Data processing agreement
Last updated: 4 November 2026
BizStaff is a service of GABMAN INVESTMENTS LTD (גבמן השקעות בע״מ), Company No. 513969626, 10 Herzl St, Tel Aviv-Yafo 6688318, Israel. Email: contact@bizstaff.ai.
This agreement forms part of our terms of service. It applies when we process personal data of your customers or staff for you through BizStaff. You (the business) are the controller and we are the processor. If this agreement and the terms differ about personal data, this agreement prevails.
1. What we process
- Purpose and nature: answering your customers on your website chat, WhatsApp, SMS and phone, sharing your booking, ordering or scheduling link, checking availability on your booking site (for hotels), passing requests to your team and calling people back when they ask.
- People: customers and prospective customers who contact your business through the service, and members of your team whose names and replies to customers pass through it.
- Data: names, phone and WhatsApp numbers, email addresses given in a conversation, messages, call recordings and transcripts, what people asked for (such as dates, services, appointments or orders), requests and short customer notes, and the names and messages of your team members in those conversations.
- Not meant for: special categories of data (such as health information), details of legal or financial matters, payment card numbers and ID numbers. You instruct us, and you will set up and use the agent so, that it collects only what is needed to book an appointment, a consultation or an order. The agent asks people not to send such details. If someone sends them anyway, we process them only as part of that conversation and delete them on the normal schedule.
- Duration: while your subscription lasts, then until deletion under section 8. Retention periods are in our privacy policy.
2. Your instructions
We process the data only to provide the service under the terms, your settings and your written instructions, unless a law requires otherwise, in which case we tell you first where the law allows. We tell you if we think an instruction breaks data protection law.
3. Confidentiality and security
Only people who need access to provide the service have it, and they are bound to confidentiality. We protect the data with encrypted connections (HTTPS), access control, service keys stored apart from the code, logging and automatic deletion on the schedules in our privacy policy.
4. Sub-processors
You authorize these sub-processors: Cloudflare (hosting, storage, email), OpenAI (text answers), ElevenLabs (voice conversations, call recordings and transcripts), Twilio (phone numbers, calls and SMS) and Meta (WhatsApp). Each is bound by written data protection terms that protect the data in line with this agreement, and we remain responsible to you for them. We tell you by email at least 30 days before we add or replace one. If you object on reasonable data protection grounds and we cannot resolve it, you may cancel with immediate effect and we refund the unused part of fees already paid.
5. Transfers
We are in Israel, which the European Commission and the UK recognize as giving adequate protection. Transfers to sub-processors in other countries rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses (with the UK addendum), as provided in the sub-processor's terms.
6. Helping you
- We help you answer requests from your customers to exercise their rights: to see, correct or delete their data, to restrict or object to its use, or to receive a copy in a portable format. Your team can also see and remove customer notes and conversations on your management page.
- We tell you without undue delay, and within 48 hours after we become aware of it, about a personal data breach affecting your data, with the information we have.
- We give you reasonable help with data protection impact assessments and with questions from authorities.
7. Audits
We give you the information needed to show that we meet this agreement and answer your reasonable written questions. If that is not enough, you may audit once a year, with 30 days' notice, at your cost and under confidentiality. Once a year, on request, we confirm in writing that we meet our security obligations under this agreement. We access only what you connect to the service: the chat on your website, the public pages of your website and booking system, the phone number you forward and the information you give us.
8. End of the service
When the service ends, we delete your customers' data within 30 days, unless a law requires us to keep it. You can ask for a copy until the service ends.
9. Laws of other countries
- Israel: for your data we act as a holder (מחזיק) under the Protection of Privacy Law, 5741-1981, and apply the Data Security Regulations, 2017 as they apply to us.
- EU and UK: this agreement contains the terms required by Article 28 of the GDPR and the UK GDPR.
- United States: we act as your service provider or processor under US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA). We do not sell or share your customers' personal information; we do not keep, use or disclose it for any purpose other than providing the service to you, or outside our direct business relationship with you; we do not combine it with personal information we receive from others, except as the CCPA allows; and we give it the level of privacy protection the CCPA requires. We tell you if we can no longer meet these obligations, and you may then take reasonable steps to stop and remedy any unauthorized use. You remain responsible for your customers' consent to calls and texts under the TCPA and state laws, as our terms of service describe.