Data Processing Agreement

1. Roles

1.1 For call content — recordings, transcripts, caller phone numbers, and the enquiry details your callers give — you are the controller and we are your processor. You decided to use an answering service and you decide why calls are handled and how long they are kept.

1.2 For your own account data — your business details, billing records, usage totals, support correspondence, and the verification records we must keep in order to assign you a telephone number — we are the controller, and our Privacy Policy governs it. This is not a matter of preference: we hold those records to meet our own obligations, so we cannot hold them merely on your instructions.

1.3 You confirm you have a lawful basis for the processing you instruct, and that you have given your callers whatever information you are required to give them.

2. Subject matter and scope

3. Our obligations

We will:

3.1 Process personal data only on your documented instructions, which comprise this DPA, the Terms, and the configuration you set in your account. If we believe an instruction breaches data protection law, we will tell you and may suspend that instruction.

3.2 Ensure that anyone we authorise to access the data is under a duty of confidentiality.

3.3 Implement appropriate technical and organisational measures as set out in Schedule 1.

3.4 Engage sub-processors only in accordance with clause 5.

3.5 Assist you in responding to data subject requests. If a caller contacts us directly we will not respond substantively — we will tell them to contact you and inform you promptly. Where a request requires us to retrieve, export or delete a recording, we will do it without undue delay and at no charge.

3.6 Assist you with security obligations, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing.

3.7 Notify you without undue delay, and in any event within 24 hours, of becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties.

3.8 Delete or return the data in accordance with clause 9.

3.9 Make available the information necessary to demonstrate compliance, and allow for audits — see clause 10.

4. Your obligations

You will set a retention period for recordings and transcripts (our default is 90 days), keep your account access secure, give your callers the information data protection law requires, and not use the service to process data you have no lawful basis to process.

5. Sub-processors

5.1 You give general authorisation for us to engage the sub-processors listed at deskcaller.com/subprocessors, which forms part of this DPA.

5.2 We will give you at least 30 days’ notice before adding or replacing a sub-processor, by updating that page and emailing you if you have asked to be notified.

5.3 You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may terminate the affected part of the service without penalty and receive a pro-rata refund of prepaid fees.

5.4 We remain fully liable to you for our sub-processors’ acts and omissions, and impose on them obligations at least as protective as those in this DPA.

6. International transfers

6.1 The service is operated from the United Kingdom. Your account data and your call recordings and transcripts are stored in the UK, and our staff access them from the UK.

6.2 Some sub-processors are located outside the UK — see deskcaller.com/subprocessors, which states each location. Where personal data is transferred to them, we do so under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable, and we have carried out a transfer risk assessment for each. Copies are available on request.

6.3 We will not introduce a transfer to a new country without updating the sub-processor page and giving you notice under clause 5.2, so that you can object.

7. What we do not do

We do not use your call recordings, transcripts or caller data for any purpose of our own. Specifically, we do not use them to train, tune or evaluate our models or prompts; we do not use them for product analytics, benchmarking or research; and we do not use them for our own marketing. Any change to this requires your prior agreement, and would make us a controller for that use rather than your processor.

8. Security

Set out in Schedule 1. We will not materially reduce the overall level of security during the term.

9. Deletion and return

9.1 On termination, or on your written request, we will delete your data within 30 days, or return it in a commonly used machine-readable format if you ask before deletion.

9.2 We may retain data where UK law requires, and only for as long as required. Our own controller records under clause 1.2 are governed by our Privacy Policy retention periods.

10. Audit

We will respond to a reasonable written request for information about our processing within 30 days. Where that is insufficient for your compliance obligations, you may audit us — at your cost, on 30 days’ notice, no more than once a year unless a breach or a regulator requires otherwise, subject to confidentiality and without accessing other customers’ data.

11. General

Liability under this DPA is subject to the limits in the Terms, except where data protection law does not permit limitation. This DPA is governed by the law of England and Wales. Where it conflicts with the Terms on data protection, this DPA prevails.

Schedule 1 — Technical and organisational measures