Data processing agreement

Between [Your company name], ABN [ABN] (processor) and the customer (controller). Part of the Terms of service.

1. Scope

We process personal information of the customer's leads, callers and staff only to provide the service and on the customer's documented instructions (their configuration of agents, lists and integrations).

2. Our obligations

• Process only on instructions, and tell the customer if an instruction seems unlawful.
• Ensure staff with access are bound by confidentiality.
• Keep appropriate security: encryption in transit and at rest, access controls, two-step sign-in, activity logging, backups.
• Use the sub-processors listed in the Privacy Policy, and give [30] days' notice of new ones so the customer can object.
• Help the customer respond to access, correction and deletion requests (export and erase tools are in the dashboard).
• Notify the customer without undue delay, and within [72] hours, of an eligible data breach affecting their data, and help with Notifiable Data Breaches assessments.
• Delete or return the customer's data within [30] days of the end of the agreement, except where law requires keeping it.
• Provide information reasonably needed to show compliance, and allow audits on reasonable notice [once a year].

3. Customer obligations

The customer is responsible for having a lawful basis and giving collection notices for the personal information it has us process, including telling people about recording and AI use.

4. Overseas disclosure

Some sub-processors are outside Australia. We take reasonable steps (contractual terms) so they handle information consistently with the APPs (APP 8).