Data processing agreement (DPA)

Last updated: November 13, 2026

This is a courtesy translation. The Hebrew version is the binding one.

This agreement governs the relationship between a ChatMe customer (the database controller) and ChatMe (the holder of the information on the customer's behalf), under the Privacy Protection Law, 5741-1981, as amended by Amendment 13, and the Privacy Protection (Data Security) Regulations, 5777-2017, and in particular Regulation 15 (outsourcing). This agreement is an appendix to the Terms of Use and applies to every customer upon acceptance of the Terms. A customer who wants a signed copy may contact us.

1. Parties and definitions

• The Customer: the business using the ChatMe services, as shown in the subscription account or the order form (the "Database Controller").
• ChatMe: Eden Cohen, licensed dealer no. 208687566, 4 Hanit St., Herzliya (the "Holder").

Any term not defined here shall be interpreted in accordance with the Privacy Protection Law and the regulations enacted under it.

In the event of a conflict between this agreement and the Terms of Use with respect to personal information, this agreement prevails.

2. Subject of the processing and the Customer's instructions

2.1 ChatMe will process information from the Customer Database only to provide the services the Customer ordered: lead and customer management (CRM), smart dialer and call recording, voice agent, AI call summaries, WhatsApp, email marketing, customer journeys and offline conversion reporting to Meta. The processing details are set out in Appendix A.

2.2 The Customer's instructions are this agreement, the Terms of Use, the settings the Customer configures in the system (for example routing rules, statuses reported to Meta, enabling recordings and the voice agent), and any further written instructions. ChatMe will not process the information for any other purpose.

2.3 The Customer is responsible for having a lawful basis to collect and process the information, including:

• informing data subjects in accordance with Section 11 of the Law;
• obtaining consent to receive advertising messages in accordance with Section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982, before sending marketing messages by WhatsApp, email or SMS;
• giving advance notice of call recording and of a conversation with an AI-based voice agent;
• registering the database or giving notice to the Privacy Protection Authority, to the extent required by law;
• obtaining appropriate consent and giving appropriate notice before sharing information with Meta as part of offline conversions.

2.4 If ChatMe believes that an instruction of the Customer violates the law, it will notify the Customer promptly and may suspend carrying it out until the matter is clarified.

2.5 The Customer will not enter into the system information of special sensitivity (for example medical information or full credit card details) beyond what the service requires, except by prior arrangement with ChatMe.

3. ChatMe's obligations as Holder

3.1 Limited use. ChatMe will not use information from the Customer Database for its own purposes, will not sell it, will not share it with other customers and will not use it to train artificial intelligence models, unless the Customer has approved this in writing.

3.2 Confidentiality. ChatMe will keep the information confidential in accordance with Section 16 of the Law, including after the agreement ends.

3.3 Authorized persons only. Access to the information will be given only to ChatMe staff who need it for their role (for example supporting a Customer request or handling a fault), who have signed a confidentiality undertaking and received data security training, as required by Regulations 17 and 18 of the Data Security Regulations.

3.4 Data security officer. The person responsible for data security in the service: Eden Cohen, edencohen533@gmail.com. All privacy and security matters should be addressed to him.

3.5 Assistance to the Customer. ChatMe will reasonably assist the Customer in meeting its obligations under the Law: responding to data subject requests, risk assessments, reporting security incidents and inquiries from the Privacy Protection Authority.

3.6 Demand by an authority. If a competent authority demands information from the Customer Database from ChatMe, ChatMe will notify the Customer in advance, unless it is prohibited by law from doing so, and will disclose only what it is required to disclose.

3.7 Records. ChatMe will maintain a list of the databases it holds for its customers, as required of a holder under the Law.

4. Data security

4.1 ChatMe will take security measures that comply with the Data Security Regulations and with the security level of the Customer Database set out in Appendix A. By default, ChatMe will meet at least the requirements of the medium security level.

4.2 The measures include at least:

• encryption of information in transit (TLS) and at rest;
• logical separation between customers, so that one customer cannot see another customer's information;
• role-based access permissions within the Customer's account, set by the Customer;
• user identification and authentication, including two-factor authentication (authenticator app and backup codes) available to the customer's users under a per-role policy set by the customer, with ChatMe staff accessing production systems only with two-factor authentication;
• logging of access and sensitive actions, retained for at least 24 months, as required by Regulation 10;
• regular backups and a recovery procedure;
• ongoing security updates and separation of the development environment from the production environment;
• a database definitions document and a data security procedure, reviewed at least once a year.

4.3 ChatMe will conduct a review or test of its security measures at least once every 18 months, and will remedy any material gaps found without delay.

4.4 The Customer is responsible for security on its side: its users' passwords and devices, granting permissions to reps, and removing access for employees who have left.

The measures are detailed in Appendix C.

5. Sub-processors

5.1 The Customer authorizes ChatMe to use the sub-processors listed in Appendix B.

5.2 ChatMe will notify the Customer of the addition or replacement of a sub-processor 30 days in advance, by email or in the system. The Customer may object for a reasonable reason related to data protection. If no solution is found, the Customer may stop using the relevant service without penalty.

5.3 With every sub-processor that receives access to the information, ChatMe will ensure a written undertaking (in an agreement or in its terms of service) to security and confidentiality at a level no lower than this agreement.

5.4 Providers that the Customer connects on its own are not sub-processors of ChatMe. These include, for example, the business's Meta account (lead ads and offline conversions), the business's WhatsApp Business number, and tools connected through the API, Zapier or Make. For these services, the terms between the Customer and the provider apply, and ChatMe transfers information to them on the Customer's instructions.

6. Transfer of information abroad

6.1 Some of the information is stored and processed outside Israel. The main database and the application servers are located in the European Union (Frankfurt, Germany). Call recordings are stored in Israel. AI, email and notification services process information in the United States and other countries, as detailed in Appendix B.

6.2 Any transfer abroad will be made in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001. The transfer will be based on one of the grounds set out there: a country whose law ensures a level of protection no lower than Israeli law (for example the countries of the European Union), or a written undertaking by the recipient to take adequate measures to protect privacy and not to transfer the information onward.

6.3 ChatMe will update Appendix B when a processing location changes, in accordance with the procedure in Section 5.2.

7. Security incidents

7.1 ChatMe will notify the Customer of a security incident affecting the Customer Database without delay, and no later than 24 hours after becoming aware of it, so that the Customer can meet its reporting obligation under Regulation 11 of the Data Security Regulations.

7.2 The notice will include, to the extent known at that stage:

• what happened and when;
• what information was affected, and approximately how many data subjects;
• what ChatMe did to stop the incident and limit the damage;
• a contact person at ChatMe for further information.

7.3 Information not known at the time of the first notice will be provided in updates as the investigation progresses.

7.4 In a severe security incident, ChatMe will cooperate with the Customer in reporting to the Privacy Protection Authority and in complying with the Authority's instructions, including notifying data subjects if the Authority so orders.

7.5 ChatMe will document every security incident and its handling, and will make the documentation available to the Customer on request.

8. Data subject rights

8.1 The Customer handles data subject requests. ChatMe provides the Customer with tools in the system to do so on its own:

8.2 If a request from a data subject reaches ChatMe directly, ChatMe will forward it to the Customer within 5 business days, and will not respond to the requester on the Customer's behalf except on the Customer's instructions.

8.3 Call recordings and voice agent. Recordings and transcripts are part of the Customer Database. The Customer is responsible for informing anyone who speaks with the business that the call is recorded, and that they are speaking with an AI-based agent and not with a person. ChatMe makes it possible to play such a message at the start of the call.

8.4 Automated decisions. AI summaries, lead scoring and prioritization in the dialing queue are aids for the sales team, and do not make decisions with legal effect on data subjects.

9. Audit and oversight

9.1 Once a year, on request, ChatMe will provide the Customer with a short report on the implementation of this agreement and on its security measures, as required of a holder under Regulation 15 of the Data Security Regulations.

9.2 The Customer may send a reasonable data security questionnaire, and ChatMe will answer it within 30 days.

9.3 In the event of a severe security incident, or when a competent authority requires it, the Customer may conduct an audit itself or through an external auditor bound by confidentiality, with at least 14 days' prior coordination and during business hours. The audit will not include access to other customers' information or to ChatMe's trade secrets.

9.4 Each party will bear its own costs of the audit, unless the audit found a material breach of this agreement by ChatMe, in which case ChatMe will bear the reasonable cost of the audit.

10. Term, return and deletion

10.1 This agreement remains in force for as long as ChatMe processes information for the Customer, and the confidentiality provisions remain in force after it ends.

10.2 During the service, the Customer can export its information from the system at any time, in a common format (CSV).

10.3 When the service ends, the information will remain available for export for 30 days. At the end of that period, ChatMe will delete the Customer Database from its production systems. Copies in backups will be deleted in the regular backup cycle, and no later than 30 days after the service ends.

10.4 On request, ChatMe will provide the Customer with written confirmation of the deletion.

10.5 ChatMe may retain information it is required to retain by law (for example billing records and invoices), only for as long as required.

10.6 Retention periods during the service:

11. Liability, governing law and jurisdiction

11.1 Each party's liability under this agreement is subject to the limitations of liability in the Terms of Use, unless the law prohibits limiting it.

11.2 Each party is responsible for its own compliance with the Law: the Customer as the Database Controller, and ChatMe as the Holder. ChatMe will not be liable for use of the information by the Customer in violation of the law, for example sending marketing messages without consent.

11.3 In the event of a conflict between this agreement and the Terms of Use regarding personal information, this agreement prevails.

11.4 This agreement is governed by Israeli law. Exclusive jurisdiction is vested in the competent courts of the Tel Aviv-Jaffa district.

11.5 ChatMe may update this agreement to adapt it to a change in the law or in the service, with 30 days' advance notice. A change that reduces the protection of the information requires the Customer's consent.

Appendix A: Processing details

Appendix B: Sub-processors

The list is current as of November 13, 2026.

Appendix C: Main security measures

Contact

For any question about this agreement or to request a signed copy: edencohen533@gmail.com, 050-5552309.