Data Processing Agreement

This Data Processing Agreement ("DPA") supplements and is incorporated into the Ovrtxt Terms of Service. It applies when personal data of individuals in the European Economic Area (EEA), United Kingdom, or other jurisdictions with applicable data protection law is processed by Ovrtxt on behalf of the Customer.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person that is processed under the Terms of Service.

"Processing" means any operation performed on personal data, including collection, transmission, storage, and deletion.

"Controller" means the Customer, who determines the purposes and means of processing.

"Processor" means Ovrtxt, who processes personal data on behalf of the Controller.

2. Roles and Responsibilities

The parties acknowledge that for end-user phone numbers submitted through the API, the Customer is the Controller and Ovrtxt is the Processor. Ovrtxt shall process personal data only on the documented instructions of the Customer, which are set out in the Terms of Service and the API documentation.

3. Subject Matter of Processing

• Categories of data subjects: End users of the Customer's application who request authentication.
• Categories of personal data: Phone numbers (E.164 format), session metadata, and inbound SMS delivery timestamps.
• Duration of processing: For the duration of the active session TTL (maximum 300 seconds). Hashed records retained per our Privacy Policy retention schedule.
• Purpose of processing: Delivery of the SMS/RCS-based authentication service.

4. Processor Obligations

Ovrtxt agrees to:

• Process personal data only on Customer's documented instructions;
• Ensure that persons authorized to process personal data have committed to confidentiality;
• Implement appropriate technical and organizational measures per Article 32 GDPR;
• Not engage sub-processors without prior notification to Customer (see Subprocessors list);
• Assist Customer in responding to data subject rights requests;
• Notify Customer without undue delay (within 72 hours) upon becoming aware of a personal data breach;
• Delete or return all personal data upon termination of the agreement.

5. International Data Transfers

For transfers of EEA personal data to the United States, Ovrtxt relies on the EU Standard Contractual Clauses (SCCs) per Commission Implementing Decision 2021/914. The SCCs are incorporated by reference into this DPA and are available upon request from legal@ovrtxt.com.

6. Technical and Organizational Measures

• TLS 1.3 encryption for all data in transit;
• AES-256 encryption for data at rest;
• Cryptographic hashing of phone numbers in persistent storage;
• Role-based access control and least-privilege internal policies;
• Annual third-party penetration testing and vulnerability management program;
• SOC 2 Type II audit in progress (reports available under NDA for Enterprise customers).

7. Sub-processors

Ovrtxt uses third-party sub-processors to deliver the Services. A current list is maintained at ovrtxt.com/subprocessors. Ovrtxt will notify Customers of any material changes to this list with at least 30 days' notice.

8. Contact

Data Protection Officer: privacy@ovrtxt.com

Legal inquiries: legal@ovrtxt.com