Last updated 2026-11-02
This Data Protection Agreement (“DPA”) is incorporated into and forms part of the Newo Terms of Service (the “Terms”), available at https://www.newo.ai/terms-of-service, unless Customer has entered into a superseding written agreement with Newo Inc., a Delaware corporation with its principal place of business at 2261 Market Street #5263, San Francisco, CA 94114, USA (“Newo”), in which case this DPA forms part of that agreement (together with the Terms, the “Underlying Agreement”). Capitalized terms not defined here have the meaning given in the Underlying Agreement. Newo may amend this DPA from time to time by publishing changes at https://newo.ai; continued use of the Cloud Services after the effective date of a change constitutes acceptance of the revised DPA. Newo will give Customer at least thirty (30) days’ notice of any material change, and no change will materially reduce the protection of Customer Data under this DPA.
This DPA sets out the terms on which Newo Processes Customer Data when providing the Cloud Services, and is intended to satisfy the requirements generally applicable to data processing agreements under the data protection and privacy laws applicable to the Processing of Customer Data (“Privacy Laws”), including, where applicable, Article 28(3) GDPR.
“Customer Data” means personal data or personal information (as defined under applicable Privacy Laws) that Customer or its End-Users provide in the course of using the Cloud Services and that Newo Processes on Customer’s behalf. “Process” or “Processing” has the meaning given under applicable Privacy Laws. “Sub-processor” means a processor or service provider engaged by Newo to Process Customer Data.
Customer determines the purposes and means of Processing Customer Data and is the controller/business with respect to it; Newo Processes Customer Data solely as a processor/service provider on Customer’s behalf and documented instructions, as set out in Schedule A.
Newo will:
(a) Process Customer Data only on Customer’s documented instructions and for the purposes described in Schedule A, except where otherwise required by law, in which case Newo will inform Customer of that legal requirement before Processing unless that law prohibits it;
(b) not sell or share Customer Data, and not use it for any purpose other than providing and supporting the Cloud Services for Customer;
(c) ensure personnel authorized to Process Customer Data are bound by confidentiality;
(d) implement appropriate technical and organizational security measures as described in Schedule A;
(e) notify Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a breach of security compromising Customer Data, and provide the information reasonably available to Newo that Customer needs to meet its own notification obligations, including the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address it, and the contact details of Newo’s Data Protection Officer, who can be reached at compliance@newo.ai;
(f) provide reasonable assistance to Customer in responding to requests from individuals to exercise their rights under applicable Privacy Laws, and in meeting Customer’s related compliance obligations, at Customer’s cost where the assistance requested is excessive or unreasonably burdensome;
(g) engage Sub-processors only under a written agreement imposing data protection terms materially no less protective than this DPA, and remain responsible for each Sub-processor’s performance; Newo will provide at least thirty (30) days’ notice of a new Sub-processor and an opportunity for Customer to object on reasonable grounds within fourteen (14) days; if Newo cannot reasonably address Customer’s objection, Customer may terminate the affected Cloud Services without penalty;
(h) upon Customer’s written request, including at termination of the Cloud Services, delete or return Customer Data at Customer’s choice within thirty (30) days, except that Customer Data held in routine, secured backups will be deleted within forty-five (45) days, and except where retention is required by law;
(i) not use Customer Data, and not permit any Sub-processor to use Customer Data, to train, fine-tune, or otherwise develop any artificial intelligence or machine learning model, whether Newo’s or a third party’s;
(j) provide reasonable assistance to Customer in ensuring compliance with its obligations relating to security of Processing, notification of personal data breaches, data protection impact assessments, and prior consultation with supervisory authorities, taking into account the nature of Processing and the information available to Newo;
(k) make available to Customer the information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer. Newo may satisfy this obligation by providing its current ISO/IEC 27001 certificate and SOC 2 report under confidentiality. Any on-site audit will be conducted on at least thirty (30) days’ notice, during business hours, and no more than once per year, unless required by a supervisory authority or following a breach affecting Customer Data; and
(l) immediately inform Customer if, in Newo’s opinion, an instruction from Customer infringes applicable Privacy Laws; and
(m) where Customer Data includes personal information subject to the California Consumer Privacy Act, as amended (the “CCPA”), or other U.S. state privacy laws, act as Customer’s service provider or contractor and:
(i) Process Customer Data only for the limited and specified business purposes of providing, supporting, and securing the Cloud Services described in Schedule A, or as otherwise permitted for service providers under the CCPA;
(ii) not sell or share Customer Data, as those terms are defined in the CCPA;
(iii) not retain, use, or disclose Customer Data for any other purpose, including any other commercial purpose, or outside the direct business relationship between Newo and Customer;
(iv) not combine Customer Data with personal information Newo receives from or on behalf of others, or collects from its own interactions with consumers, except as the CCPA permits;
(v) comply with its obligations under the CCPA and provide the same level of privacy protection the CCPA requires of Customer;
(vi) notify Customer if Newo determines it can no longer meet its obligations under the CCPA;
(vii) allow Customer, on notice, to take reasonable and appropriate steps to ensure Newo uses Customer Data consistently with Customer’s CCPA obligations, including through Section 3(k), and to stop and remediate any unauthorized use; and
(viii) assist Customer with consumer requests under Section 3(f), and bind its Sub-processors to equivalent obligations under Section 3(g).
Newo certifies that it understands and will comply with the restrictions in this Section 3(m).
Newo is headquartered in the United States. For Customers provisioned on Newo’s EU deployment, Customer Data is hosted and stored in the European Union (Google Cloud, Belgium), and AI model and speech processing is performed in EU regions, as set out in Schedule B. Customer Data may nevertheless be transferred outside the EEA, United Kingdom, or Switzerland: (i) to Sub-processors that Schedule B lists as Processing outside the EEA; (ii) where Newo or Sub-processor personnel located outside the EEA access Customer Data for administration, support, or security purposes; and (iii) for Customers not provisioned on the EU deployment, where Customer Data is Processed in the United States.
Where Customer Data is transferred from the EEA, United Kingdom, or Switzerland to a country without an adequacy decision, Newo will ensure the transfer is subject to an appropriate safeguard under applicable Privacy Laws, as follows: (i) for transfers from Customer to Newo, Module Two (controller to processor), or Module Three (processor to processor) where Customer acts as a processor, of the Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 (“SCCs”), which are incorporated into this DPA by reference, with Schedule A serving as Annex I and the security measures in Schedule A serving as Annex II; (ii) for onward transfers from Newo to Sub-processors, Module Three (processor to processor) SCCs or another valid transfer mechanism, entered into between Newo and the Sub-processor; (iii) for transfers from the United Kingdom, the UK Information Commissioner’s Office International Data Transfer Addendum; and (iv) for transfers from Switzerland, the SCCs as adapted for the Swiss Federal Data Protection and Information Commissioner (FDPIC). By accepting the Underlying Agreement, Customer (on its own behalf and, where applicable, on behalf of each controller established in the EEA, UK, or Switzerland) is deemed to execute the safeguards in (i), (iii), and (iv) with Newo, effective as of Customer’s acceptance of the Underlying Agreement.
For the purposes of the SCCs: (A) the optional docking clause in Clause 7 applies; (B) under Clause 9, Option 2 (general written authorization) applies, with notice of changes given as set out in Section 3(g); (C) the optional language in Clause 11 does not apply; (D) the competent supervisory authority is determined in accordance with Clause 13; and (E) under Clauses 17 and 18, the SCCs are governed by the laws of Ireland, and disputes are resolved by the courts of Ireland.
Customer is responsible for the accuracy, quality, and lawfulness of Customer Data and the means by which it was obtained, and for ensuring its instructions to Newo comply with applicable Privacy Laws.
The Parties’ respective liabilities arising out of or relating to this DPA are subject to the limitations and exclusions of liability set forth in the Underlying Agreement.
This DPA does not address, and Newo will not knowingly Process, Protected Health Information (as defined under HIPAA) absent a separately executed Newo Business Associate Agreement. Customers with such requirements should contact Newo to execute the applicable Business Associate Agreement or a jurisdiction-specific DPA referenced in Section 8.
Where Customer has separately executed Newo’s EMEA Data Protection Agreement, USA Data Protection Agreement, or a Business Associate Agreement, that document governs the subject matter it covers, and this DPA continues to apply to any aspect of Processing not addressed there.
(a) Amendment. Newo may amend this DPA as described above; no other amendment is effective unless in a writing signed by both Parties.
(b) Survival. Sections 4, 6, 7, and 8, and any provision that by its nature should survive, will survive termination.
(c) No third-party beneficiaries. Nothing in this DPA confers rights on any person other than the Parties and their successors and permitted assigns, except as expressly provided for Data Subjects under the clauses referenced in Section 4.
(d) Order of precedence (Underlying Agreement). In a conflict between this DPA and the Underlying Agreement regarding Customer Data, this DPA controls.
(e) Governing law. This DPA is governed by the governing-law provisions of the Underlying Agreement.
Categories of Data Subjects: Customer’s employees and authorized users; and individuals who interact with Customer’s AI agents, including callers, message senders, and Customer’s own customers and prospects (“End-Users”). Categories of Customer Data: account and contact information; End-User names, phone numbers, email addresses, and other contact details; call audio and recordings (where recording is enabled); call and message transcripts; SMS and chat message content; appointment, booking, and order details; and other information shared via the Cloud Services. Sensitive data: Customer Data may incidentally include special categories of personal data that End-Users volunteer during an interaction (for example, health information shared with a dental or medical practice). Nature of Processing: receiving, transcribing, analyzing, and responding to calls and messages using automated AI agents; storing call records, transcripts, and related data; and exchanging data with Customer’s connected systems. Frequency: continuous, for the term of the Underlying Agreement. Purposes: providing and supporting the Cloud Services for Customer. Retention: for the term of the Underlying Agreement, then deleted in accordance with Section 3(h).
Security measures (Annex II): encryption of Customer Data at rest using AES-256, with encryption keys managed in Google Cloud Key Management Service and rotated at least every twelve (12) months; encryption in transit for application and API traffic using TLS; an information security management system certified to ISO/IEC 27001; independent SOC 2 attestation; role-based access controls limiting access to personnel who need it; controls to ensure ongoing confidentiality, integrity, availability, and resilience of Processing systems; logging and monitoring; incident response and recovery procedures; and regular testing and evaluation of security measures.
The following Sub-processors Process Customer Data. Locations show the US deployment and, where different, the EU deployment.
Google Cloud Platform (incl. Vertex AI) – hosting, storage, databases, AI models – US / EU (Belgium)
OpenAI – language models – US / EU endpoint
Deepgram – speech-to-text, text-to-speech – US / EU endpoint
ElevenLabs – text-to-speech, speech-to-text – US / EU instance
Twilio – telephony and SMS – US / Ireland
Twilio SendGrid – email delivery – US / EU
Telnyx – telephony and SMS – US
Auth0 (Okta) – customer authentication – US / Germany
Datadog – monitoring and security logging – US / Germany
Sentry – error monitoring – US / Germany
Browserless – restaurant booking automation – US
Make.com – end-user notification emails – US
Intercom – customer support – US
PostHog – product analytics (no call data) – US
Stripe – billing – US
Coupler – internal reporting – US
Apify – business listing lookup for agent setup – US
Parallel.ai – searches customer's own website for agent setup – US