Data Processing Addendum

1. Roles and scope

You are the controller (or “business”) of personal information in Customer Data, such as leads’ names, phone numbers, email addresses, company details, call transcripts and qualification answers. We are your processor (or “service provider”/“contractor”). We process it only to provide, secure and support the Service, on your documented instructions (these Terms, your configuration and your use of the Service), unless the law requires otherwise, in which case we’ll tell you where allowed.

2. Details of processing

• Subjects: your leads and prospects; your users and team members.
• Data: contact details, company information, form submissions and consent records, call audio streamed in real time (not stored), transcripts, call outcomes and scores, enrichment data, and CRM data you connect.
• Purposes: calling and qualifying your leads, transferring calls, alerts, reporting, CRM write-back, support, security and billing.
• Duration: for the term of your account, then deletion as in Section 8.

3. Your responsibilities

You are responsible for the lawfulness of the personal information you send us and your instructions, including having a legal basis, giving any notices and obtaining any consents (including consent to be called with an AI voice, and to recording or transcription where required), and handling requests from your leads.

4. Confidentiality and security

We ensure people who process Customer Data are bound by confidentiality. We maintain appropriate technical and organizational measures, including encryption in transit, encryption of stored integration credentials, access controls limited to staff who need access, separation of each customer’s data, logging, and monitoring. We may update these measures as long as overall protection isn’t reduced.

5. Subprocessors

You authorize us to use the subprocessors listed here. We’ll update that page before adding or replacing a subprocessor and, on request, notify you by email; you may object on reasonable data-protection grounds within 15 days, and if we can’t address the objection either party may terminate the affected part of the Service. We impose data-protection obligations on subprocessors at least as protective as this DPA and remain responsible for their performance.

6. Requests and assistance

If a lead or other person contacts us to access, correct, delete or opt out of processing of their information in Customer Data, we’ll refer them to you or tell you, and won’t respond ourselves except as you instruct or the law requires. We’ll provide reasonable help with your obligations, including security, data protection assessments and regulator inquiries, considering the nature of the processing.

7. Security incidents

We’ll notify you without undue delay, and within 72 hours where feasible, after confirming a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data, and give you the information reasonably available to help you meet your obligations.

8. Deletion and return

You can export Customer Data and delete your account in the portal at any time. On deletion, we delete Customer Data from live systems promptly and from backups within about 30 days, except where the law requires us to keep it.

9. Audits

On reasonable written request, no more than once a year, we’ll answer security questionnaires and provide information reasonably necessary to show compliance with this DPA.

10. International transfers

We and our subprocessors process data in the United States. Where data protection law requires a transfer mechanism, the parties will rely on an appropriate mechanism, such as the EU Standard Contractual Clauses, which we’ll sign on request.

11. CCPA/CPRA

Where the California Consumer Privacy Act applies, we act as your service provider and contractor. We won’t sell or share personal information in Customer Data, retain, use or disclose it for any purpose other than the business purposes in this DPA, or outside our direct business relationship with you, or combine it with personal information from other sources except as the law allows. We certify that we understand and will comply with these restrictions, and will tell you if we can no longer meet our obligations.