Data Processing Agreement

Last updated: 24 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the business customer ("Controller", "you") and Polaris Digital Platforms EOOD (EIK 208683849, VAT BG208683849), Kapitan Raycho Nikolov No. 34, Ruse 7000, Bulgaria ("Processor", "we"). It applies to personal data of your website visitors and kiosk guests that we process on your behalf when you use Inter Reception, as required by Article 28 GDPR.

1. Subject matter and duration

We process personal data to provide the AI avatar service for as long as you use the service and until deletion under section 9.

2. Nature, purpose, data and subjects

3. Our obligations

We will (a) process personal data only on your documented instructions, which are these terms and your configuration of the service; (b) ensure that persons authorised to process it are bound by confidentiality; (c) apply the security measures in section 4; (d) respect the conditions for sub-processors in section 5; (e) help you answer data-subject requests and meet your obligations under Arts. 32–36 GDPR, taking into account the nature of processing; (f) delete or return the data under section 9; (g) give you the information needed to show compliance and allow reasonable audits (by questionnaire first, with at least 30 days' notice, no more than once a year unless a breach occurred); (h) tell you if we believe an instruction breaches data protection law.

4. Security measures

Encrypted connections (HTTPS); hashed passwords; role-based access to accounts; rate limiting and bot protection on public endpoints; separation of each customer's data; access to production data limited to authorised staff.

5. Sub-processors

You give general authorisation to the sub-processors below. We will inform you by e-mail at least 14 days before adding or replacing one; you may object on reasonable data-protection grounds within that period, and if we cannot resolve it either party may terminate the affected service. We impose on sub-processors obligations equivalent to this DPA.

Sub-processor Purpose Location
OpenAI Language model for avatar answers, speech and text processing United States
Anam Live avatar video and voice See section 6
HeyGen (LiveAvatar) Live avatar video United States
Simli, Spatius Alternative avatar providers (used only if selected for your account) See section 6
ElevenLabs Synthetic voice (used only if selected for your account) United States
Fish Audio Alternative synthetic voice (used only if selected for your account) See section 6
Stripe Payment processing European Union / United States
Cloudflare Content delivery and security proxy for our website, bot protection (Turnstile) United States / global
Hetzner Online GmbH Hosting of the platform and data (servers) Germany
Resend Sending service e-mails United States

6. International transfers

For transfers outside the EU/EEA we rely on the EU Standard Contractual Clauses (Module 3, processor to sub-processor) or an adequacy decision / EU–US Data Privacy Framework certification of the recipient.

7. Personal data breaches

We notify you without undue delay, and in any case within 48 hours after becoming aware of a breach affecting your data, with the information we have to help you meet your notification duties.

8. Your responsibilities

You are the controller: you decide the legal basis, give visitors the required notice (including that they are speaking with an AI), and decide what the avatar may collect. You will not instruct the avatar to collect special-category data.

9. Deletion and return

When you close the account or ask us to, we delete conversation records and leads within 30 days, except what the law requires us to keep. On request, before deletion, we give you a copy of your lead and conversation records in a common machine-readable format.

10. Contact

[email protected]