Data Processing Agreement

Draft for legal review. This DPA is written to meet the Georgian Law on Personal Data Protection (processor contract rules) and Article 28 of the GDPR. It has not been reviewed by a lawyer and is not in force.

1. Purpose and parties

This Data Processing Agreement (DPA) is part of the agreement between KCall LLC (Georgian company ID 404509983, [registered address · to be confirmed], "KCall" or "processor") and the business that uses iCall ("Customer" or "controller"). It applies to personal data that KCall processes on the Customer's behalf through iCall. For the data KCall handles as a controller itself, see the Privacy Policy.

2. Definitions

"Personal data", "processing", "controller", "processor" and "data subject" have the meaning given in the Georgian Law on Personal Data Protection and, where it applies, the GDPR ("data protection law"). "Subprocessor" means a third party engaged by KCall to process personal data for the Customer. "Incident" means a breach of security that leads to the accidental or unlawful destruction, loss, change, disclosure of or access to personal data.

3. Roles and details of processing

The Customer is the controller and KCall is the processor. The subject, nature, purpose, duration, data types and data subjects are set out in Annex 1. KCall processes the data for the term of the agreement and then as section 11 says.

4. Instructions

• KCall processes personal data only on the Customer's documented instructions. The agreement, the order form, the settings the Customer configures in the workspace and its use of the service are those instructions.
• KCall does not process the data for its own purposes, does not sell it, and does not use it to train AI models. Any use to improve the service needs the Customer's separate agreement [no training or improvement use without opt-in · to be confirmed].
• KCall tells the Customer without delay if it believes an instruction breaks data protection law, and may pause that instruction until it is clarified.
• The Customer must give instructions that are lawful, and is responsible for having a legal basis for the processing and for the notices and consents described in the Call recording and AI disclosure policy.

5. Confidentiality

KCall makes sure that the people who process the data are bound to confidentiality, are given access only as they need it for the service, and are trained on handling it [confirm staff confidentiality terms and training · to be confirmed].

6. Security

KCall keeps technical and organisational measures that fit the risk, including those in Annex 3 and the security overview. KCall may change them if the level of protection is not reduced.

7. Subprocessors

• The Customer gives KCall its prior written consent to use the subprocessors in Annex 2 for the purposes and in the locations listed.
• KCall will give the Customer at least [30 days · to be confirmed] days notice by email and in the workspace before it adds or replaces a subprocessor.
• The Customer may object in writing within [14 days · to be confirmed] days, giving reasons related to data protection. The parties will then try in good faith to find a solution. If there is none, the Customer may end the affected service and receive a refund of prepaid fees for the period after the end.
• KCall imposes on each subprocessor obligations that give at least the same level of protection as this DPA and stays fully responsible to the Customer for them.
• Georgian law requires the controller's prior consent to subprocessing. Counsel must confirm that consent by notice and the right to object, without an express reply, is enough [confirm with counsel · to be confirmed].

8. International transfers

Customer data is stored and processed by default in the European Union (Frankfurt, Germany and Helsinki, Finland). Some subprocessors may process data in other countries, as Annex 2 shows. KCall transfers personal data out of Georgia, and onward, only where the data protection law allows: to a country on the adequacy list of the competent authority, or with safeguards such as approved contract terms [choose and document the mechanism per provider · to be confirmed]. Where the GDPR applies to a Customer, the parties will add the EU standard contractual clauses where needed [confirm if EU customers are in scope · to be confirmed].

9. Help for the Customer

• Data subject requests. KCall passes any request it receives from a caller or contact to the Customer within [2 business days · to be confirmed] and does not answer it itself unless told to. KCall gives the Customer the tools and help it reasonably needs to answer requests within the legal time, which is generally 10 working days in Georgia, within [5 business days · to be confirmed] of being asked.
• Compliance. KCall helps with security measures, incident notices, impact assessments and consultation with the authority, taking into account the nature of the processing and the information it has. Reasonable extra effort may be charged at our standard rates [confirm the assistance fee, if any · to be confirmed].
• Records. KCall keeps the records of processing activities that data protection law requires of a processor and gives them to the competent authority when it asks.

10. Incidents

KCall notifies the Customer of an incident affecting its personal data without undue delay and in any case within [24 hours · to be confirmed] of confirming it. Georgian law expects a processor to report immediately, so KCall treats a confirmed incident as urgent. The notice goes to the account owner and the security contact on file and says what is known: the nature of the incident, the data and people likely affected, the likely effects, the steps taken and a contact point. KCall keeps the Customer updated and gives further details as they are found. The Customer decides whether to notify the authority (in Georgia the State Audit Office, within 72 hours of identifying the incident) and the data subjects. See the incident notification commitment.

11. Return and deletion

When the agreement ends, KCall gives the Customer [30 days · to be confirmed] days to export its data and then deletes the personal data and existing copies, as the retention schedule says, unless the law requires it to be kept. Backups age out as stated there. KCall confirms the deletion in writing on request.

12. Information and audits

KCall gives the Customer the information needed to show that it follows this DPA, including answers to reasonable security questionnaires. The Customer, or an auditor it names who is bound by confidentiality, may audit KCall once a year, or after an incident, on [30 days · to be confirmed] days notice, during business hours, in a way that does not disturb the service or other customers. KCall may suggest an independent report or a remote audit first. The Customer pays for the audit, unless it shows a material breach [confirm audit rights · to be confirmed]. Audits do not include other customers' data.

13. Liability and order of precedence

Liability under this DPA follows the limits in the terms of service. If this DPA conflicts with the other documents about personal data, the DPA prevails.

14. Changes to this DPA

KCall will not change this DPA in a way that reduces protection without the Customer's approval. For other changes it will notify the Customer as the terms of service describe and give a chance to object.

15. Law

The law and courts in the terms of service apply, except that mandatory rules of data protection law apply as they must.

16. Annex 1: details of processing

• Item

  Subject and nature

  Description

  Running an AI voice assistant for the Customer: receiving and placing phone calls, understanding speech, replying, transferring calls, writing transcripts and summaries, storing recordings if enabled, and carrying out actions in systems the Customer connects

• Item

  Purpose

  Description

  Providing the iCall service to the Customer

• Item

  Duration

  Description

  The term of the agreement, then as in the retention schedule

• Item

  Data subjects

  Description

  The Customer's callers and the people it contacts, the Customer's staff and users

• Item

  Data types

  Description

  Voice audio, transcripts, phone numbers, names and contact details given on calls, call time, duration and outcome, the information the caller gives about their request, notes and summaries, data from systems the Customer connects (for example appointments, orders)

• Item

  Special categories

  Description

  Not collected on purpose. A caller may mention them. The Customer must not configure the assistant to collect them unless it has a lawful basis and has agreed this in writing [confirm special categories rule · to be confirmed]

• Item

  Frequency

  Description

  Continuous, while the service is used

17. Annex 2: subprocessors

The list below is our launch roster and will be confirmed before the DPA is approved [confirm the roster, contract tiers and processing regions · to be confirmed]. "Optional" means KCall uses the provider only when the Customer switches the feature on.

• Subprocessor

  Supabase (platform on AWS)

  What it does

  database, sign-in and file storage, including recordings

  Data

  all customer data

  Location

  AWS eu-central-1, Frankfurt, Germany

  Use

  core

• Subprocessor

  Hetzner Online GmbH

  What it does

  voice host: telephony runtime, live audio relay, campaign dispatcher

  Data

  live call audio and call data while a call runs, host logs

  Location

  Helsinki, Finland

  Use

  core, planned for launch

• Subprocessor

  Vercel Inc.

  What it does

  hosting of the website, workspace and control API

  Data

  requests, sign-in data, workspace content in transit

  Location

  server functions in Frankfurt, Germany, through a global network and a United States company

  Use

  core

• Subprocessor

  Google (Gemini API)

  What it does

  AI speech and language model that understands and answers calls

  Data

  live call audio, text, prompts and customer knowledge

  Location

  [confirm processing region and the paid-service data terms, no training on data · to be confirmed]

  Use

  core

• Subprocessor

  Flitt

  What it does

  payment processing and invoicing

  Data

  billing contact, company details, payment status

  Location

  Georgia [confirm · to be confirmed]

  Use

  core

• Subprocessor

  gosms.ge

  What it does

  SMS: verification codes and notifications

  Data

  phone number, message text

  Location

  Georgia [confirm · to be confirmed]

  Use

  core

• Subprocessor

  Cloudflare Turnstile or hCaptcha

  What it does

  bot check before sending a verification SMS

  Data

  technical data such as IP address

  Location

  set by the provider [choose and confirm · to be confirmed]

  Use

  planned

• Subprocessor

  Google Workspace APIs (Calendar, Sheets and others)

  What it does

  read and write the Customer's own calendar or spreadsheet

  Data

  data in the Customer's connected account

  Location

  as set by the Customer's Google account

  Use

  optional, on the Customer's connection

• Subprocessor

  Telegram

  What it does

  notifications to the Customer's staff

  Data

  message text, names

  Location

  outside the EU, various [confirm · to be confirmed]

  Use

  optional

• Subprocessor

  Viber (Rakuten Viber)

  What it does

  notifications

  Data

  message text, phone numbers

  Location

  [confirm · to be confirmed]

  Use

  optional

• Subprocessor

  WhatsApp (Meta)

  What it does

  notifications

  Data

  message text, phone numbers

  Location

  outside the EU, various [confirm · to be confirmed]

  Use

  optional

KCall operators, when the Customer chooses to hand calls to them, work under KCall's own responsibility and this DPA. They are not a separate subprocessor.

Supabase may use further subprocessors, such as Amazon Web Services, under its own terms. We will tell you before we add a new provider to this list.

18. Annex 3: security measures

The measures below are a summary. The security overview gives the status of each, and says what is planned. Items marked "planned" are not built yet.

• separation between customers by row level security and role based access, with permissions checked on every request
• recordings in private storage, reachable only through short-lived signed links, each issue audited
• an append-only audit log of sensitive actions
• support access only through a named, scoped grant that expires after at most 30 days, is audited, and that the customer can revoke (a platform administrator can also issue a grant, see the security overview)
• a second factor for platform administrators
• encryption in transit, and storage encryption by the hosting providers [confirm · to be confirmed]
• secrets kept out of code and out of test systems, and technical logs kept free of call content
• planned: limits on spend, call length and attempts, enforced by the platform
• independent review and automated tests before changes are released
• backup and restore planned, recovery targets of 4 hours and 24 hours of data, which are internal targets