Scope and roles
This DPA is entered into between Telephoned.pro (“Processor”, “we”, “us”, or “our”) and the customer identified in the applicable order, proposal, service agreement, or other written agreement (“Customer” or “Controller”).
For Personal Data processed by Telephoned.pro on the Customer's behalf to provide the contracted AI automation services, the Customer determines the purposes and means of processing and acts as Controller, while Telephoned.pro acts as Processor, to the extent required by applicable data-protection law.
Telephoned.pro may separately act as an independent controller for information it processes for its own business purposes, such as account administration, billing, security, legal compliance, and customer relationship management. Such processing is governed by the Telephoned.pro Privacy Policy and is outside the scope of this DPA.
Subject matter, duration and processing details
The subject matter of processing is the provision of AI-powered business automation services, which may include AI receptionist services, phone and messaging workflows, lead capture and qualification, appointment scheduling, CRM automation, follow-up workflows, integrations, AI agents, and other custom automations agreed with the Customer.
Processing continues for the duration of the applicable service relationship and for any limited period reasonably necessary to complete deletion, return, backup expiry, or legally required retention after termination.
Categories of Personal Data
- Names, contact details, company information, identifiers, and communication information;
- Lead, customer, appointment, CRM, calendar, and interaction information;
- Call recordings, transcripts, summaries, messages, notes, and other communications where enabled;
- Information contained in Customer-provided knowledge bases, instructions, prompts, or workflow inputs;
- Technical and usage information where included in the Customer's configured workflows;
- Other Personal Data the Customer instructs Telephoned.pro to process through the Service.
Categories of Data Subjects
- Prospective customers and leads;
- Existing customers and clients;
- Callers and other individuals communicating with the Customer;
- Employees, contractors, suppliers, or other business contacts where applicable;
- Other individuals whose Personal Data the Customer lawfully submits to the Service.
Documented instructions
Telephoned.pro shall process Personal Data only on documented instructions from the Customer, including instructions contained in the applicable service agreement, configuration, workflow, integration settings, written requests, or other documented directions.
The Customer is responsible for ensuring that its instructions are lawful and do not require Telephoned.pro to violate applicable law. If Telephoned.pro reasonably believes an instruction infringes applicable data-protection law, it may notify the Customer and suspend the affected processing until the issue is resolved.
Unless required by law, Telephoned.pro will not use Customer Personal Data for purposes incompatible with the Customer's documented instructions.
Customer responsibilities as Controller
The Customer is responsible for determining the lawful purposes and means of processing and for complying with obligations applicable to a Controller.
The Customer is responsible for:
- Identifying and documenting an appropriate legal basis for processing;
- Providing legally required privacy notices and disclosures;
- Obtaining consent where required;
- Providing legally required call-recording notices and obtaining required permissions;
- Ensuring marketing calls, SMS, emails, and automated outreach comply with applicable laws;
- Ensuring that Personal Data supplied to Telephoned.pro is collected and disclosed lawfully;
- Configuring appropriate retention periods and deletion instructions;
- Ensuring instructions supplied to Telephoned.pro are lawful and sufficiently specific;
- Responding to data-subject requests and supervisory authorities, with Telephoned.pro providing the assistance described in this DPA.
Telephoned.pro's obligations
Telephoned.pro shall:
- Process Personal Data only on documented instructions, except where processing is required by applicable law;
- Ensure persons authorised to process Personal Data are subject to confidentiality obligations;
- Implement appropriate technical and organizational measures designed to protect Personal Data;
- Maintain appropriate records and documentation concerning processing where required by law;
- Assist the Customer with applicable GDPR obligations as described in this DPA;
- Notify the Customer of a Personal Data breach without undue delay after becoming aware of it;
- Inform the Customer if, in Telephoned.pro's reasonable opinion, an instruction infringes applicable data-protection law;
- Use subprocessors only as permitted under Section 7.
Security and technical measures
Telephoned.pro will maintain technical and organizational measures appropriate to the risks presented by the processing, taking into account the nature of the Personal Data and the state of technology.
Measures may include access controls, least-privilege permissions, authentication, encryption in transit, secure infrastructure, logging and monitoring, vulnerability management, backups, incident-response procedures, personnel confidentiality, and supplier security reviews.
The Customer acknowledges that no system connected to the internet can be guaranteed completely secure. The Customer is responsible for security of its own accounts, credentials, devices, systems, integrations, and instructions.
Subprocessors
The Customer provides general authorisation for Telephoned.pro to engage subprocessors reasonably necessary to provide the Service, including providers of cloud hosting, databases, telephony, voice, SMS, email, AI models, analytics, monitoring, security, CRM, calendar, payment, and other infrastructure services.
Telephoned.pro will impose data-protection obligations on subprocessors appropriate to the processing and required by applicable law. Telephoned.pro remains responsible for the performance of its subprocessors to the extent required by applicable law.
Telephoned.pro may add or replace subprocessors where reasonably necessary to operate or improve the Service. Where GDPR requires notification or an objection mechanism, Telephoned.pro will provide appropriate notice and a meaningful opportunity to object on reasonable data-protection grounds.
If the Customer objects to a new subprocessor on reasonable data-protection grounds and the parties cannot resolve the objection, either party may terminate the affected service on written notice, subject to the applicable commercial agreement.
International transfers
Telephoned.pro and its subprocessors may process Personal Data in countries outside the European Economic Area.
Where GDPR Chapter V applies, transfers will be made using a lawful transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, or another legally recognized safeguard, as applicable.
The Customer authorises Telephoned.pro to make international transfers necessary to provide the Service, subject to the safeguards required by applicable law.
Data subject rights
Taking into account the nature of processing, Telephoned.pro will provide reasonable assistance to the Customer in responding to requests from data subjects to exercise rights under applicable data-protection law.
Where a data subject contacts Telephoned.pro directly regarding Personal Data processed on the Customer's behalf, Telephoned.pro may direct the individual to the Customer unless applicable law requires Telephoned.pro to respond directly. Telephoned.pro may assist the Customer with access, correction, deletion, restriction, portability, objection, or other requests where reasonably necessary.
The Customer is responsible for verifying the identity and authority of the requester and determining whether a request must be fulfilled.
Personal Data breaches
Telephoned.pro will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting Customer Personal Data and will provide information reasonably available to assist the Customer in meeting applicable notification obligations.
Where reasonably necessary and available, the notification may include the nature of the incident, categories of affected data, likely consequences, mitigation measures, and other information reasonably available to Telephoned.pro.
The Customer remains responsible for determining whether notification to a supervisory authority or affected individuals is required and for making such notifications unless the parties expressly agree otherwise.
Assistance, DPIAs and regulatory cooperation
Taking into account the nature of processing and information available to Telephoned.pro, we will provide reasonable assistance with:
- Security obligations applicable to the processing;
- Data protection impact assessments where reasonably necessary;
- Prior consultation with a supervisory authority where required;
- Responses to reasonable requests from competent data-protection authorities relating to the processing.
Assistance that requires substantial custom work, engineering, legal analysis, or extraordinary resources may be subject to reasonable fees where permitted by applicable law and agreed with the Customer in advance.
Audits and compliance information
Telephoned.pro will make available information reasonably necessary to demonstrate compliance with applicable processor obligations.
Where required by GDPR, the Customer may conduct audits or inspections relating to the processing, subject to reasonable prior written notice, confidentiality obligations, security requirements, business-continuity considerations, and reasonable limits on frequency and scope.
Audits must not unreasonably disrupt Telephoned.pro's operations or expose the data, systems, security controls, confidential information, or Personal Data of other customers.
Where available, Telephoned.pro may satisfy reasonable audit requests through current security documentation, questionnaires, certifications, independent reports, or other appropriate evidence before an on-site audit is considered.
Return and deletion of Personal Data
At the end of the applicable services, the Customer may request the return or deletion of Customer Personal Data, unless applicable law requires retention.
Telephoned.pro will delete or return Personal Data within a reasonable period appropriate to the relevant system and service configuration. Backup copies may remain until overwritten through ordinary backup lifecycle procedures, after which they will no longer be available for active processing except where required by law or legitimate security purposes.
The Customer is responsible for exporting any data it needs before termination where export functionality is available or agreed.
Confidentiality
Telephoned.pro will ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty of confidentiality.
Confidentiality obligations survive termination for as long as the information remains confidential under applicable law or the parties' agreement.
Liability
The parties' liability under this DPA is subject to the liability provisions and limitations in the applicable commercial agreement and Terms & Conditions, except to the extent such limitation is prohibited by applicable law.
Nothing in this DPA excludes or limits liability that cannot legally be excluded or limited.
Nothing in this DPA transfers the Customer's statutory responsibilities as Controller to Telephoned.pro or makes Telephoned.pro responsible for the lawfulness of the Customer's processing instructions, legal bases, notices, consents, marketing practices, or business purposes.
Term and termination
This DPA begins when the Customer first uses the applicable Service involving processing of Personal Data and continues for the duration of that processing relationship.
Termination of the applicable Service agreement terminates this DPA, subject to provisions that by their nature survive termination, including confidentiality, deletion, liability, and legally required retention.
Order of precedence
If there is a conflict between this DPA and the applicable Terms & Conditions or service agreement regarding the processing of Personal Data, this DPA controls to the extent necessary to resolve that conflict.
For commercial matters unrelated to data processing, the applicable service agreement and Terms & Conditions remain controlling.
Governing law
This DPA is governed by and construed in accordance with the laws of the Czech Republic, without regard to its conflict-of-law principles, except to the extent mandatory data-protection laws require otherwise.
Any dispute concerning this DPA will be handled in accordance with the dispute-resolution provisions of the applicable service agreement or Terms & Conditions, subject to mandatory law.
Contact and execution
Questions regarding this DPA should be directed to:
Telephoned.pro
our contact form
This DPA may be accepted electronically, including by signing an order, service agreement, or DPA, or by another legally valid electronic acceptance mechanism agreed by the parties.