1.Roles
You are the controller (or data fiduciary, or business) of personal data in your workspace. We are your processor (or service provider) and act only on your documented instructions, which are the agreement, this addendum, and your configuration and use of the service.
2.Details of processing
| Item | Description |
|---|---|
| Subject matter | Providing the cloud communications service described in the agreement. |
| Duration | The term of the agreement plus the export and deletion period. |
| Nature and purpose | Hosting, storing, transmitting, routing, recording, transcribing, analysing, and displaying communications and related data to provide the service, and AI processing when you enable it. |
| Data categories | Names, phone numbers, email addresses, call detail records, recordings, voicemail, messages, chat, meeting data, contacts, calendar events, files, AI agent transcripts, device and log data. Special categories only if you choose to put them in the service. |
| Data subjects | Your users, your customers and prospects, callers, meeting guests, and other people who communicate with you through the service. |
| Frequency | Continuous, for as long as the service is used. |
3.Our commitments
- Process personal data only to provide the service and as you instruct; tell you if an instruction appears to break the law.
- Keep it confidential, and limit access to staff and subprocessors who need it and are bound by confidentiality.
- Help you answer data subject requests, impact assessments, and regulator enquiries, taking into account the nature of the processing.
- Notify you without undue delay, and within 72 hours where possible, after becoming aware of a personal data breach affecting your data, with the information we have to help you meet your own duties.
- Not sell personal data, not retain, use, or disclose it outside the direct business relationship, and not combine it with other data, as required of a service provider under US state privacy laws.
- Delete or return personal data when the service ends, as described below.
4.Security measures
We maintain technical and organisational measures appropriate to the risk, including the following.
| Area | Measure |
|---|---|
| Access control | Role-based permissions, scoped API keys, administrator audit logging, and access limited to staff who need it. |
| Tenant isolation | Every workspace is a separate organization. Users, numbers, calls, messages, and files are scoped to it. |
| Encryption | TLS for traffic to the website, application, and API. Stored credentials and integration secrets are encrypted at the application layer. |
| Resilience | Hosted on Oracle Cloud Infrastructure in India with backups. Restore procedures are tested. |
| Development | Peer review, dependency checks, separate sandbox environments, and no use of production customer data in testing. |
| Monitoring | Request IDs on administrative and API activity, webhook delivery logs, and alerting on service errors. |
| People | Confidentiality obligations and security guidance for staff with access to systems. |
5.Subprocessors
You authorise the subprocessors listed on our Subprocessors page. We impose data protection obligations on them that are no less protective than this addendum and remain responsible for their performance. We give at least 30 days' notice before adding a subprocessor that processes customer service data. You may object on reasonable data protection grounds within that period; if we cannot resolve the objection you may end the affected service and receive a refund of prepaid fees for it.
6.International transfers
The service is hosted in India. Some subprocessors process data in other countries. Where the law requires a transfer mechanism, the following apply and are incorporated into this addendum:
- EEA personal data: the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) and, where you act as a processor, Module Three. Clause 7 (docking) is included, the option in Clause 11 is not used, the supervisory authority is the one that supervises you, and the governing law and courts are those of Ireland.
- UK personal data: the UK International Data Transfer Addendum to the EU clauses, issued by the Information Commissioner.
- Swiss personal data: the EU clauses, with references to the GDPR read as references to the Swiss FADP and the Swiss Federal Data Protection and Information Commissioner as a competent authority.
- Indian personal data: transfers abroad follow section 16 of the DPDP Act and any restriction notified by the Government, and sector rules that apply to you.
For subprocessors certified under the EU-US Data Privacy Framework we may rely on it in addition to the clauses. We assess the transfer risk and add supplementary measures where needed.
7.Data subject requests
If a data subject contacts us about data we hold for you, we will refer them to you unless the law requires otherwise. The service includes export and deletion tools so you can respond yourself. We will help with requests that you cannot answer with those tools.
8.Audits and information
We provide information reasonably needed to show compliance with this addendum, including answers to security questionnaires, once a year or after a breach. If that does not satisfy a regulator or the law, you may carry out an audit with 30 days' notice, during business hours, under confidentiality and without disrupting other customers. Each party bears its own costs unless the audit finds a material breach.
9.Deletion and return
When the service ends, you can request an export within 30 days. We then delete your service data from active systems, and from backups as they expire, unless the law requires us to keep it.
10.Liability and precedence
Each party's liability under this addendum is subject to the limits in the Terms of service, to the extent the law allows. If this addendum conflicts with the Standard Contractual Clauses, the clauses prevail for the transfers they cover; otherwise this addendum prevails over the rest of the agreement on the processing of personal data.
Need help with this document?
Choose the route that matches your question. These links do not replace the terms above.