Version 27 September 2026. This agreement was drafted by Anty Virtual on the model of the standard controller-to-processor terms under Article 28 of the GDPR and the Nigeria Data Protection Act 2023 and has not yet been reviewed by outside counsel. A client that wants changes sends them to hello@antyvirtual.com; we would rather sign a fair agreement than a fast one.
How to sign it
Email hello@antyvirtual.com with your legal entity name, address, the products you use and the name of your signatory. We return this text as a PDF with Annex A completed for your account, signed by Anty Virtual, for your counter-signature. The signed copy is kept with your account and the date of signature is written to the audit log.
1. Parties and roles
This Data Processing Agreement (the “DPA”) is between the client named in the Order Form or account (the “Controller”, “you”) and Anty Virtual LLC, Phoenix, Arizona, United States (the “Processor”, “Anty Virtual”, “we”). It forms part of the agreement under which Anty Virtual provides its services to you (the “Agreement”) and governs every processing of Personal Data that Anty Virtual carries out on your behalf. Where this DPA and the Agreement conflict on data protection, this DPA prevails.
You are the Controller of the Personal Data of your customers, callers, patients, clients and staff that passes through the services. Anty Virtual is your Processor. Anty Virtual is itself the Controller only of the data of its own staff, couriers and field agents, which this DPA does not cover.
2. Definitions
- Personal Data, Controller, Processor, Data Subject, Processing, Personal Data Breach have the meanings given in the GDPR (Regulation (EU) 2016/679) and, for data of persons in Nigeria, the Nigeria Data Protection Act 2023 (“NDPA”); “Data Protection Law” means whichever of those, the UK GDPR, or a United States state privacy law applies to the processing.
- Services means the Anty Virtual products you use: Anty Voice, Anty Cards, Anty Connect, Anty Food and Anty Loyalty, as described in Annex A.
- Sub-processor means a third party engaged by Anty Virtual to process Personal Data on your behalf.
3. Scope and instructions
- Anty Virtual processes Personal Data only on your documented instructions, which are: the Agreement, this DPA, your use of the services and their settings, and any further written instruction you give. Annex A describes the subject matter, duration, nature, purpose, categories of data and categories of Data Subjects.
- Anty Virtual will tell you at once if, in its opinion, an instruction infringes Data Protection Law, and may pause that instruction until it is resolved.
- Anty Virtual does not sell Personal Data, does not use it for its own marketing, and does not use it, or permit any Sub-processor to use it, to train, fine-tune or improve any machine-learning model. Aggregated, de-identified statistics that cannot be related to you or any Data Subject may be used to operate and improve the services.
4. Processor obligations
Anty Virtual will:
- ensure that every person authorised to process Personal Data is bound by confidentiality and has access only to what their role requires;
- implement the technical and organisational measures in Annex C and keep them under review;
- assist you, taking into account the nature of the processing, in responding to Data-Subject requests (section 8), in meeting your security, breach-notification, impact-assessment and consultation obligations, and in demonstrating compliance;
- keep a record of the processing it carries out on your behalf and make it available on request;
- on your written request, provide the information needed to demonstrate compliance with this DPA, and allow and contribute to audits as set out in section 10.
5. Sub-processors
- You authorise the Sub-processors listed in Annex B, which is also published at my.antyvirtual.com/trust/sub-processors.
- Anty Virtual will give you at least 14 days’ notice by email, to your account’s notification address, before a new or replacement Sub-processor processes your Personal Data. You may object within that period on reasonable data-protection grounds; Anty Virtual will then work with you to find another way, and if there is none you may terminate the affected service without penalty and with a pro-rata refund of prepaid fees.
- Anty Virtual imposes on each Sub-processor, by written contract, data-protection obligations no less protective than this DPA, and remains liable to you for a Sub-processor’s performance.
6. Security
Anty Virtual implements the measures in Annex C, appropriate to the risk, including encryption in transit and at rest, the second sealing of identity numbers, bank accounts and connection tokens, access limited by role and capability, audit logging of sign-ins and changes, daily backups with point-in-time recovery, and the retention and deletion described at my.antyvirtual.com/trust/retention. Annex C states plainly which measures are not yet in place.
7. Personal Data Breaches
Anty Virtual will notify you without undue delay and in any case within 72 hours of becoming aware of a Personal Data Breach affecting your Personal Data, describing its nature, the categories and approximate number of Data Subjects and records, the likely consequences, the measures taken or proposed, and a contact. Information not available at first is provided as it becomes available. Anty Virtual will assist you in notifying supervisory authorities and Data Subjects where you are required to.
8. Data-subject requests
If a Data Subject writes to Anty Virtual to exercise a right over Personal Data processed on your behalf, Anty Virtual will pass the request to you within five working days and not answer it itself unless you instruct it to or the law requires it. Anty Virtual provides the tools it has (deletion of a customer record from the dashboard) and, on request, exports, corrections and the assistance you need to answer within the statutory period.
9. International transfers
The services are hosted in the United States (Annex B gives the regions). Where Personal Data of Data Subjects in the European Economic Area or the United Kingdom is transferred to Anty Virtual or its Sub-processors outside those territories, the parties enter into the European Commission’s Standard Contractual Clauses (Decision 2021/914, Module Two, controller to processor) and, for the UK, the International Data Transfer Addendum, which are incorporated by reference and completed with the details in Annex A and B; in a conflict, the Clauses prevail. Where Personal Data of Data Subjects in Nigeria is transferred out of Nigeria, this DPA and the Agreement are the Controller’s documented basis under section 41 of the NDPA, and Anty Virtual will assist with any further instrument the Nigeria Data Protection Commission requires.
10. Audit
Once a year, or after a Personal Data Breach, you may audit Anty Virtual’s compliance with this DPA on 30 days’ written notice, by written questionnaire, by review of the published Security page and the findings and status it reports, and, where those do not answer a reasonable question, by a remote or on-site inspection at a mutually agreed time by you or an independent auditor bound by confidentiality. Anty Virtual holds no third-party certification today and says so; the Security page states what it does instead.
11. Return and deletion
At the end of the Agreement Anty Virtual keeps your Personal Data available for export for 30 days, then deletes it on your written instruction, or in any case within 90 days, and confirms deletion in writing, naming the date backups roll off (seven days after deletion). Personal Data that the law requires Anty Virtual to keep (payment and tax records) is kept only for that purpose and that period. Deletion at Sub-processors follows their terms in Annex B; Anty Virtual instructs each of them at the same time.
12. Liability, law, term
- Each party’s liability under this DPA is subject to the limits and exclusions in the Agreement, except that nothing limits liability that cannot be limited by law.
- This DPA is governed by the law that governs the Agreement; where the Agreement is silent, the law of the State of Arizona, United States, without prejudice to the mandatory application of Data Protection Law to the processing.
- This DPA takes effect on the date the last party signs and continues for as long as Anty Virtual processes Personal Data on your behalf.
Annex A: the processing
| Subject matter | Providing the Services to the Controller: answering and placing calls, replying to messages, taking bookings and orders, review and feedback collection, loyalty, and for restaurants, ordering, payment, dispatch and delivery. |
| Duration | The term of the Agreement plus the return and deletion period in section 11. |
| Nature and purpose | Collection, storage, transmission to and from the Sub-processors in Annex B, analysis by an AI assistant at the time of a call or message, retrieval by the Controller in its dashboard, and deletion. |
| Categories of Data Subjects | The Controller’s customers, callers, patients or clients; the Controller’s staff who use the dashboard. |
| Categories of Personal Data | Name, phone number, email, address; the content of calls (audio, transcript, summary) and messages; bookings and appointment details; orders and delivery details; payment status (never card numbers); feedback and review activity; loyalty visits and points; the Controller’s staff sign-in records. |
| Special categories | None by design. A Controller in health care must say so on its account (the “handles health information” setting), which requires explicit retention periods; the content of a call to a clinic may then include health information, processed only as the Controller instructs. |
| Retention | Call recordings 90 days and transcripts 365 days by default, set by the Controller in Settings; other records for the term; see retention. |
| Controller details | Completed on the signed copy: legal name, address, notification email, signatory. |
Annex B: sub-processors
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Anthropic | The language model behind the assistants: reading a menu photo, suggesting feedback tags, drafting a review reply, the general assistant. One message at a time; no customer roster is ever sent. | The text of the message being handled and the context it needs (a menu, a piece of feedback, a question). | United States |
| Retell AI | The voice agent for Anty Voice: the phone number, the call itself, the recording and the transcript. | The caller’s number, the audio of the call, the transcript, the details the caller gives (name, phone, what they want, an appointment). | United States |
| Supabase | The database, sign-in and file storage for the whole platform. | Everything the platform holds: business records, customer contacts and orders, call records, feedback, staff accounts, encrypted credentials. | United States, AWS us-west-1 (California). Backups in the same region. |
| Vercel | Hosting: the application runs here. | Platform traffic and application data in transit; server functions run in the Washington DC region (iad1) with a global edge. | United States (primary), global edge |
| Resend | Transactional email: sign-in codes, booking confirmations, notices to a business, the weekly digest. | Name, email address and the content of the email. | United States |
| Monnify (Moniepoint) | Payments for Anty Food: collecting a customer’s payment into the restaurant’s own account, paying couriers. Money never touches an Anty Virtual account. | The payer’s bank and card details as Monnify needs them, amounts, references; couriers’ bank accounts for payouts. | Nigeria |
| Meta (WhatsApp Business Platform, Instagram) | Messaging for Anty Connect and Anty Food: the business’s own WhatsApp and Instagram accounts, connected by the business. | Messages between the business and its customers, phone numbers, the templates sent. | Meta’s infrastructure (global) |
| Termii | SMS to Nigerian numbers where WhatsApp cannot reach. | Phone number and the text of the message. | Nigeria |
| Smile Identity | Identity verification for couriers and field staff: the NIN check and the photo match, through Smile’s own capture screen. | The person’s NIN and photograph, sent straight to Smile; Anty Virtual keeps the outcome and a reference, never the images. | Smile’s infrastructure (described in Smile’s privacy notice) |
| Google (Places, Calendar) | Finding a business’s listing and its reviews; writing bookings to a business’s own Google Calendar when the business connects it. | Place ids and public listing details; for a connected calendar, the appointment’s time, the caller’s name and phone, and the service booked. | Google’s infrastructure (global) |
| Cal.com (being retired) | Booking calendar for two offices that have not yet connected Google Calendar. | Appointment time, the caller’s name, phone and email. | United States |
Regions for Anty Virtual’s own hosting: database and file storage on Supabase in AWS us-west-1 (California, United States), application on Vercel with server functions in iad1 (Washington DC area) and static assets on a global edge. The live list, with each Sub-processor’s terms as read and the date, is at my.antyvirtual.com/trust/sub-processors.
Annex C: technical and organisational measures
- Encryption: TLS in transit on every connection; encryption at rest on the database, file storage and backups; AES-256-GCM sealing under an application-held master key for identity numbers, bank accounts and connection tokens; keyed fingerprints for duplicate detection without decryption; scrypt for point-of-sale PINs.
- Access control: sign-in by emailed code or link; every query scoped to the signed-in Controller; database access revoked from browser roles; staff capabilities granted by the owner and re-checked on every request; signed, four-hour, audited “view as” sessions with a visible banner; console sessions end after a week without activity.
- Logging: every sign-in with its address; every change to money, identity and settings with actor, time and change. Reads are not logged (an open item).
- Backups and recovery: daily backups kept seven days, point-in-time recovery for seven days, a rehearsed restore procedure (23 September 2026), same region as the database.
- Retention and deletion: nightly purge of recordings and transcripts past the Controller’s periods, including deletion at the voice provider; deletion of a Controller’s data on request with written confirmation.
- Suppliers: every Sub-processor under written data-protection terms; 14 days’ notice before a new one.
- Review: an independent code and configuration security review on 23 September 2026, its serious findings and their status published at my.antyvirtual.com/trust/security; the incident process published there.
- Not yet in place, stated plainly: an enforced second factor for staff sign-in; row-level security policies in the database; read logging; self-serve deletion of a whole Controller; an external penetration test; SOC 2 or ISO 27001 certification.
Signed for Anty Virtual LLC: ______________________ Date: __________ Signed for the Controller: ______________________ Date: __________