process the data only on the Customer's documented instructions, including regarding international transfers, unless required by law, in which case it will inform the Customer beforehand unless legally prohibited.
- Inform the Customer if it believes an instruction infringes data protection law.
- Not use the data for its own purposes or to train AI models.
- Keep a record of processing activities as processor (Art. 30(2) GDPR).
7. Confidentiality
DevRoam ensures that persons authorised to process the data have committed to confidentiality or are under a statutory obligation of confidentiality, including after their engagement ends.
8. Security
DevRoam implements technical and organisational measures appropriate to the risk (Art. 32 GDPR), including: encryption in transit (HTTPS/TLS) and at rest (encrypted database, backups and storage); isolation of each Customer's data; app access with authentication and roles; internal access restricted on a least-privilege basis; activity logging; backups; and signed outgoing webhooks. Measures are reviewed and may be updated provided the level of protection is not reduced.
9. Sub-processors
The Customer gives a general authorisation for DevRoam to engage the sub-processors listed below. DevRoam imposes on each, by contract, data protection obligations equivalent to those in this agreement and remains liable to the Customer for their compliance. DevRoam will give at least 15 days' notice of any addition or replacement of sub-processors by updating this page and emailing the account owner; the Customer may object on reasonable grounds by writing to privacidad@devroam.com and, if no solution is found, cancel the service without penalty.
| Provider | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database, storage, authentication, email (SES), SMS (End User Messaging; disabled) and fallback language model (Bedrock) | EU: Ireland (eu-west-1); Bedrock fallback in Frankfurt (eu-central-1) | Not applicable (EEA) |
| Anthropic | Language model that generates the assistant's replies | USA | EU-US Data Privacy Framework or standard contractual clauses |
| Deepgram | Real-time speech transcription | USA | EU-US Data Privacy Framework or standard contractual clauses |
| ElevenLabs | Speech synthesis | USA / EU | EU-US Data Privacy Framework or standard contractual clauses |
| xAI | Fallback speech transcription and synthesis | USA | Standard contractual clauses |
| DIDWW | Phone numbers and call transport (carrier) | As per carrier contract | Standard contractual clauses where data leaves the EEA |
| Twilio | Fallback SMS (disabled) | USA | EU-US Data Privacy Framework or standard contractual clauses |
| Meta Platforms (WhatsApp Business) | WhatsApp confirmation, reminder and notification messages | EU / USA | EU-US Data Privacy Framework or standard contractual clauses |
| Stripe | Subscription billing and, if the business enables them, booking deposits (Stripe Connect) | EU / USA | EU-US Data Privacy Framework or standard contractual clauses |
| Google (Firebase Cloud Messaging) | Push notifications for the Android app | USA | EU-US Data Privacy Framework |
| Apple (APNs) | Push notifications for the iOS app | USA | EU-US Data Privacy Framework |
| Google (Calendar) / Microsoft (Outlook) | Only if the business connects its calendar: reading availability and creating appointments | USA / EU | EU-US Data Privacy Framework |
10. Assistance to the Customer
Taking into account the nature of the processing, DevRoam will help the Customer respond to data subject requests (access, rectification, erasure, objection, restriction and portability); the app lets the Customer view and delete any customer's data. It will also assist with security, data protection impact assessments and prior consultation with the supervisory authority. If a data subject contacts DevRoam directly, DevRoam will refer them to the Customer.
11. Personal data breaches
DevRoam will notify the Customer without undue delay and in any event within 48 hours of becoming aware of a personal data breach, with the information available (nature, categories and approximate number of data subjects and records, likely consequences and measures taken or proposed), so that the Customer can meet its notification obligations (Arts. 33 and 34 GDPR).
12. End of service: return and deletion
When the service ends, and at the Customer's choice, DevRoam will return the personal data in a structured electronic format (on request at privacidad@devroam.com) or delete it, together with existing copies, unless the law requires retention. The Customer can also delete its account from the app. Encrypted backups are deleted in their ordinary rotation cycle and are not used for any other purpose in the meantime.
13. Audits and information
DevRoam will make available to the Customer the information necessary to demonstrate compliance with this agreement and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates who is bound by confidentiality, with reasonable notice of at least 30 days (except in case of a breach or a request from an authority), during business hours and without compromising the security of other customers. Each party bears its own costs.
14. International transfers
Data is stored in the European Union (AWS, Ireland region). Some sub-processors process data outside the European Economic Area, in particular in the USA, to process the voice and text of conversations (see clause 9). These transfers rely on an adequacy decision (EU-US Data Privacy Framework, for certified providers) or on the standard contractual clauses approved by the European Commission, with supplementary measures where appropriate.
15. Liability and governing law
The parties' liability is governed by the Terms and conditions and Art. 82 GDPR. This agreement is governed by Spanish law and disputes are submitted to the courts of Málaga.