ActiveCalls Data Processing Terms

Preamble

This Data Processing Agreement (the “DPA”) forms part of the ActiveCalls Acceptable Use Policy and Service Agreement (the “Agreement”) between Intergo Telecom Ltd, a limited liability company incorporated in the Republic of Cyprus with registration number HE 352115, having its registered office at Tepeleniou 17, Office 102-103, 8010 Paphos, Cyprus (“Intergo Telecom” or the “Processor”), and the customer that has accepted the Agreement (the “Customer” or the “Controller”).

This DPA is accepted by the Customer when it accepts the Agreement at sign-up and requires no separate signature. It reflects the parties’ agreement on the processing of Customer Personal Data in accordance with Article 28 of the GDPR and, where applicable, the UK GDPR.

1. Definitions

1.1 Capitalised terms not defined in this DPA have the meaning given in the Agreement. In this DPA:

2. Roles of the Parties and Scope

2.1 With respect to Customer Personal Data, the Customer is the controller and Intergo Telecom is a processor. Where the Customer itself acts as a processor on behalf of a third-party controller, Intergo Telecom acts as the Customer’s sub-processor and the Customer warrants that its instructions have been authorised by the relevant controller.

2.2 Intergo Telecom acts as an independent controller, and not as a processor, when it processes: (a) Account, billing and contact data of the Customer and its End Users; and (b) call detail records and traffic data to the extent necessary for billing, interconnection settlement, fraud prevention, network security and compliance with its legal and regulatory obligations as a provider of electronic communications services, including retention and lawful-access obligations. Such processing is described in the ActiveCalls Privacy Policy and is not governed by this DPA.

2.3 Telecommunications carriers, interconnection partners and other operators that originate, transit or terminate calls in the public telephone network act as providers of electronic communications services in their own right and are not Sub-processors of Intergo Telecom. Their processing of traffic data is governed by the telecommunications and data protection laws applicable to them.

2.4 The subject matter, duration, nature and purpose of the processing, the types of Customer Personal Data and the categories of Data Subjects are set out in Annex 1.

3. Customer Obligations

3.1 The Customer is responsible for the lawfulness of the processing of Customer Personal Data and shall ensure that:

4. Processing on Documented Instructions

4.1 Intergo Telecom shall process Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law to which Intergo Telecom is subject, in which case Intergo Telecom shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.2 The Customer’s documented instructions consist of the Agreement, this DPA, and the configuration of the Services by the Customer, including the activation of features, routing rules, recording and retention settings and enabled integrations. Additional instructions require the written agreement of the parties.

4.3 Intergo Telecom shall immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend execution of that instruction until it is confirmed or modified by the Customer.

4.4 Intergo Telecom shall not use Customer Personal Data, including call recordings and transcripts, to train or improve artificial intelligence models for the benefit of other customers or third parties.

5. Confidentiality

5.1 Intergo Telecom shall ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and have access to Customer Personal Data only to the extent necessary to perform the Services.

6. Security of Processing

6.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to Data Subjects, Intergo Telecom shall implement and maintain the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR.

6.2 Intergo Telecom may update the measures in Annex 2 from time to time, provided that the updates do not result in a material reduction of the overall level of security.

6.3 The Customer is responsible for the security measures within its control, including the protection of Account credentials, End User access management, device security and the configuration of the Services.

7. Sub-processors

7.1 The Customer grants Intergo Telecom a general authorisation to engage Sub-processors. The Sub-processors engaged at the effective date of this DPA are listed in Annex 3.

7.2 Intergo Telecom shall inform the Customer of any intended addition or replacement of a Sub-processor at least thirty (30) days in advance, by updating the list and notifying Customers who have subscribed to updates. The Customer may object to the change on reasonable grounds relating to data protection within that period. The parties shall discuss the objection in good faith; if no resolution is reached, the Customer may terminate the affected Services without penalty and receive a pro-rata refund of prepaid fees.

7.3 Intergo Telecom shall impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as those in this DPA, and shall remain fully liable to the Customer for the performance of the Sub-processor’s obligations.

8. International Transfers

8.1 Intergo Telecom may transfer Customer Personal Data outside the European Economic Area only in compliance with Chapter V GDPR, including to countries subject to an adequacy decision or on the basis of the SCCs.

8.2 To the extent the Customer transfers Customer Personal Data to Intergo Telecom from outside the EEA, or Intergo Telecom transfers Customer Personal Data to a Sub-processor in a third country not covered by an adequacy decision, the SCCs are incorporated by reference as follows: Module Two (controller to processor) or Module Three (processor to processor), as applicable; the optional docking clause (Clause 7) applies; Option 2 (general written authorisation) of Clause 9(a) applies with the notice period set out in clause 7.2; the optional language in Clause 11 does not apply; Clauses 17 and 18 are governed by and subject to the laws and courts of the Republic of Cyprus; and Annexes I to III of the SCCs are completed with the information in Annexes 1 to 3 of this DPA.

8.3 For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference, with Tables 1 to 3 completed by the information in this DPA and its Annexes, and either party may end the UK Addendum as set out in its Section 19. For transfers subject to Swiss law, references to the GDPR in the SCCs are read as references to the Swiss Federal Act on Data Protection and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

8.4 Intergo Telecom has carried out, and shall maintain, transfer impact assessments for transfers to Sub-processors in third countries and shall make a summary available to the Customer on request.

9. Assistance with Data Subject Rights

9.1 Taking into account the nature of the processing, Intergo Telecom shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests from Data Subjects to exercise their rights under Chapter III GDPR. The Services include self-service tools allowing the Customer to access, export and delete recordings, transcripts and other Customer Personal Data.

9.2 If Intergo Telecom receives a request directly from a Data Subject relating to Customer Personal Data, it shall promptly forward the request to the Customer and shall not respond to it except to direct the Data Subject to the Customer, unless otherwise required by law.

10. Personal Data Breaches

10.1 Intergo Telecom shall notify the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

10.2 The notification shall, to the extent then known, describe the nature of the breach, including the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and mitigate its effects, and a contact point for further information. Where information is not available at the time of the initial notification, it shall be provided in phases without undue further delay.

10.3 Intergo Telecom shall take reasonable steps to contain, investigate and mitigate the Personal Data Breach and shall cooperate with the Customer in meeting its obligations under Articles 33 and 34 GDPR. A notification by Intergo Telecom is not an acknowledgement of fault or liability.

10.4 This clause is without prejudice to any obligation of Intergo Telecom, as a provider of electronic communications services, to notify personal data breaches or security incidents to the competent authorities under the ePrivacy rules or Directive (EU) 2022/2555 (NIS2) and its national implementing law.

11. Data Protection Impact Assessments

11.1 Taking into account the nature of the processing and the information available to it, Intergo Telecom shall provide reasonable assistance to the Customer with any data protection impact assessment and prior consultation with a Supervisory Authority that the Customer is required to carry out in relation to the Services, in particular where the Customer uses call recording, employee monitoring or AI-assisted analytics features.

12. Audits and Information

12.1 Intergo Telecom shall make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR, including, on request, a summary of its security measures and any relevant certifications.

12.2 Where the information under clause 12.1 is not sufficient to demonstrate compliance, or where required by a Supervisory Authority, the Customer may carry out an audit, including an inspection, either itself or through an independent auditor bound by confidentiality, no more than once in any twelve (12) month period (except following a Personal Data Breach or at the request of a Supervisory Authority), on at least thirty (30) days’ written notice, during normal business hours and without unreasonably disrupting Intergo Telecom’s operations. Each party bears its own costs, unless the audit reveals a material breach of this DPA by Intergo Telecom.

12.3 Audits shall not extend to the data of other customers, to information subject to legal privilege, or to information whose disclosure would compromise the security of Intergo Telecom’s network or systems.

13. Return and Deletion of Customer Personal Data

13.1 Upon termination of the Agreement, the Customer may export Customer Personal Data using the tools available in the Services for thirty (30) days. After that period, Intergo Telecom shall delete Customer Personal Data, including recordings and transcripts, within ninety (90) days, unless Union or Member State law requires its storage.

13.2 Customer Personal Data held in backups shall be deleted in accordance with Intergo Telecom’s backup rotation cycle and shall remain protected by this DPA until deletion. Intergo Telecom shall confirm deletion in writing on request.

14. Requests from Public Authorities

14.1 If Intergo Telecom receives a request from a public authority, including a law enforcement authority, for access to Customer Personal Data, it shall, unless prohibited by law: (a) promptly notify the Customer; (b) require the authority to direct the request to the Customer where appropriate; (c) assess the legality of the request and challenge it where there are reasonable grounds to consider it unlawful; and (d) disclose only the minimum data necessary to comply with the request. Requests received in Intergo Telecom’s capacity as a provider of electronic communications services and relating to data it processes as a controller are handled in accordance with Applicable Law.

15. Liability

15.1 Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement, except to the extent such limitations are not permitted by Applicable Data Protection Law or by the SCCs with respect to Data Subjects.

16. Term, Precedence and Changes

16.1 This DPA remains in force for as long as Intergo Telecom processes Customer Personal Data on behalf of the Customer.

16.2 In the event of a conflict, the SCCs (and the UK Addendum, where applicable) prevail over this DPA, and this DPA prevails over the Agreement with respect to the processing of Customer Personal Data.

16.3 Intergo Telecom may update this DPA where required by changes in Applicable Data Protection Law, a decision of a Supervisory Authority or court, or the adoption of new standard contractual clauses, on notice to the Customer. Any other change that materially reduces the protection of Customer Personal Data requires the Customer’s agreement.

17. Governing Law

17.1 This DPA is governed by the laws of the Republic of Cyprus, and the courts of Cyprus have exclusive jurisdiction, without prejudice to the governing-law and jurisdiction provisions of the SCCs.

18. Contact

18.1 Intergo Telecom’s Data Protection Officer can be contacted at dpo@intergotelecom.com or at Tepeleniou 17, Office 102-103, 8010 Paphos, Cyprus.

Annex 1 — Description of the Processing

Annex 2 — Technical and Organisational Measures

• Encryption: encryption of signalling and media in transit (TLS/SRTP for WebRTC and supported SIP endpoints) and encryption at rest of recordings, transcripts and databases.
• Access control: role-based access in the Services; least-privilege access for Intergo Telecom personnel; multi-factor authentication for administrative access; access logging and periodic access reviews.
• Network security: firewalls and session border controllers, intrusion detection, DDoS mitigation, segregation of production environments, and fraud-monitoring controls for anomalous traffic patterns.
• Availability and resilience: redundant infrastructure, regular backups, tested restoration procedures and business continuity and disaster recovery plans.
• Vulnerability management: regular patching, vulnerability scanning and annual penetration testing.
• Incident management: documented incident response procedures, including breach notification to customers and to competent authorities under GDPR, ePrivacy and NIS2 rules.
• Personnel: confidentiality undertakings, background checks where permitted by law, and regular data protection and security training.
• Supplier management: due diligence and contractual data protection obligations for Sub-processors, and periodic reviews.
• Data minimisation and deletion: configurable retention for recordings and transcripts, secure deletion procedures and deletion at the end of the Agreement in accordance with clause 13.
• Accountability: appointed Data Protection Officer, records of processing activities, and data protection by design and by default in product development.

Annex 3 – Sub-processors

This Annex lists the Sub-processors we engage to process Customer Personal Data on your behalf. Any intended addition or replacement is notified in accordance with clause 7.2 of the DPA.

Part A – Sub-processors

Part B – Providers that are not Sub-processors