Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between CloudBriz Technologies Ltd. (“Processor,” “CloudBriz,” “we,” “us,” or “our”) and the entity subscribing to the Mediabriz service or to License Manager for Genesys Cloud (“Controller,” “Customer,” or “you”) for the provision of the Mediabriz service, Mediabriz Conversation Intelligence (“Service”), and, where the Customer subscribes to it, License Manager for Genesys Cloud (“License Manager”).

This DPA sets out the terms that apply to the processing of personal data by CloudBriz on behalf of the Customer in connection with the Service and License Manager, in compliance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

License Manager is a separate solution in the Mediabriz family and processes Personal Data differently from the Service. Section 20 applies only to License Manager and, for License Manager, overrides the general sections of this DPA as set out in Section 20.1. Elsewhere in this DPA, “Service” means Mediabriz Conversation Intelligence.

1. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR.
• “Processing” means any operation performed on Personal Data, as defined in Article 4(2) of the GDPR.
• “Data Subject” means the identified or identifiable natural person to whom Personal Data relates.
• “Sub-processor” means any third party engaged by CloudBriz to process Personal Data on behalf of the Customer.
• “Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

2. Roles and Scope

2.1 Roles

• The Customer is the Data Controller and determines the purposes and means of processing Personal Data.
• CloudBriz is the Data Processor and processes Personal Data solely on behalf of the Customer in accordance with this DPA and the Customer’s documented instructions.

2.2 Scope of Processing

CloudBriz processes Personal Data only on documented instructions from the Customer, as reflected in the Customer’s use of the Service, and solely as necessary to provide the Service. CloudBriz does not independently determine the purposes of processing beyond what is necessary to provide the Service.

Such processing may include:

• Media file handling and display within digital conversations
• User-driven features such as annotations, comments, and follow-ups
• Security-related processing such as malware scanning (if enabled)
• Generation of previews and derived media assets
• Usage tracking for billing and service operation purposes
• Sending short agent replies to customers through the Customer’s Genesys Cloud environment, initiated by the Customer’s authorized user from the extension (Inline Reply); the reply text is transmitted directly from the user’s browser to Genesys Cloud using that user’s own Genesys Cloud credentials and is not stored or processed by CloudBriz, which records only a count-only usage event (action type, channel type, organization ID, and user ID). The exception is AI Reply: when the user asks Mediabriz to draft or improve a reply, the conversation’s text messages, and the user’s unsent draft when improving, are sent to the AI model for that request only and are not stored (see AI-assisted analysis below)
• Provision of aggregate, organization-level usage analytics and scan-result reporting to the Customer’s authorized administrators (the Mediabriz Insights dashboard)
• AI-assisted analysis of conversation content (conversation text and, where the Customer’s authorized user explicitly selects them, images shared in the conversation), performed only upon an explicit action by the Customer’s authorized user, to produce a structured draft for that user’s review and approval, or, with AI Reply, a suggested reply that the user sends to the customer by selecting Send in the extension and that is never sent automatically (if enabled and configured by the Customer)
• Delivery of conversation files to a destination the Customer configures (Conversation Actions "send files", if enabled and configured by the Customer), performed only for the files the Customer’s authorized user selects and approves: CloudBriz retrieves each selected file from Genesys Cloud, keeps a temporary copy in the Customer’s data region, and sends the Customer’s configured endpoint a time-limited download link for each file

3. Categories of Data Subjects

Personal Data processed under this DPA may relate to the following categories of data subjects:

• Customer’s authorized users (agents and administrators) who access the Service through Genesys Cloud
• Conversation participants whose metadata appears in conversations processed by the Service

4. Types of Personal Data Processed

This Section 4 describes the Service. The Personal Data processed by License Manager is described in Section 20.4.

4.1 Data We Store

4.2 Data We Do NOT Store

5. Data Storage Locations

This Section 5 describes the Service. For License Manager, see Section 20.5.

5.1 Regional Architecture

CloudBriz operates regionally distributed infrastructure. The Customer’s data region is selected during initial configuration, and data is stored and processed within the selected region, subject to applicable data transfer safeguards.

CloudBriz stores and processes Customer data within the region selected by the Customer. Certain limited operational data that does not contain personal data may be processed in other regions for service operation and billing purposes.

5.2 EU Data Residency

For EU organizations, CloudBriz is designed to store and process operational Personal Data within the EU. This includes conversation records, scan results, annotations, tokens, thumbnails, and temporary scan files. Where the Customer has enabled AI-assisted Conversation Actions, AI model inference for EU organizations is performed through an EU geographic inference profile so that the analyzed conversation content (text and any images selected by the Customer’s authorized user, and the user’s unsent draft when improving a reply with AI Reply) is processed within EU regions. Temporary copies of files delivered through Conversation Actions are stored in, and downloaded from, the EU region for EU organizations.

Certain data that does not contain Personal Data (such as aggregate billing counters) may be stored outside the EU for centralized reporting purposes.

Certain Service features may involve processing by third-party services that operate globally. See Section 15 for applicable transfer safeguards.

The principal example of such third-party processing is the rendering of Office file previews (Word, Excel, PowerPoint), which is performed by Microsoft’s Office Online viewer (view.officeapps.live.com). When a user opens an Office file preview, Microsoft’s servers fetch the file from CloudBriz’s regional media CDN and render it on Microsoft’s global infrastructure; this rendering step is outside CloudBriz’s regional control and applies to both US and EU data-region organizations. Customers requiring strict regional containment for all preview operations may opt out of this processing by blocking outbound traffic to view.officeapps.live.com at the network or proxy level. In that case, Office file preview will be unavailable, but all other Service functionality (image and video preview, downloads, annotations, scanning) will continue to operate normally within the Customer’s selected data region.

6. Data Retention and Deletion

6.1 Retention Principles

CloudBriz retains Personal Data only for as long as necessary to provide the Service and fulfill its contractual and legal obligations.

Personal Data is deleted or anonymized when no longer required, in accordance with automated retention policies and applicable law.

Temporary and processing-related data is retained only for short durations necessary to support the functionality of the Service.

The following categories describe the general nature of data retention:

• Operational data (such as conversation records, scan results, and user annotations) is retained for a limited period and automatically deleted thereafter.
• Temporary processing data (such as document previews, media thumbnails, and scan files) is retained for short durations and automatically removed.
• Billing data consists of aggregate organizational usage counts that do not contain Personal Data and may be retained for reporting and compliance purposes.

A detailed data retention schedule is available upon request by contacting CloudBriz.

6.2 Deletion Upon Termination

Upon termination of the Customer’s subscription, operational data will be deleted in accordance with CloudBriz’s retention policies. Data subject to automated retention will continue to be removed as applicable.

The Customer may request earlier deletion of their organization’s data by contacting CloudBriz. CloudBriz will process such requests within a reasonable timeframe.

7. Confidentiality

CloudBriz ensures that persons authorized to process Personal Data on behalf of the Customer have committed to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to Personal Data is restricted to personnel who require it to perform their role in providing the Service.

8. Processor Obligations

8.1 Instructions

CloudBriz shall process Personal Data only on documented instructions from the Customer, unless required to do so by applicable law. If CloudBriz is required by law to process Personal Data other than on the Customer’s instructions, CloudBriz will inform the Customer of such legal requirement before processing, unless prohibited by law from doing so.

8.2 Notification of Instruction Violations

If, in CloudBriz’s reasonable opinion, an instruction from the Customer infringes applicable data protection laws, CloudBriz will notify the Customer and may suspend the relevant processing until the instruction is clarified or modified.

8.3 Records of Processing Activities

CloudBriz maintains a record of processing activities carried out on behalf of the Customer, in accordance with Article 30(2) of the GDPR, containing:

• The name and contact details of the Processor
• The categories of processing carried out on behalf of the Customer
• Where applicable, transfers of Personal Data to third countries and the documentation of suitable safeguards
• A general description of technical and organizational security measures

9. Third-Party Services and Sub-processors

9.1 Authorized Third-Party Services and Sub-processors

CloudBriz relies on the following third-party services and sub-processors in connection with the Service. The sub-processors for License Manager are listed in Section 20.7.

The Customer acknowledges that Mediabriz is designed to operate in conjunction with Genesys Cloud, which is a required platform dependency of the Service. CloudBriz does not control the operation of Genesys Cloud, does not determine the purposes or means of processing performed independently by Genesys Cloud, and is not responsible for Genesys Cloud’s own data processing activities.

Note on AI model inference. The AI inference sub-processor listed above is engaged only when the Customer has enabled and configured the Conversation Actions feature and one of the Customer’s authorized users explicitly triggers an analysis of a conversation. The conversation text, together with any images from the conversation that the user has explicitly selected for that analysis (subject to a per-organization limit configured by CloudBriz; image analysis may be disabled for the Customer’s organization on request), and, when the user asks AI Reply to improve a reply, the user’s unsent draft, is submitted to the model for inference, processed transiently, and not retained: CloudBriz does not store the analyzed text or images or the model’s draft output or suggested reply, model invocation logging is disabled, and per the provider’s service terms Customer content is not used to train models. For EU data-region organizations, inference is performed entirely within EU regions.

Note on the Microsoft Office Online viewer. The Microsoft sub-processor listed above is engaged only when a user opens an in-app preview for an Office file format (Word, Excel, PowerPoint). The file is rendered in Microsoft’s Office Online viewer at view.officeapps.live.com and processed on Microsoft’s global infrastructure, which is outside CloudBriz’s regional control — this applies to both US and EU data-region organizations. Customers requiring strict regional containment for all preview operations may disable Office file preview by blocking outbound traffic to view.officeapps.live.com at the network or proxy level. In that case, Office file preview will be unavailable, but all other Service functionality (image and video preview, downloads, annotations, scanning) will continue to operate normally. CloudBriz does not determine the purposes or means of any processing performed independently by Microsoft and is not responsible for Microsoft’s own data processing activities beyond the configuration of how Office files are submitted to the Office Online viewer.

9.2 Sub-processor Obligations

Each sub-processor is contractually bound to:

• Process Personal Data only as necessary to perform their services
• Implement appropriate technical and organizational security measures
• Comply with applicable data protection laws

9.3 Changes to Sub-processors

CloudBriz may update its list of sub-processors from time to time. CloudBriz will provide notice of any new sub-processor by updating the list on its website or through other reasonable means.

The Customer may object to a new sub-processor on reasonable data protection grounds by notifying CloudBriz within 30 days of such notice.

This objection right does not apply to sub-processors that are essential to the operation of the Service, including Genesys Cloud.

In the event of a valid objection that cannot be reasonably resolved, CloudBriz may, at its discretion, (i) provide a commercially reasonable alternative, or (ii) allow the Customer to discontinue use of the affected functionality. Such objection shall not entitle the Customer to terminate the Agreement as a whole.

10. Security Measures

CloudBriz implements the following technical and organizational measures to protect Personal Data. For a comprehensive description of our security architecture, see our Security Overview.

10.1 Encryption

10.2 Access Controls

10.3 Organizational Measures

• Access to production infrastructure is restricted to authorized CloudBriz personnel
• Administrative access is authenticated and logged
• Security configurations are managed using controlled and auditable deployment processes

11. Data Breach Notification

11.1 Notification Timeline

In the event of a Data Breach affecting the Customer’s Personal Data, CloudBriz will notify the Customer without undue delay after becoming aware of the breach.

Such notification may be provided via email, through the Service interface, or other reasonable means.

11.2 Notification Content

The notification will include, to the extent reasonably available:

• A description of the nature of the Data Breach, including the categories and approximate number of data subjects and records affected
• The name and contact details of CloudBriz’s point of contact for further information
• A description of the likely consequences of the Data Breach
• A description of the measures taken or proposed to address the Data Breach, including measures to mitigate its possible adverse effects

11.3 Security Incidents

A security incident that does not result in unauthorized access to, or accidental or unlawful destruction, loss, alteration, or disclosure of Personal Data shall not be considered a Data Breach under this DPA. CloudBriz may, at its discretion, inform the Customer of significant security incidents that do not constitute a Data Breach.

11.4 Cooperation

CloudBriz will provide reasonable cooperation to the Customer in connection with the investigation and remediation of a Data Breach, taking into account the nature of the processing and the information available to CloudBriz.

To the extent permitted by applicable law, such assistance shall be provided at the Customer’s reasonable expense where it requires significant additional effort beyond CloudBriz’s standard obligations.

12. Data Subject Rights

12.1 Assistance

CloudBriz will provide reasonable assistance to the Customer in fulfilling its obligations to respond to Data Subject requests, taking into account the nature of the processing and the information available to CloudBriz.

Where CloudBriz receives a Data Subject request directly, it will promptly forward the request to the Customer.

12.2 Scope

Given the nature of the Service, most Personal Data processed is limited to identifiers and metadata. The Customer retains primary control over Data Subject rights through their Genesys Cloud administration.

13. Data Protection Impact Assessments

CloudBriz will provide reasonable assistance to the Customer in connection with data protection impact assessments and prior consultations with supervisory authorities where required by applicable data protection law, taking into account the nature of the processing and the information available to CloudBriz.

To the extent permitted by applicable law, such assistance shall be provided at the Customer’s reasonable expense where it requires significant additional effort beyond CloudBriz’s standard obligations.

14. Audit Rights

14.1 Customer Audits

The Customer may request information reasonably necessary to demonstrate CloudBriz’s compliance with this DPA.

CloudBriz will satisfy such requests by providing documentation, certifications, or summaries of its security and data protection practices.

Only where such information is not sufficient, the Customer may request an audit, subject to the following conditions:

• The audit must be based on reasonable written notice of at least 30 days
• Audits may be conducted no more than once per year, unless required by a supervisory authority
• Audits must be conducted during normal business hours and in a manner that does not unreasonably interfere with CloudBriz’s business operations
• Audits must be limited in scope to information relevant to this DPA
• The auditor must be independent, subject to CloudBriz’s approval, and bound by confidentiality obligations
• CloudBriz may object to an auditor on reasonable grounds
• Audits shall be conducted at the Customer’s expense, including reimbursement of CloudBriz’s reasonable costs and internal resources required to support the audit

14.2 Compliance Evidence

CloudBriz will make available, upon reasonable request, information necessary to demonstrate compliance with this DPA, including:

• Documentation of security measures and certifications, where available
• Information regarding sub-processors
• Results of third-party security assessments, where available

CloudBriz may reasonably limit the scope and frequency of such disclosures to prevent undue burden or risk to the security of its systems.

15. International Data Transfers

15.1 Data Processing Locations

CloudBriz is designed to process and store Customer Personal Data in the region selected by the Customer.

Certain Service features may involve processing by third-party services that operate globally. Where such processing involves transfers of Personal Data outside the Customer’s region, CloudBriz is designed to ensure that appropriate safeguards are in place in accordance with applicable data protection laws.

15.2 Transfer Safeguards

Where Personal Data is transferred to countries outside the European Economic Area, CloudBriz maintains appropriate safeguards, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions of the European Commission
• Other legally recognized transfer mechanisms under applicable data protection law

16. GDPR Compliance (Article 28)

This DPA is entered into in accordance with Article 28 of the GDPR. CloudBriz shall:

• Process Personal Data only on documented instructions from the Customer
• Ensure that persons authorized to process Personal Data have committed to confidentiality
• Implement appropriate technical and organizational security measures
• Assist the Customer in ensuring compliance with Articles 32–36 of the GDPR
• Delete Personal Data in accordance with this DPA and applicable law, and, where applicable and technically feasible, may provide return of Personal Data upon written request and subject to the parties’ agreement
• Make available information necessary to demonstrate compliance with Article 28

17. Term and Termination

This DPA shall remain in effect for the duration of the Customer’s Mediabriz subscription. Obligations relating to data protection, confidentiality, and data deletion survive termination of this DPA.

18. Limitation of Liability

CloudBriz’s total liability under this DPA shall be subject to the limitations set forth in the Terms of Use and EULA. Nothing in this DPA excludes or limits liability to the extent that such exclusion or limitation is not permitted under applicable data protection law.

19. Conflict

In the event of any conflict between this DPA and the Terms of Use, EULA, or any other agreement between the parties, the provisions of this DPA shall prevail with respect to data protection matters.

20. License Manager for Genesys Cloud

20.1 Scope

License Manager for Genesys Cloud (“License Manager”) is a separate solution in the Mediabriz family. It gives the Customer’s organization a managed login page for Genesys Cloud, together with license usage visibility, policies and alerts. License Manager is not part of the Service.

This Section 20 applies only where the Customer uses License Manager, and only to the processing of Personal Data by License Manager. For License Manager, this Section 20 replaces Sections 2.2, 3, 4, 5, 6.1, 9.1, 12.2 and 15.1, and supplements Section 10. All other sections of this DPA apply to License Manager as they apply to the Service. If this Section 20 conflicts with any other section of this DPA in relation to License Manager, this Section 20 prevails.

20.2 Purposes of Processing

CloudBriz processes Personal Data for License Manager only on documented instructions from the Customer, as reflected in the Customer’s License Manager settings, and solely as necessary to provide License Manager.

Such processing may include:

• Reading user, presence, license, role and billable usage data from the Customer’s Genesys Cloud organization, using the OAuth client that the Customer’s administrator creates when connecting License Manager, to count license usage against the licensed capacity or licensed hours, licensing model and billing period that the Customer sets
• Operating the Mediabriz login page that the Customer gives its users: recording each sign-in made through the page before the user is sent on to Genesys Cloud and, where the Customer has selected the Apply policy mode, asking new users to try again shortly when the Customer’s licensed capacity is fully in use
• Matching a Login ID that a user enters on the login page with a user in the Customer’s Genesys Cloud organization, where the Customer’s settings ask for a Login ID
• Producing the Login exceptions report, where the Customer has enabled it: a daily comparison of the sign-ins made through the login page with the users who came online in Genesys Cloud
• Provision of license usage and Login exceptions views, including CSV export, to the Customer’s authorized administrators in the Mediabriz Insights dashboard
• Sending alert emails to the address the Customer sets
• Protecting the login page and the Customer’s organization, including allowed networks, the private link, rate limits, a web application firewall and the detection of sign-ins that are reserved but not used
• Security, audit and troubleshooting of License Manager

20.3 Categories of Data Subjects

Personal Data processed by License Manager may relate to the following categories of data subjects:

• Customer’s users: the active users of the Customer’s Genesys Cloud organization, whose presence and license assignments License Manager reads, whether or not they use the login page
• Login page users: persons who use the Customer’s Mediabriz login page
• Customer’s administrators and alert recipients: users who configure License Manager or view its reports, and the persons whose email address the Customer sets for alerts

License Manager does not process data about conversation participants.

20.4 Types of Personal Data Processed

License Manager stores the following data:

License Manager stores names and email addresses: the display names and primary email addresses on Login exceptions records, and the alert email address in the Customer’s settings.

On the user’s device, the login page sets a strictly necessary cookie holding a random browser identifier, which expires after one day, and keeps the last Login ID entered, the chosen language and the sign-in destination in the browser’s local storage so that the page can prefill them.

License Manager does not process the following:

20.5 Where Data Is Stored and Processed

License Manager runs on AWS. For each organization, most License Manager processing takes place in the AWS region that matches the Customer’s data region (US or EU), together with components that serve all organizations. This Section 20.5 describes the current arrangement for information only. CloudBriz does not commit that any category of License Manager data is stored or processed only in a particular region, and Section 5.2 does not apply to License Manager.

Currently:

• In the Customer’s data region: user identifiers and license data, usage records, the directory map, login page records, Login IDs entered, Login exceptions, audit records, the encrypted Genesys Cloud client secret, License Manager’s operational logs, the reading of the Customer’s Genesys Cloud organization, the sending of alert emails, and the Login exceptions views and exports in Mediabriz Insights.
• In the United States, for all organizations: a copy of the organization’s License Manager settings, including the alert email address and allowed networks, and backups of that copy; the Mediabriz setup wizard and the administration interface, which process the settings, the connection to Genesys Cloud and aggregate usage counts, and whose logs contain the administrator’s Genesys Cloud user ID; the firewall logs; the static files of the login page; and the record that reserves the login page address (no Personal Data).
• On AWS’s global edge network: the login page is delivered, and requests to it are received, at an AWS edge location near the user, which may be outside the Customer’s data region. Requests, including the Login ID entered and the user’s IP address, pass through the edge location in transit. Apart from the firewall logs, they are not logged there.
• Email: alert emails are delivered to the recipients’ email providers. The alert about sign-ins that are reserved but not used, which names the network concerned, is also sent to CloudBriz’s operations mailbox.
• Genesys Cloud: License Manager reads data from, and sends users on to, the Customer’s Genesys Cloud region.

Where this involves a transfer of Personal Data outside the European Economic Area, Section 15.2 applies.

20.6 Data Retention and Deletion

When the Customer’s organization is removed from License Manager, CloudBriz deletes the Genesys Cloud connection and the organization’s usage records, directory map, license data and Login exceptions. Audit records are kept until the end of their retention period. Section 6.2 applies.

20.7 Sub-processors

CloudBriz relies on the following third-party services and sub-processors in connection with License Manager:

License Manager does not use the AI inference services or the Microsoft Office Online viewer listed in Section 9.1. The statement in Section 9.1 about Genesys Cloud as a required platform dependency applies to License Manager. Sections 9.2 and 9.3 apply.

20.8 Security Measures

Section 10 applies to License Manager, with the following measures. Where Section 10 refers to token-based authentication of users, the login page is protected by the measures below instead.

20.9 Data Subject Rights

For License Manager, Personal Data includes identifiers and, in Login exceptions, names and email addresses. The Customer’s administrators can view, search and export Login exceptions in Mediabriz Insights, and the Customer’s License Manager settings control whether the login page collects Login IDs. Section 12.1 applies.

21. Contact

For questions about this DPA or to exercise any rights under it, please contact us.

CloudBriz Technologies Ltd.