Data Processing Agreement

# Data Processing Agreement

Last updated: [effective date] — Version 1.0 (DRAFT)

This Data Processing Agreement ("DPA") is entered into by and between [Company Legal Name] ("Processor") and each Customer Organization ("Controller") that uses the Outbound Service. This DPA is incorporated into the Terms of Service.

## 1. Subject matter and duration

• - Subject matter: personal information contained in Customer Data (names, phone numbers, email addresses, interaction metadata, and call recordings/transcripts where enabled) that the Controller provides to the Processor to operate the Service.
• - Duration: the term of the Services under the Terms of Service.
• - Nature and purpose: to provide the outbound communication Service on the Controller's behalf.
• - Types of data subjects: the Controller's contacts — US consumers the Controller has lawfully collected consent or a lawful basis to contact.

## 2. Obligations of the Controller (you)

• - You are the controller. You are responsible for (a) the lawfulness of collecting Customer Data, (b) the notices you give to data subjects, (c) obtaining the consents required by law for the calls and messages you place through the Service, and (d) responding to data-subject requests you receive directly.
• - You warrant that you have all rights and consents necessary to provide Customer Data to the Processor and to use the Service as you do.

## 3. Obligations of the Processor (us)

We will process Customer Data only on documented instructions from the Controller (the Service itself, its configuration, and the Terms constitute those instructions), under this DPA, and in accordance with applicable law. We will:

• - Keep personnel who process Customer Data bound to confidentiality;
• - Implement the technical and organizational measures in Section 5;
• - Process personal data subject to the Controller's instructions and this DPA;
• - Assist the Controller in responding to data-subject requests, taking into account the nature of the processing;
• - Inform the Controller, without undue delay, after becoming aware of a breach of this DPA;
• - At the Controller's choice, delete or return Customer Data after the end of the Service, and delete existing copies unless law requires retention;
• - Make available to the Controller the information reasonably necessary to demonstrate compliance, including audit support (the append-only audit log is available to the account's admins).

## 4. Sub-processors

The Controller authorizes the following sub-processors (the "Authorized Sub-processors"), which are bound by data-processing terms imposing data-protection obligations no less protective than this DPA:

• - Twilio — telephony (calls, SMS, number infrastructure)
• - Cloudflare — cloud infrastructure, tunneling, email routing
• - [AI model provider] — language-model inference for agent replies [COUNSEL REVIEW: name the actual model provider and confirm its DPA/sub-processor terms.]

We will give the Controller at least 30 days' notice before adding a sub-processor. The Controller may object on reasonable data-protection grounds; if we cannot resolve the objection, we will [terminate the affected Service / find an alternative]. [COUNSEL REVIEW: confirm the objection mechanism and termination fallback.]

## 5. Security measures (annex)

• - Encryption in transit: TLS 1.2+ for all data in transit.
• - Encryption at rest: [COUNSEL REVIEW: confirm at-rest encryption for the database and for call recordings.]
• - Access control: role-based access; per-organization data isolation; least privilege.
• - Authentication: salted password hashing; session tokens stored server-side with expiry; service credentials held only by the platform.
• - Audit logging: append-only log of sensitive operations (org/user changes, consent events, call attempts, exports) with tamper-evidence (no code path can modify or delete entries).
• - Vulnerability management and incident response: [COUNSEL REVIEW: describe the actual patching cadence and incident-response SLA (e.g., 72-hour breach notification).]

## 6. Data subject requests

The Controller is the primary point of contact. The Processor will assist with technical and legal steps (access, deletion, correction) within the deadlines in applicable law, at the Controller's direction. If a data subject contacts the Processor directly, the Processor will forward the request to the Controller and not respond independently except as required by law.

## 7. Security incident / breach

The Processor will notify the Controller without undue delay (and in any event within 72 hours) after becoming aware of a personal data breach, with the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed. The Processor will cooperate with the Controller's investigation and any regulator notification. [COUNSEL REVIEW: confirm the 72-hour SLA matches the actual incident-response process.]

## 8. Audit rights

The Controller may audit the Processor's compliance, or rely on the Processor's certifications and the append-only audit log. Audits will be conducted during business hours, on reasonable notice, and in a manner that does not unreasonably interfere with the Service. [COUNSEL REVIEW: confirm the audit mechanism (on-site vs. remote vs. SOC 2 report reliance).]

## 9. Data returned or deleted at termination

At the Controller's election, the Processor will, within [30] days of termination: (a) return Customer Data in a standard machine-readable format, and/or (b) securely delete Customer Data and confirm deletion. The Processor will retain a minimal subset only to the extent required by law (e.g., tax/financial records), and will isolate and protect it. [COUNSEL REVIEW: confirm the export format and the 30-day window.]

## 10. Liability

Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service. Nothing in this DPA limits the Processor's indemnity obligation in Section 9 of the Terms or its confidentiality obligations. [COUNSEL REVIEW: confirm the interplay with the ToS liability cap.]

## 11. International transfers

Customer Data is processed in the United States. If the Processor or a sub-processor transfers Customer Data to a country outside the US, the parties will implement appropriate safeguards (e.g., Standard Contractual Clauses) and the Processor will update this DPA. [COUNSEL REVIEW: confirm US-only processing and subprocessor locations.]

## 12. Governing law

This DPA is governed by the same law and forum as the Terms of Service.

---

[COUNSEL REVIEW — open items: §3 controller/processor split and the "documented instructions" language; §4 named sub-processors + objection mechanism; §5 at-rest encryption, incident-response SLA; §8 audit mechanism; §9 export format + deletion window; §10 interplay with ToS liability cap; §11 subprocessor locations.]