sonarsense.io

Data Processing Agreement

Template for Corporate Customers (B2B) · Part 3, Art. 6 of Federal Law 152 · Effective Date: May 25, 2026

1. Parties

  • Customer (Personal Data Operator)— a legal entity that has subscribed to SonarSense services and is the operator of personal data of its employees and other individuals in accordance with clause 2 of Art. 3 of Federal Law 152-FZ.
  • Contractor (Guarantor)— SONAR LLC (INN 3666278212, OGRN 1263600003952, Reg. No. in the Operators Register 36-26-044855), processing personal data on behalf of the Customer in accordance with Part 3 of Art. 6 of Federal Law 152-FZ.

2. Subject

The Customer entrusts the Contractor with processing personal data of the Customer’s employees and other individuals (the Customer’s employees' counterparties participating in recorded conversations), within the scope, terms, and purposes described in Privacy Policy and Sonar Assistant Privacy Policy.

3. List of operations involving personal data

  • collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction
  • use (speech recognition, AI prompt generation, and analysis result generation)
  • transfer to second-level guarantors (see section 6) — including cross-border transfer
  • anonymization, blocking, deletion, destruction

4. Requirements for the Contractor's protection of personal data

The contractor provides the following security measures in accordance with Article 19 of Federal Law No. 152-FZ:

  • organizational measures: access control, employee training, data access control
  • technical measures: connection encryption (TLS 1.2+), backup, unauthorized access monitoring
  • localization of processing results on servers in the Russian Federation (Art. 18.5 of Federal Law 152-FZ)
  • obtaining separate consents from Data Subjects for the processing of biometric personal data and cross-border transfer
  • notification of intent to carry out cross-border transfer has been submitted to Roskomnadzor and approved

5. Responsibility of parties

5.1. The Customer is responsible for ensuring that legal grounds exist for processing the Subjects' personal data and for obtaining the necessary consents, including consent to record conversations involving third parties (see article 152.2 of the Civil Code of the Russian Federation).

5.2. The Contractor is responsible for the security of personal data processing on its side and at second-level processors within the scope of its mandate.

5.3. The parties allocate responsibility in accordance with part 5 of article 6 of 152-FZ: the Customer is responsible to the Subject for the Contractor's actions within the scope of the mandate; the Contractor is responsible to the Customer for actions that violate the terms of this Agreement.

6. Engaging third parties (second-level processors)

The Customer is notified of the Contractor's engagement of the following third parties and consents to the transfer of Data Subject personal data to them, to the extent described in the Policies:

  • Soniox, Inc. (USA, servers in Germany) — speech recognition
  • OpenRouter, Inc. (USA) — AI hint generation
  • Google LLC (USA), DeepSeek AI (China) — backup AI providers
  • Hetzner Online GmbH (Germany) — network egress proxy
  • YANDEX LLC (Russia) — authentication (for web platform), Yandex SmartCaptcha

7. Incident notification

7.1. Upon detecting an incident that has caused or could cause unauthorized access to personal data, the Contractor notifies the Customer within 24 (twenty-four) hours of detecting the incident by email.

7.2. The Customer independently notifies Roskomnadzor of the incident in the manner prescribed by Art. 21 of 152-FZ.

8. Validity period

The contract is valid from the moment of acceptance by the Customer until the termination of the corporate subscription. After subscription termination, the Contractor deletes the personal data of the Subjects within 30 (thirty) calendar days.

9. Applicable Law

This Agreement is governed by the legislation of the Russian Federation. All disputes shall be resolved in the manner established by the legislation of the Russian Federation.

Acceptance

This Agreement may be accepted in one of the following ways:

  • marking "I Accept the Data Processing Agreement" in the Customer's administrator personal account in the Service
  • signing a separate copy of the Agreement upon Customer's request (send to support@sonarsense.io)

© 2026 sonarsense.io