Skip to content

Legal

Data Processing Addendum

Last updated September 1, 2026

This Data Processing Addendum is part of the Enso FM Terms of Service. It applies automatically to every customer and needs no signature; a countersigned copy is available on request.

Version 1.0, effective September 1, 2026.

1. Scope and how this DPA applies

1.1 Parties. This Data Processing Addendum (“DPA”) is between Enso Integration LLC, a Texas limited liability company, 17350 State Hwy 249, Suite 220 #37085, Houston, Texas 77064 (“Enso”), and the customer that has accepted the Enso FM Terms of Service (the “Terms”) (“Customer”).

1.2 Incorporation. This DPA is incorporated into and forms part of the Terms. It applies to the extent Enso processes Personal Data on Customer’s behalf in providing the Service. Capitalized terms not defined here have the meanings given in the Terms.

1.3 No signature required. Customer’s acceptance of the Terms is acceptance of this DPA. Where Customer’s procurement process requires a countersigned copy, Customer may request one from support@ensointegration.ai; the countersigned copy will have the same content and effective date as this page.

1.4 Precedence. For any matter concerning the processing of Personal Data, this DPA prevails over any conflicting term in the Terms. For every other matter, the Terms prevail. Nothing in this DPA reduces the disclaimers, exclusions, and limitations of liability in the Terms.

2. Definitions

3. Roles of the parties

3.1 Customer is the Controller (or Business) and Enso is the Processor (or Service Provider) of Personal Data. Where Customer itself acts as a processor for an End Client, Enso is a sub-processor, and Customer warrants that its instructions to Enso are authorized by that End Client.

3.2 Enso is a Controller of the account, billing, and contact information of Customer’s own personnel, and of Usage Data, as described in the Privacy Policy. That processing is outside this DPA.

4. Details of processing

The subject matter, duration, nature, and purpose of processing, and the categories of Data Subjects and Personal Data, are set out in Annex 1.

5. Customer’s instructions and obligations

5.1 Instructions. Enso will process Personal Data only on Customer’s documented instructions. The Terms, this DPA, Customer’s configuration of the Service (intake questions, escalation rules, retention settings, recording settings, and integration endpoints), and Customer’s use of the Service’s features are Customer’s complete and final instructions. Additional instructions require Enso’s written agreement and may be subject to fees.

5.2 Lawfulness. Customer is solely responsible for: the lawfulness of its instructions; having a lawful basis for the processing; providing every notice and obtaining every consent that Applicable Data Protection Law requires from Data Subjects, including notice that an automated assistant answers the line and, where Customer enables recording, recording consent; and the accuracy and quality of Personal Data.

5.3 Prohibited data. Customer will not submit, and will configure the Service so that Contacts are not asked for, the categories of data prohibited by Section 8 of the Terms (protected health information, cardholder data, government identification numbers, financial account numbers, biometric identifiers, and data about children under 13). Enso has no obligation under this DPA for data submitted in breach of that Section.

5.4 Unlawful instructions. Enso will inform Customer if, in Enso’s opinion, an instruction infringes Applicable Data Protection Law. Enso is not required to review Customer’s instructions for lawfulness, and may suspend the affected processing until the instruction is withdrawn or corrected.

6. Enso’s obligations

6.1 Confidentiality. Enso ensures that personnel authorized to process Personal Data are bound by written confidentiality obligations and receive appropriate training. Access is limited to what is needed to operate, secure, and support the Service and is logged.

6.2 Security. Enso will implement and maintain the technical and organizational measures described in Annex 2, and may update them from time to time provided the overall level of protection is not materially reduced.

6.3 Assistance with Data Subject requests. Taking into account the nature of the processing, Enso will provide reasonable assistance, through the functionality of the Service and otherwise at Customer’s cost, to help Customer respond to requests from Data Subjects to exercise their rights. If a Data Subject contacts Enso directly about Personal Data processed for Customer, Enso will, where the Customer can be identified, direct the Data Subject to Customer and will not respond substantively except as required by law.

6.4 Assistance with assessments. Enso will provide reasonable information available to it to help Customer carry out any data protection impact assessment or consultation with a supervisory authority that Applicable Data Protection Law requires, at Customer’s cost where the assistance is more than minimal.

6.5 Security Incident notification. Enso will notify Customer without undue delay, and in any event within 72 hours, after confirming a Security Incident affecting Customer’s Personal Data. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. Enso may provide information in phases as it becomes available. Notice is sent to the account administrator’s email on file. Enso’s notice is not an admission of fault or liability. Customer is responsible for any notification to Data Subjects, regulators, or End Clients that Applicable Data Protection Law requires of it.

6.6 Deletion and return. During the term, Customer may export its work-order data through the Service. Within 30 days after the Terms end, Customer may request export of remaining Personal Data. After that period Enso will delete Personal Data, subject to backups that expire on a rolling schedule (after which the data is unrecoverable) and to any retention required by law, in which case Enso will continue to protect the retained data under this DPA and process it for no other purpose.

6.7 Records and audit. Enso will make available the information reasonably necessary to demonstrate compliance with this DPA. Customer may, no more than once in any 12-month period and on at least 30 days’ written notice, verify Enso’s compliance by (a) reviewing Enso’s then-current security documentation, third-party audit reports, or certifications, and (b) submitting a written security questionnaire of reasonable length, which Enso will answer within a reasonable time. An on-site audit is available only where Applicable Data Protection Law gives Customer a non-waivable right to one, or a regulator requires it; it will be at Customer’s cost, during business hours, on reasonable notice, subject to confidentiality, and limited to what is necessary to verify compliance with this DPA. Enso may condition access on the auditor’s agreement to reasonable confidentiality and safety terms.

7. United States state privacy law terms

This Section applies where the CCPA, the TDPSA, or a similar United States state privacy law applies to Personal Data. Enso, as Service Provider or Processor:

8. Subprocessors

8.1 General authorization. Customer authorizes Enso to engage Subprocessors to provide the Service. Enso currently uses Subprocessors in these categories: telephony and messaging (phone numbers, voice, and SMS); AI model hosting (processing of call, message, and email content to run the agents; content sent through its API is not used to train the provider’s foundation models); payment processing; cloud application and database hosting in the United States; transactional email delivery; and website hosting. A current named list is available to customers on request from support@ensointegration.ai.

8.2 Flow-down. Enso will impose on each Subprocessor written data-protection obligations that are no less protective of Personal Data than those in this DPA, to the extent applicable to the service the Subprocessor provides, and remains responsible for each Subprocessor’s performance.

8.3 Changes. Enso will give Customer at least 15 days’ notice, by email to the account administrator or by notice in the app, before authorizing a new Subprocessor that will process Personal Data in a way that materially changes how Personal Data is handled. Customer may object in writing within that period on reasonable data-protection grounds. If the parties cannot resolve the objection within 30 days, Customer may terminate the affected subscription on written notice, and Enso will refund any prepaid Fees for the period after termination. This is Customer’s sole remedy for an objection.

9. International transfers

9.1 The Service is operated from and hosted in the United States, and the Terms restrict its use to the United States. Customer instructs Enso to process Personal Data in the United States.

9.2 If, notwithstanding Section 9.1, Personal Data subject to the GDPR or the UK GDPR is processed under this DPA, the parties agree that the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), Module Two (controller to processor), and, for UK data, the UK International Data Transfer Addendum issued by the Information Commissioner’s Office, are incorporated by reference and apply to that transfer, with Customer as data exporter and Enso as data importer, Annex 1 and Annex 2 of this DPA serving as the corresponding annexes, Option 2 (general authorization) selected for Clause 9, the optional docking clause omitted, Ireland selected for the governing law and forum clauses, and a 15-day period for Subprocessor notices. Where the clauses conflict with this DPA, the clauses prevail for that transfer.

10. Liability

Each party’s liability arising out of or relating to this DPA, including any Standard Contractual Clauses incorporated by it, is subject to the exclusions and limitations of liability in the Terms, and is counted toward, and not in addition to, the aggregate cap there. Enso’s obligations under this DPA are owed to Customer only; Data Subjects, End Clients, and any other third party are not third-party beneficiaries of this DPA except to the extent Applicable Data Protection Law makes a provision directly enforceable by them.

11. Term and changes

11.1 This DPA takes effect when Customer accepts the Terms and continues for as long as Enso processes Personal Data on Customer’s behalf, including any post-termination retention period.

11.2 Enso may update this DPA to reflect changes in Applicable Data Protection Law, in the Service, or in Enso’s Subprocessors. Enso will give notice of a material change in the manner described in Section 18.2 of the Terms, and will update the version and effective date at the top of this page. Where a change is required by law, it takes effect as the law requires.

12. Contact

Questions about this DPA, requests for a countersigned copy, or the current Subprocessor list: support@ensointegration.ai, or by mail to Enso Integration LLC, Attn: Legal, 17350 State Hwy 249, Suite 220 #37085, Houston, Texas 77064.

Annex 1: Details of processing

Subject matter. Operation of the Enso FM after-hours work-order desk for Customer: answering Customer’s inbound calls, texts, and email; capturing work orders; notifying and dispatching Customer’s technicians; recording status and close-out; and handing work orders to Customer’s own systems.

Duration. The term of the Terms plus the post-termination export and deletion period in Section 6.6.

Nature and purpose. Collection, transcription, storage, structuring, analysis by AI models, transmission to Customer’s personnel and systems, and deletion, solely to provide the Service to Customer and as Customer configures it.

Categories of Data Subjects. Callers and message senders on Customer’s line; tenants, occupants, and site staff; End Client personnel such as property managers and facilities coordinators; Customer’s technicians, on-call personnel, and Authorized Users.

Categories of Personal Data. Names; phone numbers; email addresses; site and unit addresses and access notes; the content of calls (as transcripts, and as audio only where Customer enables recording), text messages, and emails handled by the agents; work-order details, urgency, status, and history; technician assignment and location descriptions in status updates; technical data such as timestamps and message identifiers.

Sensitive or special categories. None are intended or permitted. Customer will not submit, and will configure the Service so that Contacts are not asked for, the data prohibited by Section 8 of the Terms. Incidental disclosure by a Contact (for example, a caller volunteering a medical condition) is processed only as part of the transcript and is not used to make inferences.

Frequency. Continuous, as calls, messages, and emails arrive.

Retention. Transcripts, recordings, and work-order data are retained for the period Customer configures or Enso’s default window, then deleted or de-identified; account records are kept as described in the Privacy Policy.

Annex 2: Technical and organizational security measures

Explore Enso FM