DATA PROCESSING POLICY

1. Purpose and Roles

This policy applies to data processed by AIO CO on behalf of clients in the course of delivering automation and agentic AI services. In most engagements, the client acts as the data controller, determining the purposes and means of processing, while AIO CO acts as a data processor, processing data on the client's behalf and instructions.

2. Categories of Data Processed

Depending on the engagement, AIO CO may process categories of data including business contact information, customer or patient communications relevant to the automated workflow, scheduling and booking data, transactional and order data, and operational data from connected systems such as CRM or ERP platforms.

3. Purposes of Processing

Data is processed solely for the purpose of designing, building, testing, deploying, and maintaining the automation and agentic AI systems agreed with the client, including configuring workflows, training and tuning AI agents on client-specific information, and monitoring system performance.

4. Data Processing Principles

AIO CO adheres to the following principles when processing data on behalf of clients:

• Lawfulness, Fairness, and Transparency: Data is processed in accordance with the client's instructions and applicable law.
• Purpose Limitation: Data is used only for the purposes agreed with the client.
• Data Minimization: Only data necessary for the agreed automation or agent functionality is processed.
• Accuracy: Reasonable steps are taken to ensure data used in automation remains accurate and current.
• Storage Limitation: Data is retained only as long as necessary for the engagement or as instructed by the client.
• Integrity and Confidentiality: Data is protected through industry-standard security practices.
• Accountability: AIO CO maintains records of processing activities relevant to client engagements.

5. Sub-Processors and Third-Party Tools

AIO CO may engage third-party tools and service providers, such as hosting, communication, or analytics platforms, to support the delivery of automation services. Any such sub-processors are selected with appropriate confidentiality and security obligations in place.

6. International Data Transfers

Where data is transferred outside the country in which it was originally collected, AIO CO takes reasonable steps to ensure such transfers comply with applicable data protection requirements.

7. Security Measures

AIO CO implements industry-standard security practices appropriate to the nature of the data processed, including access controls, encrypted data transmission, and restricted access on a need-to-know basis.

8. Data Breach Notification

In the event of a data breach affecting client data processed by AIO CO, we will notify the affected client without undue delay and provide information necessary for the client to meet their own notification obligations.

9. Data Subject Rights

Individuals whose data is processed as part of an automation engagement may have rights regarding their personal information as described in our Privacy Policy. Requests relating to these rights should be directed to the relevant client (as data controller) or to AIO CO, which will assist as appropriate.

10. Data Retention and Deletion

Data processed in connection with an engagement is retained only for as long as necessary to provide the agreed services, unless a longer retention period is required by law or requested by the client. Upon completion or termination of an engagement, data is deleted or returned in accordance with the client's instructions.

11. Changes to This Policy

We may update this Data Processing Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with a revised "Last Updated" date.

12. Contact Us

If you have questions about this Data Processing Policy, please contact us:

AIO CO
1401 21st Street STE R, Sacramento, CA 95811, United States
Email: info@aioco.co