Data Processing Agreement

1. What this is, and when it applies

This agreement (“DPA”) applies whenever you use CallPal to process personal data about other people — the contacts your team calls, and the people in your organization who use the service. For that data you are the controller and CallPal is the processor: you decide who is called and why, and we act on your instructions.

It forms part of the Terms of Service and takes effect when you accept them. You do not need to sign anything for it to apply. If your procurement process requires a countersigned copy, write to [email protected] and we will return one.

Where CallPal decides how data is used — your own account details, billing, and visitors to our marketing site — we are the controller and the Privacy Policy governs instead. Terms used here that are defined in the GDPR carry their GDPR meaning.

2. Our instructions

We process personal data only on your documented instructions, including for transfers. Your instructions are this DPA, the Terms, and your use of the service — importing contacts, placing calls, enabling recording, connecting a CRM, and the settings your administrators choose.

We do not use your contacts, calls or recordings for our own purposes. We do not sell personal data, and we do not use it to train machine-learning models. If we believe an instruction breaks data protection law, we will tell you rather than carry it out quietly. Where law requires us to process data beyond your instructions, we will inform you first unless that law forbids it.

3. Confidentiality

Access to your data is limited to people who need it to run or support the service, and everyone with such access is bound by a duty of confidentiality that survives their engagement. Support access to a customer workspace happens only to resolve a request or a fault, and playback of a recording is written to an audit log wherever it happens.

4. Security

We implement the technical and organizational measures set out in Annex II, which describes what the system does today rather than what we intend to build. We may change a measure as the product develops, but not in a way that materially lowers the level of protection.

5. Subprocessors

You give general authorization for the subprocessors listed in Annex III. Each is engaged under a written contract imposing data protection obligations no weaker than these, and we remain responsible to you for what they do.

Before we add or replace one, we will tell the administrators on your account by email at least 30 days in advance. If you have a reasonable data protection objection, tell us within those 30 days and we will work with you to find a resolution; if none is available, you may terminate the affected part of the service and receive a refund of fees paid for the unused remainder of the term.

Your carrier and your CRM are not our subprocessors

CallPal is bring-your-own-carrier: your organization provisions its own SIP trunk, and your call traffic goes to your carrier under your contract with them. The same is true of the CRM or spreadsheet service you connect. We pass data to them because you configured them to receive it, and each handles it under its agreement with you. They are your processors, not ours, and Annex III does not list them.

6. Where data is processed, and international transfers

All call media, call recordings and the application database are processed and stored on servers in Nuremberg, Germany. There is one region and it is in the EU, for every customer.

Some of the subprocessors in Annex III process limited data outside the EEA — billing data, the delivery of a transactional email, a sign-in with Google, the bot check on our signup form, product analytics. Where they do, the transfer relies on the European Commission’s standard contractual clauses (Module Three, processor to processor), incorporated into our contract with that provider, together with the UK Addendum where UK data is involved and the Swiss adaptations where Swiss data is. Annex III names each provider’s processing location.

7. Helping you answer the people whose data it is

A person whose data you hold may ask you for access, correction, deletion, restriction, objection or portability. Those requests are yours to answer, and much of what you need is built into the product so you do not have to ask us:

• Erasure — an administrator erases a contact from the contact record itself. The audio is destroyed first, the personal details are overwritten rather than flagged, and a marker is left so the next CRM sync cannot bring that person back.
• Access and portability — contacts and call history are readable and exportable from the application by anyone with the right permission.
• Restriction of recording — recording can be switched off for the organization, paused mid-call by the rep, and a number can be added to the do-not-call list, which every dialer is checked against before it places a call.

Where a request reaches us instead of you, we will not answer it ourselves. We will tell you without undue delay and help you respond, taking into account the nature of the processing and the information available to us. If we cannot identify which customer a request relates to, we will say so rather than guess.

8. Personal data breaches

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and in any case within 72 hours, by email to your account administrators. The notification will describe what happened, the categories and approximate number of records affected as far as we can establish them, the likely consequences, the measures taken or proposed, and a contact point for follow-up. Where the full picture is not yet available we will send what we have and update you as we learn more, rather than wait.

We will not notify a supervisory authority or a data subject on your behalf unless you ask us to in writing: those are the controller’s notifications to make.

9. Data protection impact assessments

Recording conversations and calling people at scale are exactly the activities a DPIA is written for. Taking into account the information available to us, we will provide reasonable assistance with your assessments and with any prior consultation with a supervisory authority that follows from one — starting with this document, Annex II, and answers to specific questions about how the service works.

10. Deletion and return

You can delete contacts, recordings and users at any time while your account is open, and recordings are removed from storage automatically when they pass the retention window your organization set.

When your subscription ends we lock the account rather than deleting it immediately, so your data can still be exported for a reasonable period, and then delete it. You may ask us in writing to delete it sooner and we will do so without undue delay. Copies held in routine backups are overwritten on the ordinary backup cycle rather than extracted individually; until they are, they remain protected by the measures in Annex II and are not used for any other purpose.

We keep only what law requires us to keep — invoices and the records behind them — and audit-log entries which record that an action happened rather than the personal data it concerned.

11. Audits and information

On request we will provide the information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and details of the measures in Annex II.

Where that is not sufficient for your obligations, you may audit us — yourself or through an independent auditor who is not a competitor of ours and is bound by confidentiality — once in any twelve-month period, on at least 30 days’ written notice, during business hours, in a way that does not disrupt the service or expose another customer’s data. You bear the cost of the audit, except where it establishes a material breach of this DPA. A supervisory authority exercising its own powers is not subject to these limits.

12. Duration, precedence and changes

This DPA applies for as long as we process personal data on your behalf, and the obligations that by their nature should survive — confidentiality, deletion, the transfer safeguards — survive its end.

If this DPA conflicts with the Terms, this DPA wins for anything about the processing of personal data. If it conflicts with the standard contractual clauses, the clauses win. We may update this page as the service, the law or our subprocessors change; the “last updated” date reflects the current version, and we will tell customers directly about a change that materially affects how their data is handled.

Annex I — Description of the processing

A. The parties

Controller (data exporter): the customer organization that has accepted the Terms, acting through the administrators on its account. Processor (data importer): CallPal, providing outbound calling, call recording, contact storage and CRM synchronization as described in the Terms.

B. Categories of data subject

• The contacts your organization calls — customers, leads, and other people in your records.
• The people in your organization who use CallPal: reps, managers and administrators.

C. Categories of personal data

• Contact data — name, phone number, email address, company, owner, status and any further fields you choose to import or map from your CRM or spreadsheet.
• Call data — the time and duration of a call, its outcome and hangup cause, the number presented, the trunk used, and which of your users placed it.
• Call recordings — the audio of a call, where your organization has recording enabled, and therefore whatever the parties say during it.
• User data — the names, work email addresses, roles, permissions and authentication data of your team, and the sign-in and administrative events in the audit log.

No special-category data is requested or required. Recording captures whatever is said on a call, so a conversation could contain it; where your calls are likely to, that is a factor for your own assessment under section 9, and the disclosure, pause and do-not-call controls exist for it.

D. Nature, purpose, duration and frequency

Processing is continuous for the duration of your subscription and consists of storing, retrieving and transmitting the data above in order to place outbound calls, record them where you have enabled recording, log the result, write call activity back to a CRM you have connected, and provide the reporting, monitoring and support that go with it. Retention is as described in section 10 and in the Privacy Policy.

Subprocessors process the data described in Annex III, for the purpose stated there, for as long as they provide that part of the service.

Annex II — Technical and organizational measures

Each of these is in place today. Where a measure depends on a setting your organization controls, that is said rather than glossed over.

Encryption

• All application and website traffic is served over TLS.
• The call leg between a rep’s browser and our servers is WebRTC, so its media is always DTLS-SRTP encrypted. The leg from our servers to your carrier uses the transport and media encryption you configure on your trunk; TLS and SRTP are available, and which you use is your carrier’s and your choice.
• Contact phone numbers are encrypted at the field level with AES-256-GCM before they reach the database, and are looked up through a keyed hash, so the database holds no searchable list of numbers.
• Call recordings are encrypted at rest in object storage.
• The credentials for your SIP trunk and your CRM are held in a separate encrypted store, never in ordinary application rows, and are never returned by the API once saved.

Access control

• Every query is scoped to one organization. A user of one workspace cannot address another workspace’s records at all, not merely be refused them.
• Permissions are per action and assigned through roles. By default a rep sees only their own calls and recordings; a manager sees their team’s; and contact phone numbers can be masked from people whose job does not need them.
• A permission change takes effect on the next request rather than when a token expires, and deactivating or deleting a user ends every session they hold and revokes their softphone credential in the same step.
• Passwords are hashed with argon2id. Sign-in is rate limited per source and per address tried, so a password cannot be guessed at leisure, and every refused sign-in is recorded.
• Sessions live in an httpOnly cookie that JavaScript cannot read, rotate on every renewal, have an absolute lifetime, and a replayed token is treated as theft and ends every session for that account.

Accountability and logging

• An audit trail records playing back a recording, muting one, erasing a contact, changing retention or the recording disclosure, listening to or joining a live call, role and permission changes, and sign-ins and refusals.
• Supervision of a live call is written to the trail before it is attempted, so an attempt that failed is still visible.

Controls for the people you call

• A recording disclosure plays to the person you are calling before the two sides are connected. It is on by default, and if it cannot be played the call is dropped rather than connected silently.
• A rep can mute the recording mid-call. It writes silence rather than shortening the file, so the gap is provable and the recording still matches the length of the call.
• A do-not-call list is checked before every dial, by every dialer, and calling hours can be restricted per organization.
• Recording retention is a window your organization sets within your plan’s ceiling; a value above the ceiling is refused rather than silently reduced.

Segregation, resilience and change control

• Production runs on dedicated servers in Germany. The database and recording storage are reachable only from those servers, not from the public internet.
• Production refuses to start with a default or unset secret, and refuses to start if its data encryption keys are not the ones the database was written with — the failure mode that would otherwise silently make stored phone numbers unreadable.
• Changes are reviewed and covered by an automated test suite that must pass before a deployment is allowed to proceed.

Annex III — Subprocessors

Current as of the date at the top of this page.

• Hetzner Online GmbH — Germany. Servers that carry call media and store call recordings, the application database and the application itself. All customer personal data described in Annex I is processed here.
• Railway Corp. — Netherlands (EU region). Hosting for the web application and marketing site; processes connection metadata such as the IP addresses of people who load them.
• Stripe, Inc. and Stripe Payments Europe, Ltd. — Ireland and United States. Subscription billing and card payments. Processes your billing contact and payment details; card numbers go to Stripe directly and are never held by CallPal.
• Plus Five Five, Inc. (Resend) — United States. Transactional email — invitations, verification codes, password resets, billing notices. Processes the recipient’s email address and the content of that message.
• Google Ireland Ltd. / Google LLC — Ireland and United States. “Sign in with Google”, where your organization chooses to use it: processes the email address and name of the user signing in. Google Analytics runs on our marketing site only, never on your workspace data.
• Mixpanel, Inc. — European Union (EU data residency), with the provider in the United States. Product analytics: which features are used and how often, and call metadata — the time, duration and outcome of a call and the internal ID of the user who placed it. Identified only by internal account and workspace IDs; it receives no names, email addresses, phone numbers, contact data or recordings.
• Cloudflare, Inc. — United States. The invisible bot check on our signup form, which reads technical signals from the browser of the person signing up.

Your SIP carrier and your CRM are not on this list, for the reason given in section 5.

Contact

Questions about this page, or a request you would like us to action, go to [email protected]. A person answers.