Data Processing Agreement

• "Personal Data" means call recordings, transcripts, phone numbers, and any information relating to identified or identifiable individuals
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, and deletion
• "Data Subject" means the individual calling Customer's phone number
• "Subprocessor" means any third party engaged by Processor to process Personal Data

2.1 Scope of Processing

2.2 Processor's Obligations

• Process Personal Data only on documented instructions from Controller
• Ensure persons authorized to process Personal Data are bound by confidentiality
• Implement appropriate technical and organizational security measures
• Assist Controller with data subject rights requests
• Delete or return Personal Data at the end of services
• Make available information necessary to demonstrate compliance

Processor implements and maintains the following security measures:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls with role-based permissions and multi-factor authentication
• Regular security assessments and vulnerability scanning
• Incident response procedures with 72-hour breach notification
• Employee security training and background checks
• Secure software development lifecycle practices

4.1 Authorized Subprocessors

Controller agrees to the use of the following categories of subprocessors:

4.2 Adding or Changing Subprocessors

Personal Data may be processed in the United States and other countries where our subprocessors operate. We ensure appropriate safeguards are in place for any international transfers:

• Standard Contractual Clauses with all subprocessors
• Encryption and access controls for all transfers
• Compliance with applicable data transfer regulations

Processor shall assist Controller in responding to data subject requests for:

• Access to their personal data
• Correction of inaccurate data
• Deletion of their data
• Data portability
• Objection to processing

Processor will make available to Controller all information necessary to demonstrate compliance with this DPA and allow for audits:

• Annual security assessment reports
• Security questionnaire responses
• On-site audits with 30 days notice (at Controller's expense)

In the event of a personal data breach, Processor shall:

• Notify Controller without undue delay and within 72 hours
• Provide details of the breach, affected data, and potential consequences
• Take immediate measures to mitigate the breach
• Cooperate with Controller in any investigation

This DPA shall remain in effect for the duration of the Service Agreement. Upon termination:

• Processor will delete or return all Personal Data within 30 days
• Deletion certificate will be provided upon request
• Legal retention requirements may override deletion