Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Servicebetween the customer (“Controller”) and Achroweb Solutions(“Processor”, “we”) and applies when we process personal data in Customer Content on the Controller’s behalf in providing Dialgem, under the UK GDPR, the EU GDPR and other data protection laws that apply (“Data Protection Law”). It takes effect automatically with the Terms; no signature is needed, and we will countersign a copy on request.

Terms such as controller, processor, personal data, processing and personal data breach have the meaning in Data Protection Law. For account, billing and website data, we act as an independent controller under our Privacy Policy, and this DPA does not apply.

• Subject matter and purpose: hosting, transmitting, transcribing, analysing, synthesising and storing call content so the Controller can run voice AI agents.
• Duration: the term of the Terms, plus the period needed to return or delete data under section 8.
• Categories of data subjects:the Controller’s customers, prospects, contacts, employees and anyone else who calls or is called by the Controller’s agents.
• Types of personal data: voice recordings and transcripts, phone numbers, names and contact data, and anything else a person says or the Controller uploads, which may include special-category data if the Controller chooses to collect it.
• Nature of processing: collection, recording, transcription, storage, retrieval, transmission, redaction and deletion.

We will:

1. process personal data only on the Controller’s documented instructions — the Terms, this DPA, and its use of the console and API are those instructions — unless law requires otherwise, in which case we will tell the Controller first where lawful;
2. tell the Controller if we believe an instruction breaches Data Protection Law;
3. keep the data confidential and ensure those authorised to process it are bound to confidentiality;
4. apply the measures in section 4;
5. not sell the data, not use it for our own purposes, and not use it to train AI models;
6. help the Controller respond to data subject requests (see section 6), carry out data protection impact assessments and consult regulators, taking into account the nature of processing and the information we have.

We maintain technical and organisational measures appropriate to the risk, including:

• organisation-scoped data separation, checked on every request;
• role-based access with last-owner protections, and per-organisation API keys stored hashed;
• encryption in transit with TLS, and encryption of SIP trunk credentials before storage;
• per-agent controls the Controller can use to switch off recording and transcripts, redact personal data and set retention, enforced by an automatic sweep;
• no platform secrets in browser code; authorisation enforced server-side;
• logging, monitoring and alerting, and restricted staff access to production data;
• backups and a documented restore process.

We do not currently hold third-party security certifications. We may update these measures provided we do not materially reduce the protection.

The Controller gives general authorisation to the subprocessors on our Subprocessors page. We will notify the Controller at least 30 days before adding or replacing one that processes Customer Content, and the Controller may object on reasonable data-protection grounds in that period. If we cannot resolve the objection, the Controller may terminate the affected Service and receive a refund of unused prepaid credit.

We impose data protection terms on each subprocessor that are no less protective than this DPA, and we remain liable for their performance as for our own.

Where the Controller points an agent at its own third-party accounts, that provider is the Controller’s vendor, not our subprocessor.

We may process personal data in countries other than where it was collected, including the United States. For transfers of personal data subject to the UK or EU GDPR to a country without an adequacy decision, the parties agree that:

• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated, with Clause 7 (docking) included, the Option 2 general authorisation in Clause 9 using the notice period above, the optional language in Clause 11 omitted, Clause 17 governed by the law of Ireland, and Clause 18 resolved in the courts of Ireland;
• for UK transfers, the UK International Data Transfer Addendumissued by the ICO is incorporated, with the tables completed by this DPA;
• Annex I is the details in section 2, with the Controller as exporter and Achroweb Solutions as importer, and Annex II is section 4.

If a transfer mechanism is invalidated or replaced we will agree an alternative in good faith.

If we receive a request from a data subject about Customer Content, we will not respond except to tell them to contact the Controller, and will pass the request on promptly. The console and API let the Controller export and delete call data itself; for what it cannot do itself we will help within a reasonable time, at the Controller’s cost if the effort is significant.

We will notify the Controller without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Content, with the information we then have (nature, likely consequences, and measures taken or proposed), updated as we learn more. A notice is not an admission of fault.

During the term the Controller can export or delete Customer Content. Within 90 days after the Service ends we will delete or anonymise it, unless law requires us to keep it, in which case we will protect it and use it only for that purpose. Copies in backups are overwritten on the normal cycle. On request we will confirm deletion in writing.

On request we will give the Controller the information needed to show we comply with this DPA, such as answers to a reasonable security questionnaire. If that is not enough, or a regulator requires it, the Controller may audit our compliance once a year (or after a breach) on 30 days’ notice, during business hours, under confidentiality, in a way that does not disrupt service or expose other customers’ data, and at its own cost.

This DPA is subject to the liability terms of the Terms of Service, except where Data Protection Law or the Standard Contractual Clauses provide otherwise. If this DPA and the Terms conflict on data protection, this DPA prevails; if it conflicts with the Standard Contractual Clauses, they prevail.

Controllers needing a signed copy, a completed Annex, or a different arrangement (for example under HIPAA, which we do not currently support) should write to legal@dialgem.com. Our data protection contact is privacy@dialgem.com.