1. Roles of the parties
For the personal data processed through the service, you (the customer) act as the controller or business, and Good2Go AI acts as the processor or service provider. Good2Go AI processes personal data only on your behalf and on your documented instructions, and does not sell personal data or use it for its own independent purposes.
2. Subject matter and duration
The subject matter of the processing is the provision of the Good2Go AI receptionist and related messaging services. Processing continues for the duration of your use of the service and ends in accordance with the deletion and return terms below once the service relationship terminates.
3. Nature and purpose of processing
Good2Go AI processes personal data to operate the AI receptionist on your behalf: answering and handling phone calls, sending and receiving messages, capturing leads and enquiries, scheduling, transcribing and summarizing conversations, and providing the associated dashboard, records, and support. Processing is limited to what is necessary to provide these services to you.
4. Categories of personal data
Depending on how you use the service, the personal data processed may include:
- Business and end-customer contact details, such as names, phone numbers, and email addresses;
- Call recordings and transcripts;
- Message content across the channels you enable;
- Enquiry, booking, and intake information your AI agent collects; and
- Related metadata such as timestamps, call duration, and channel identifiers.
5. Categories of data subjects
The data subjects are the individuals whose personal data you process through the service — principally your callers, contacts, leads, and customers, and where relevant your own staff who use or are referenced in the service.
6. Good2Go AI’s obligations as processor
- Documented instructions. Process personal data only on your documented instructions, including as set out in this DPA and the service agreement, unless required to act otherwise by law.
- Confidentiality. Ensure that personnel authorized to process personal data are bound by appropriate confidentiality obligations.
- Security measures. Implement and maintain appropriate technical and organizational measures designed to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, taking into account the nature of the data and the risks involved.
- Assistance with data-subject requests. Provide reasonable assistance to help you respond to requests from data subjects to exercise their rights, taking into account the nature of the processing and the information available to us.
- Breach notification. Notify you without undue delay after becoming aware of a personal data breach affecting the personal data processed on your behalf, with the information reasonably available to us to help you meet your own obligations.
- Deletion or return. On termination of the service, and at your choice, delete or return the personal data processed on your behalf, except to the extent retention is required by law, and delete existing copies in accordance with our retention practices.
7. Sub-processors
You authorize Good2Go AI to engage sub-processors to help provide the service. Each sub-processor is engaged under terms that require appropriate data protection commitments, and Good2Go AI remains responsible for their performance of the processing obligations. The current sub-processors are:
| Sub-processor | Purpose |
|---|---|
| Cloud hosting & infrastructure provider | Cloud hosting and infrastructure (United States) |
| Telephony provider (voice & SMS) | Telephony and SMS messaging |
| AI language-model provider | AI language processing |
| AI voice-synthesis provider | AI voice synthesis |
| Additional AI provider | AI and related processing services |
| Messaging provider (WhatsApp) | WhatsApp messaging channel |
| Payment processor | Payment processing |
| Email delivery provider | Transactional email delivery |
We may update this list as the service evolves. Where we add or replace a sub-processor, we will provide notice through the service or our website so you have the opportunity to review the change.
8. International transfers
Personal data is processed in the United States. If you or your data subjects are located elsewhere, personal data may be transferred to and processed in the United States and other locations where we or our sub-processors operate. Where such transfers require additional safeguards under applicable law, the parties will put appropriate mechanisms in place; your counsel should confirm the mechanisms required for your situation.
9. Audit and cooperation
On reasonable written request, and subject to appropriate confidentiality protections, Good2Go AI will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA and will cooperate with reasonable audit requests, at reasonable intervals and in a manner that does not disrupt the service or compromise the security or confidentiality of other customers’ data.
10. Order of precedence
This DPA supplements the service agreement between you and Good2Go AI. In the event of a conflict between this DPA and the service agreement regarding the processing of personal data, this DPA governs to the extent of the conflict.