Data Processing Addendum (DPA)

1. Scope and Roles of the Parties

This Data Processing Addendum supplements our Terms of Service. Under GDPR Regulation (EU) 2016/679:

• Customer is the Data Controller: Determining the purposes and categories of end-user personal data submitted into voice calls and WhatsApp conversations.
• Lokam is the Data Processor: Processing Customer Personal Data solely on documented instructions to execute conversational AI flows, dynamic tools, and real-time audio synthesis.

2. Technical & Organizational Measures (TOMs)

Lokam implements state-of-the-art security measures to ensure a level of security appropriate to data risks:

• Encryption in Transit: TLS 1.3 for all REST API endpoints and WebRTC DTLS-SRTP for real-time voice media packets.
• Encryption at Rest: Dedicated encrypted vaults for third-party integration credentials and full disk-level database encryption.
• Zero-Trust Access Controls: Multi-tenant logical database isolation, role-based API scope verification, and mandatory two-factor authentication (2FA) for workspace administrators.

3. Authorized Subprocessor Directory

Lokam maintains contracts with verified third-party subprocessors providing cloud infrastructure, speech models, and media routing:

4. International Transfers & Standard Contractual Clauses (SCCs)

For transfers of Customer Personal Data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries lacking an adequacy decision, the EU Standard Contractual Clauses (Module 2: Controller-to-Processor) are hereby incorporated into this DPA.