Version 1.1, effective September 15, 2026. This version accompanies Terms Version 2.1. Customers subject to Terms Version 2.0 remain subject to DPA Version 1.0 unless and until the updated documents become effective for them.
1. Scope and how this DPA applies
1.1 Parties. This Data Processing Addendum (“DPA”) is between Enso Integration LLC, a Texas limited liability company, 17350 State Hwy 249, Suite 220 #37085, Houston, Texas 77064 (“Enso”), and the customer that has accepted the Enso FM Terms of Service (the “Terms”) (“Customer”).
1.2 Incorporation. This DPA is incorporated into and forms part of the Terms. It applies to the extent Enso processes Personal Data on Customer’s behalf in providing the Service. Capitalized terms not defined here have the meanings given in the Terms.
1.3 No signature required. Customer’s acceptance of the Terms is acceptance of this DPA. Where Customer’s procurement process requires a countersigned copy, Customer may request one from support@ensointegration.ai; the countersigned copy will have the same content and effective date as this page.
1.4 Precedence. For any matter concerning the processing of Personal Data, this DPA prevails over any conflicting term in the Terms. For every other matter, the Terms prevail. Nothing in this DPA reduces the disclaimers, exclusions, and limitations of liability in the Terms.
2. Definitions
- “Applicable Data Protection Law” means all laws that apply to the processing of Personal Data under this DPA, which may include the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), the Texas Data Privacy and Security Act (“TDPSA”), other United States state privacy laws, and, only to the extent they apply, the EU General Data Protection Regulation (“GDPR”) and the UK GDPR.
- “Personal Data” means information in Customer Data that identifies, relates to, describes, or could reasonably be linked to an identified or identifiable natural person, and that Enso processes on Customer’s behalf.
- “Data Subject” means the natural person to whom Personal Data relates, including a Contact.
- “Processing” has the meaning given in Applicable Data Protection Law, and “process” and “processed” are read accordingly.
- “Security Incident” means a confirmed breach of Enso’s security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data in Enso’s possession or control. Unsuccessful attempts, such as blocked log-in attempts, port scans, or denial-of-service attacks that do not compromise Personal Data, are not Security Incidents.
- “Subprocessor” means a third party engaged by Enso to process Personal Data in providing the Service.
- “Sell”, “Share”, “Business”, “Service Provider”, “Controller”, and “Processor” have the meanings given in Applicable Data Protection Law.
3. Roles of the parties
3.1 Customer is the Controller (or Business) and Enso is the Processor (or Service Provider) of Personal Data. Where Customer itself acts as a processor for an End Client, Enso is a sub-processor, and Customer warrants that its instructions to Enso are authorized by that End Client.
3.2 Enso is a Controller of the account, billing, and contact information of Customer’s own personnel, and of Usage Data, as described in the Privacy Policy. That processing is outside this DPA.
4. Details of processing
The subject matter, duration, nature, and purpose of processing, and the categories of Data Subjects and Personal Data, are set out in Annex 1.
5. Customer’s instructions and obligations
5.1 Instructions. Enso will process Personal Data only on Customer’s documented instructions. The Terms, this DPA, Customer’s configuration of the Service (intake questions, escalation rules, retention settings, enabled channels, and integration endpoints), and Customer’s use of the Service’s features are Customer’s complete and final instructions. Additional instructions require Enso’s written agreement and may be subject to fees.
5.2 Lawfulness. Customer is solely responsible for: the lawfulness of its instructions; having a lawful basis for the processing; providing every notice and obtaining every consent that Applicable Data Protection Law requires from Data Subjects; and the accuracy and quality of Personal Data. Every enabled voice flow uses an Enso-controlled opening that identifies the assistant as AI and explains how the call will be handled before substantive intake. In the current activated native flow, the opening states that the call will be transcribed and tells the caller to press 1 at any time to stop AI processing; separately configured consent flows may require an affirmative spoken or keypad response before intake begins. These product controls do not guarantee compliance in every jurisdiction, and Customer remains responsible for assessing whether additional notice, consent, or other controls are required for its use.
5.3 Prohibited data. Customer will not submit, and will configure the Service so that Contacts are not asked for, the categories of data prohibited by Section 8 of the Terms (protected health information, cardholder data, government identification numbers, financial account numbers, biometric identifiers, and data about children under 13). Enso has no obligation under this DPA for data submitted in breach of that Section.
5.4 Unlawful instructions. Enso will inform Customer if, in Enso’s opinion, an instruction infringes Applicable Data Protection Law. Enso is not required to review Customer’s instructions for lawfulness, and may suspend the affected processing until the instruction is withdrawn or corrected.
6. Enso’s obligations
6.1 Confidentiality. Enso ensures that personnel authorized to process Personal Data are bound by written confidentiality obligations and receive appropriate training. Access is limited to what is needed to operate, secure, and support the Service and is logged.
6.2 Security. Enso will implement and maintain the technical and organizational measures described in Annex 2, and may update them from time to time provided the overall level of protection is not materially reduced.
6.3 Assistance with Data Subject requests. Taking into account the nature of the processing, Enso will provide reasonable assistance, through the functionality of the Service and otherwise at Customer’s cost, to help Customer respond to requests from Data Subjects to exercise their rights. If a Data Subject contacts Enso directly about Personal Data processed for Customer, Enso will, where the Customer can be identified, direct the Data Subject to Customer and will not respond substantively except as required by law.
6.4 Assistance with assessments. Enso will provide reasonable information available to it to help Customer carry out any data protection impact assessment or consultation with a supervisory authority that Applicable Data Protection Law requires, at Customer’s cost where the assistance is more than minimal.
6.5 Security Incident notification. Enso will notify Customer without undue delay, and in any event within 72 hours, after confirming a Security Incident affecting Customer’s Personal Data. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. Enso may provide information in phases as it becomes available. Notice is sent to the account administrator’s email on file. Enso’s notice is not an admission of fault or liability. Customer is responsible for any notification to Data Subjects, regulators, or End Clients that Applicable Data Protection Law requires of it.
6.6 Deletion and return. During the term, Customer may export its work-order data through the Service. Within 30 days after the Terms end, Customer may request export of remaining Personal Data. After that period Enso will delete Personal Data, subject to backups that expire on a rolling schedule (after which the data is unrecoverable) and to any retention required by law, in which case Enso will continue to protect the retained data under this DPA and process it for no other purpose.
6.7 Records and audit. Enso will make available the information reasonably necessary to demonstrate compliance with this DPA. Customer may, no more than once in any 12-month period and on at least 30 days’ written notice, verify Enso’s compliance by (a) reviewing Enso’s then-current security documentation, third-party audit reports, or certifications, and (b) submitting a written security questionnaire of reasonable length, which Enso will answer within a reasonable time. An on-site audit is available only where Applicable Data Protection Law gives Customer a non-waivable right to one, or a regulator requires it; it will be at Customer’s cost, during business hours, on reasonable notice, subject to confidentiality, and limited to what is necessary to verify compliance with this DPA. Enso may condition access on the auditor’s agreement to reasonable confidentiality and safety terms.
7. United States state privacy law terms
This Section applies where the CCPA, the TDPSA, or a similar United States state privacy law applies to Personal Data. Enso, as Service Provider or Processor:
- will process Personal Data only for the limited and specified business purpose of providing the Service to Customer as described in the Terms and Annex 1, and for no commercial purpose other than that;
- will not Sell or Share Personal Data;
- will not retain, use, or disclose Personal Data for any purpose other than the business purpose specified, including any commercial purpose, or outside the direct business relationship between Enso and Customer, except as permitted by Applicable Data Protection Law (for example, to detect security incidents, to comply with law, or to build de-identified or aggregated data that no longer constitutes Personal Data);
- will not combine Personal Data received from Customer with personal information received from another source or collected from Enso’s own interaction with the Data Subject, except as permitted by Applicable Data Protection Law;
- will comply with the obligations of Applicable Data Protection Law that apply to service providers and processors, and will provide the same level of privacy protection as that law requires of Customer;
- will notify Customer if Enso determines it can no longer meet its obligations under Applicable Data Protection Law, after which Customer may take the reasonable and appropriate steps that law allows to stop and remediate unauthorized use;
- grants Customer the right to take reasonable and appropriate steps to ensure Enso uses Personal Data consistently with Customer’s obligations under Applicable Data Protection Law, through the audit mechanism in Section 6.7;
- will engage Subprocessors only under written contracts that impose obligations at least as protective as this Section, and will notify Customer of Subprocessor engagements as described in Section 8; and
- certifies that it understands the restrictions in this Section and will comply with them.
8. Subprocessors
8.1 General authorization. Customer authorizes Enso to engage Subprocessors to provide the Service. Enso currently uses Subprocessors in these categories: telephony and messaging (phone numbers, voice, and SMS); AI model hosting (processing of call, message, and email content to run the agents; content sent through its API is not used to train the provider’s foundation models); payment processing; cloud application and database hosting in the United States; transactional email delivery; and website hosting. A current named list is available to customers on request from support@ensointegration.ai.
8.2 Flow-down. Enso will impose on each Subprocessor written data-protection obligations that are no less protective of Personal Data than those in this DPA, to the extent applicable to the service the Subprocessor provides, and remains responsible for each Subprocessor’s performance.
8.3 Changes. Enso will give Customer at least 15 days’ notice, by email to the account administrator or by notice in the app, before authorizing a new Subprocessor that will process Personal Data in a way that materially changes how Personal Data is handled. Customer may object in writing within that period on reasonable data-protection grounds. If the parties cannot resolve the objection within 30 days, Customer may terminate the affected subscription on written notice, and Enso will refund any prepaid Fees for the period after termination. This is Customer’s sole remedy for an objection.
9. International transfers
9.1 The Service is operated from and hosted in the United States, and the Terms restrict its use to the United States. Customer instructs Enso to process Personal Data in the United States.
9.2 If, notwithstanding Section 9.1, Personal Data subject to the GDPR or the UK GDPR is processed under this DPA, the parties agree that the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), Module Two (controller to processor), and, for UK data, the UK International Data Transfer Addendum issued by the Information Commissioner’s Office, are incorporated by reference and apply to that transfer, with Customer as data exporter and Enso as data importer, Annex 1 and Annex 2 of this DPA serving as the corresponding annexes, Option 2 (general authorization) selected for Clause 9, the optional docking clause omitted, Ireland selected for the governing law and forum clauses, and a 15-day period for Subprocessor notices. Where the clauses conflict with this DPA, the clauses prevail for that transfer.
10. Liability
Each party’s liability arising out of or relating to this DPA, including any Standard Contractual Clauses incorporated by it, is subject to the exclusions and limitations of liability in the Terms, and is counted toward, and not in addition to, the aggregate cap there. Enso’s obligations under this DPA are owed to Customer only; Data Subjects, End Clients, and any other third party are not third-party beneficiaries of this DPA except to the extent Applicable Data Protection Law makes a provision directly enforceable by them.
11. Term and changes
11.1 This DPA takes effect when Customer accepts the Terms and continues for as long as Enso processes Personal Data on Customer’s behalf, including any post-termination retention period.
11.2 Enso may update this DPA to reflect changes in Applicable Data Protection Law, in the Service, or in Enso’s Subprocessors. Enso will give notice of a material change in the manner described in Section 18.2 of the Terms, and will update the version and effective date at the top of this page. Where a change is required by law, it takes effect as the law requires.
12. Contact
Questions about this DPA, requests for a countersigned copy, or the current Subprocessor list: support@ensointegration.ai, or by mail to Enso Integration LLC, Attn: Legal, 17350 State Hwy 249, Suite 220 #37085, Houston, Texas 77064.
Annex 1: Details of processing
Subject matter. Operation of the Enso FM after-hours work-order desk for Customer: processing configured inbound calls, texts, and forwarded email; capturing work orders; attempting configured notifications and supporting technician dispatch; recording status and completion updates; and handing work orders to Customer’s own systems.
Duration. The term of the Terms plus the post-termination export and deletion period in Section 6.6.
Nature and purpose. Collection, transcription, storage, structuring, analysis by AI models, transmission to Customer’s personnel and systems, and deletion, solely to provide the Service to Customer and as Customer configures it.
Categories of Data Subjects. Callers and message senders on Customer’s line; tenants, occupants, and site staff; End Client personnel such as property managers and facilities coordinators; Customer’s technicians, on-call personnel, and Authorized Users.
Categories of Personal Data. Names; phone numbers; email addresses; site and unit addresses and access notes; transcripts of calls; text messages and emails handled by the agents; work-order details, urgency, status, and history; technician assignment and location descriptions in status updates; technical data such as timestamps and message identifiers. On enabled voice lines, call audio is processed in real time but is not retained by the current self-serve service.
Sensitive or special categories. None are intended or permitted. Customer will not submit, and will configure the Service so that Contacts are not asked for, the data prohibited by Section 8 of the Terms. Incidental disclosure by a Contact (for example, a caller volunteering a medical condition) is processed only as part of the transcript and is not used to make inferences.
Frequency. Continuous, as calls, messages, and emails arrive.
Retention. Transcripts and work-order data are retained for the period Customer configures or Enso’s default window, then deleted or de-identified; account records are kept as described in the Privacy Policy. The current self-serve service does not retain call audio.
Annex 2: Technical and organizational security measures
- Encryption in transit. TLS for traffic between users, the Service, and its providers.
- Encryption at rest. Stored data and backups are encrypted by the underlying cloud platforms; integration secrets are encrypted at the application layer.
- Tenant isolation. Each customer has its own workspace; every query is scoped to the tenant, and cross-tenant access is available only to logged, privileged platform staff in a read-only mode.
- Access control. Role-based access (administrator, dispatcher, field-only technician); per-user credentials; multi-factor authentication available to customers and enforceable per organization; least-privilege access for Enso personnel, reviewed periodically.
- Audit logging. Privileged actions, account and configuration changes, terms acceptance, and support access are recorded with actor, tenant, IP address, and user agent, and retained independently of the records they describe.
- Application security. Security headers (CSP, frame denial, content-type sniffing protection), rate limiting on authentication and public endpoints, signed webhooks, input validation, and protection against CSV formula injection in exports.
- Telephony and messaging controls. Automated opt-out processing and suppression lists; quiet-hours holds on outbound technician SMS; and an Enso-controlled opening that identifies the AI assistant and applies the notice, consent-gate, and stop controls configured for that voice flow. The current activated native flow states that the call will be transcribed and accepts keypad 1 at any time to stop AI processing.
- Retention and deletion. Configurable per-tenant retention windows for deliveries, email ingests, and closed work orders; offboarding runs export, release, and purge; backups expire on a rolling schedule.
- Resilience. Managed cloud hosting with automated backups; durable queues with retry for outbound deliveries and notifications; per-tenant concurrency caps and a daily spend circuit breaker to contain incidents.
- Subprocessor management. Written contracts with each Subprocessor; category list published; notice of material changes.
- Vulnerability handling. A published security contact and disclosure process at
/.well-known/security.txt; dependency updates; fixes prioritized by severity. - Incident response. Confirmed Security Incidents are triaged, contained, and notified to affected customers as described in Section 6.5.