Version 2026-09-26-draft1

CallQA Data Processing Agreement

DRAFT, not legal advice, to be reviewed by counsel. Version: 2026-09-26-draft1. Not in force. [COUNSEL: ...] notes and [À COMPLÉTER] fields must be resolved before publication. Legal references were consulted on 2026-09-26.

This Data Processing Agreement (the "DPA") forms part of the Terms of Service between the Customer (the "Controller") and [À COMPLÉTER: CallQA legal entity] (the "Processor"). It applies when the Processor processes personal data on behalf of the Controller in providing the Service, and implements article 28 of Regulation (EU) 2016/679 (the "GDPR", https://eur-lex.europa.eu/eli/reg/2016/679/oj).

Capitalized terms not defined here have the meaning given in the GDPR or the Terms.

1. Scope and roles

1.1. The Controller determines the purposes and means of the processing of the personal data contained in Customer Data (call content, scenarios, test data), described in Annex 1. The Processor processes it only on behalf of the Controller.

1.2. The Processor acts as an independent controller, and not under this DPA, for account, billing, security, audit and abuse prevention data, as described in its Privacy Policy. This includes the use of call metadata and transcripts to detect calls to people who did not agree to them (Acceptable Use Policy, section 2). [COUNSEL: confirm that this separate controller purpose on call content is compatible with art. 28(10) and does not make CallQA a joint controller.]

1.3. If the Controller is itself a processor for its own client (for example an agency testing its client's voice agent), the Controller warrants that its client has authorized the use of the Processor, and this DPA applies to the Processor as a subprocessor.

2. Instructions (art. 28(3)(a))

2.1. The Processor processes personal data only on documented instructions of the Controller. The Terms, this DPA, the configuration chosen by the Controller in the Service (scenarios, schedules, audio option, retention settings) and its API calls are the Controller's complete instructions.

2.2. The Processor informs the Controller without delay if, in its opinion, an instruction infringes the GDPR or other data protection law, and may suspend its execution.

2.3. If Union or Member State law requires another processing, the Processor informs the Controller before processing, unless that law prohibits it.

3. Confidentiality (art. 28(3)(b))

The Processor ensures that persons authorized to process the personal data are bound by confidentiality obligations, and grants access only to the extent necessary (support, security, abuse handling, on request of the Controller).

4. Security (art. 28(3)(c) and art. 32)

The Processor implements the technical and organizational measures of Annex 2. It may update them provided the overall level of security is not reduced.

5. Subprocessors (art. 28(2) and 28(4))

5.1. The Controller gives a general written authorization for the Processor to engage the subprocessors listed in Annex 3.

5.2. The Processor informs the Controller of any intended addition or replacement of a subprocessor at least 30 days in advance, by email to the organization's admins and by updating Annex 3. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining period. [COUNSEL: 30 days is a common market practice, not a legal requirement; confirm.]

5.3. The Processor imposes on each subprocessor, by contract, data protection obligations offering at least the same level of protection as this DPA, and remains liable to the Controller for its subprocessors' performance (art. 28(4)).

6. Assistance with data subject requests (art. 28(3)(e))

6.1. The Service lets the Controller access, export and delete call content, scenarios and targets. [PRODUCT: export of a full organization and deletion of calls are not all available yet, see README.]

6.2. If a data subject contacts the Processor directly about Customer Data, the Processor forwards the request to the Controller without undue delay and does not answer it itself, unless instructed.

7. Assistance with security, breaches and impact assessments (art. 28(3)(f))

7.1. Personal data breach. The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data (GDPR art. 33(2) requires notification "without undue delay"; the 48 hour cap is a proposed contractual commitment). The notice includes the information of art. 33(3) available at that time, completed as it becomes available.

7.2. The Processor provides reasonable assistance for data protection impact assessments and prior consultations (art. 35 and 36), with the information it has about the Service.

8. Transfers outside the EEA (Chapter V GDPR)

8.1. Some subprocessors process data in the United States or give access from there (Annex 3). Such transfers rely on an adequacy decision (EU-US Data Privacy Framework, for certified recipients) or on the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj), Module 3 (processor to processor), completed by a transfer impact assessment.

8.2. Where the Controller is located outside the EEA and the Processor transfers data to it, Module 4 (processor to controller) of the same clauses applies to the extent required. [COUNSEL: most customers are in the US; check whether Module 4 must be incorporated by reference into this DPA and the corresponding annexes filled in.]

9. Audits and information (art. 28(3)(h))

9.1. The Processor makes available to the Controller the information necessary to demonstrate compliance with art. 28: this DPA, Annex 2, the list of subprocessors, and on request answers to a reasonable security questionnaire once a year.

9.2. If that information is not sufficient, the Controller may conduct an audit, at its own cost, by an independent auditor bound by confidentiality, on 30 days' notice, during business hours, at most once in any 12 month period, unless a breach or a supervisory authority requires otherwise.

10. Return and deletion (art. 28(3)(g))

10.1. During the contract, the Processor deletes Customer Data at the end of the retention periods of Annex 1, and on the Controller's request.

10.2. At the end of the contract, the Controller may export its Customer Data for 30 days. After that period the Processor deletes it, including copies, within 30 more days, except backups that are overwritten on their normal cycle (at most 30 days) and data the Processor must keep under Union or Member State law. The Processor confirms deletion in writing on request.

11. Liability and precedence

Liability under this DPA follows the limitation of liability of the Terms, to the extent permitted by the GDPR (art. 82). In case of conflict on the processing of personal data, this DPA prevails over the Terms; the Standard Contractual Clauses prevail over both where they apply.

12. Term

This DPA lasts as long as the Processor processes personal data for the Controller.

Annex 1. Description of the processing

Annex 2. Technical and organizational security measures

Measures below exist in the current code or infrastructure unless marked planned.

Annex 3. Subprocessors

Status at 2026-09-26. Legal entity names, locations and transfer mechanisms must be verified against each provider's own DPA before publication; none has been verified for this draft.

The operator also receives internal operational alerts through a push notification service. [PRODUCT: ensure alerts never contain personal data or phone numbers, otherwise list the service here.]

Version history