DPA / GDPR

For avaga.io marketing pages and sales forms, Avaga is typically the controller of the work email and the questions you send us.

For Avaga Workspace, your company is typically the controller of caller, customer, and staff records. Avaga is typically the processor. A signed DPA is the paper that says so. This page is not that paper.

GDPR appears on the footer next to SOC 2 Type II, HIPAA, and SSO / SAML. That mark means we will have a DPA conversation. It does not mean every subprocess, transfer tool, and retention clock is published on Lite checkout.

If GDPR, UK GDPR, or a similar law is load-bearing for your buy, talk to sales before you put production traffic on the floor.

Workspace processing includes the categories in the Privacy Policy: accounts, billing, calling, inbox, AI transcripts and summaries, ads and form leads, API and webhook payloads you send us, and support tickets about that floor.

Instructions come from you: who you seat, which numbers you buy, which AI employees you promote, which integrations you switch on, and what you export.

Avaga lists offices in Paris, New York, London, Sydney, Berlin, Madrid, San Francisco, Mexico City, and Bellevue. Listing a city is not a map of every disk. Carriers complete calls where they operate.

Standard contractual clauses and a DPA are available through sales. We do not paste a generic SCC into this page and call it signed.

Voice and messaging require carriers. Infrastructure requires hosts. The commercial rule on the site is pass-through: what we pay carriers is what you pay, plus the plan fee.

Ask sales for the current subprocessors list if your DPA requires it. Do not assume a logo on the homepage is a subprocessor, and do not assume an unnamed host is approved because a badge says GDPR.

People can ask Avaga to access, correct, delete, or export marketing-site leads we control. Write hello@avaga.io.

People who called your number or messaged your inbox are usually your request, not ours. We will help a workspace admin locate or export records where the product allows it. Data export is an extra on every plan. Custom reports are on Business.

Role-based permissions, Google Sign-in, 2FA, and recording pause/resume are on every plan. SSO/SAML is contact sales. Details live on the Security center. A DPA may point to that page and to a review packet. It will not invent controls the product does not have.

You configure product retention. You export before you close a workspace. Invoices and fraud records may outlive the floor. The DPA will say how deletion requests move from you to us and how long a backup window lasts. Until that paper is signed, treat Privacy as the public description.

If you need a US state addendum, a UK addendum, or a similar schedule, say so in the DPA request. We do not publish a separate policy for every statute on this desk. The practical path is one DPA conversation.

Use Compliance & BAA and write DPA in the need field, or email hello@avaga.io. Include your legal entity, where you operate, and whether you also need a BAA. Phone +1 415 723 8585.