Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms & Conditions between you (“Customer”, the data controller) and JAROHINA TECHNOLOGIES PRIVATE LIMITED (“Vocallie”, the data processor) governing our processing of personal data on your behalf when you use the Service. It applies to Customers whose processing is subject to the EU General Data Protection Regulation (GDPR), the UK GDPR, or India’s Digital Personal Data Protection Act, 2023 (DPDP), or any comparable law.

By using the Service, you accept this DPA. If your organisation requires a countersigned copy for its records, email [email protected].

1. Roles & scope

You are the controller of the personal data you upload and of the personal data of the individuals your agents call. Vocallie is the processor, acting only on your documented instructions (which are the Terms, this DPA, and the settings you configure inside the Service).

2. Nature & purpose of processing

• Placing and receiving calls on your behalf.
• Transcribing calls, generating summaries, and storing them in your account.
• Storing contacts, leads, follow-ups, and knowledge-base content you provide.
• Sending transactional email to your account admins.
• Producing analytics visible only inside your account.

3. Categories of data

• Identifiers (names, phone numbers, email addresses, business details).
• Voice recordings and machine-generated transcripts.
• Free-form content you enter (CRM notes, KB documents, instructions).
• Technical data required to operate the Service (IP address, logs, usage metrics).

You must not upload sensitive categories of data (health, financial account credentials, government IDs, biometrics beyond voice) unless your plan explicitly supports it and you have a lawful basis to process them.

4. Data subjects

The individuals whose data we process on your behalf are: your account users; your contacts/leads; and the people your agents call or who call you.

5. Sub-processors

You give general authorisation for Vocallie to engage sub-processors to deliver the Service. The current list is published at /subprocessors. We will update that page when the list changes; if you have subscribed to notifications at [email protected], we will email you in advance where reasonable. Each sub-processor is bound by contractual data-protection obligations no less protective than this DPA.

6. Security

Vocallie applies the following technical and organisational measures:

• Encryption in transit (TLS 1.2+) for all customer-facing traffic.
• Encryption of secrets and API tokens at rest.
• Access to production systems restricted to designated personnel and audited.
• Principle of least privilege for internal services and multi-tenant data isolation.
• Regular backups of the primary database and periodic restore verification.
• Vulnerability monitoring and prompt patching of critical CVEs.

7. Data-subject requests

You are responsible for responding to requests from data subjects (access, correction, deletion, portability, restriction, objection). The Service gives you the tools to fulfil these directly: you can edit or delete contacts, calls, recordings, and account data from the dashboard. Where you need our assistance, contact us and we will help you at no charge unless requests are unreasonable in volume.

8. International transfers

Where personal data is transferred out of the EEA, UK, or India to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (module 3 — processor-to-processor) or an equivalent lawful mechanism, together with the supplementary measures described in our sub-processor contracts.

9. Breach notification

If Vocallie becomes aware of a personal-data breach affecting your data, we will notify you without undue delay (and in any event within 72 hours where feasible), with the information reasonably necessary for you to meet your own regulatory obligations.

10. Audits

On reasonable prior written notice and no more than once every 12 months (except after a confirmed breach), Vocallie will make available the information necessary to demonstrate compliance with this DPA. Where the Customer requires an on-site audit, the parties will agree the scope, timing, and cost in advance.

11. Return & deletion

On termination of your account, and unless you export data first, Vocallie will delete or anonymise your personal data within 90 days, except where retention is required by law (e.g. tax records) or to defend legal claims.

12. Liability & conflict

The liability of each party under this DPA is subject to the limitations set out in the Terms & Conditions. If this DPA conflicts with the Terms in relation to processing of personal data, this DPA prevails.

13. Contact

For any request under this DPA, including to sign a countersigned copy, contact [email protected].