Data Processing Agreement

Parties

This Data Processing Agreement (“DPA”) is entered into between:

• Ringotel Communications Limited, a company registered in Ireland, registered address 74 South Mall, Cork, Ireland (the “Processor”); and
• the Customer identified in the Reseller / Service Agreement (the “Controller”).

This DPA forms part of the Reseller / Service Agreement between the parties (the “Agreement”) and governs the processing of personal data by the Processor on behalf of the Controller. It is intended to satisfy the requirements of Article 28(3) GDPR. In case of conflict between this DPA and the Agreement regarding the processing of personal data, this DPA prevails.

1Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “sub-processor”, “data subject”, “supervisory authority” and “personal data breach” have the meanings given in the General Data Protection Regulation (EU) 2016/679 (“GDPR”). “Applicable Data Protection Law” means the GDPR and other Union or Member State data protection provisions. “Union or Member State law” means Union or Member State law to which the Processor is subject.

2Roles of the Parties

2.1The Controller determines the purposes and means of processing the personal data of its end users (subscribers) and administrators. The Processor processes that personal data only on behalf of, and on the documented instructions of, the Controller, in order to provide the Ringotel platform and related services described in the Agreement.

2.2Where the Controller acts as a processor on behalf of a third-party controller (for example, a business customer of the Controller), the Controller warrants that its instructions, including the engagement of the Processor, have been authorised by that third-party controller. In that case the Processor acts as the Controller’s sub-processor, and the Controller remains the Processor’s sole point of contact and passes on any instructions, notices and requests to and from that third-party controller.

2.3Personal data that the Processor processes as a controller for its own purposes (such as the Controller’s account, contract and billing data, and the Processor’s own business records) is outside the scope of this DPA and is governed by the Processor’s privacy notice.

3Scope and Instructions

3.1The Processor processes personal data only on the Controller’s documented instructions, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law; in that case the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.2The Controller’s documented instructions consist of this DPA, the Agreement, the Controller’s configuration and use of the service’s features (including enabling call recording, transcription, AI features, regions and integrations), and any further instructions agreed in writing. Enabling an optional feature is an instruction to process personal data through the sub-processors listed for that feature in Appendix 2, in the locations stated there. Additional instructions outside the scope of the Agreement require prior written agreement, including on any additional fees.

3.3The subject matter, duration, nature and purpose of processing, the types of personal data, and the categories of data subjects are set out in Appendix 1.

3.4The Processor immediately informs the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law. The Processor may suspend the execution of that instruction until it is confirmed or amended by the Controller.

4Confidentiality

The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5Security of Processing

5.1The Processor takes all measures required pursuant to Article 32 GDPR. Those measures are described in Appendix 3.

5.2The Processor may update the measures, provided that they continue to meet the requirements of Article 32 GDPR.

6Sub-processing

6.1The Controller gives the Processor general written authorisation to engage sub-processors. The sub-processors authorised at the effective date of this DPA are listed in Appendix 2 and published at ringotel.com/sub-processors.

6.2The Processor informs the Controller of any intended changes concerning the addition or replacement of sub-processors, thereby giving the Controller the opportunity to object to such changes, by updating the list at ringotel.com/sub-processors and notifying the Controller by email to the Controller’s designated contact or through a notification subscription offered on that page. The Processor does not engage the new sub-processor before the objection period in Section 6.3 has ended. The Controller is responsible for keeping its designated contact current.

6.3The Controller may object to the change on reasonable data protection grounds by written notice stating those grounds within fourteen (14) days of the notice. If the Controller objects, the Processor either: (a) does not use the new sub-processor for the Controller’s personal data; or (b) where the sub-processor is engaged only for an optional feature, disables that feature for the Controller. If the Processor does neither, the Controller may terminate the affected service by written notice. If the Controller does not object within the period above, the change is deemed authorised.

6.4The Processor respects the conditions referred to in Article 28(2) and (4) GDPR for engaging a sub-processor. In particular, it imposes on each sub-processor, by way of a contract or other legal act under Union or Member State law, the same data protection obligations as set out in this DPA as referred to in Article 28(3) GDPR, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR. Where a sub-processor fails to fulfil its data protection obligations, the Processor remains fully liable to the Controller for the performance of that sub-processor’s obligations.

7International Transfers

7.1The Controller’s selection of a hosting region is an instruction concerning the hosting of its core platform data (accounts, call detail records, recordings, voicemail, messages and files). This does not apply to processing by sub-processors engaged for optional features (such as transcription and AI features) or for support, as listed in Appendix 2, which may take place outside the selected region. This Section 7.1 also does not apply to remote access by the Processor’s personnel as described in Appendix 3, or to processing or disclosure required by Union or Member State law.

7.2The Processor transfers personal data to a third country or an international organisation only in accordance with Section 3.1 and Chapter V GDPR. The transfer mechanism used for each sub-processor is stated in Appendix 2.

7.3Where the Controller selects a hosting region outside the EEA, the Controller instructs the Processor to transfer the personal data to that region.

8Data Subject Rights

8.1Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III GDPR. The Controller uses the self-service functionality of the service to respond to requests where that functionality permits.

8.2If the Processor receives a request directly from a data subject, it does not respond to the request itself, other than to direct the data subject to the Controller, and forwards the request to the Controller.

9Personal Data Breach

9.1The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s personal data. A security incident that does not lead to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data is not a personal data breach within Article 4(12) GDPR.

9.2Notification of a personal data breach is not an acknowledgement of fault or liability by the Processor.

9.3The notification includes, to the extent available to the Processor, the information referred to in Article 33(3) GDPR, which may be provided in phases.

10Assistance to the Controller

Taking into account the nature of processing and the information available to the Processor, the Processor assists the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR, in the first instance by making available Appendix 3, its documentation and any assurance reports it holds.

11Return and Deletion of Data

11.1At the choice of the Controller, the Processor deletes or returns all the personal data to the Controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data. The Controller makes its choice by written notice within fourteen (14) days after the end of the services; if it does not, the Processor deletes the personal data.

11.2Deletion is performed by cryptographic erasure and provider deletion APIs, as described in Appendix 3. Existing copies in backups of the Processor and its sub-processors are deleted in the ordinary course of their backup cycles.

12Audit

12.1The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, as set out in this Section 12.

12.2The Processor demonstrates compliance in the first instance by providing: (a) the description of its technical and organisational measures in Appendix 3; (b) responses to the Controller’s reasonable written security questionnaires, no more than once per year; and (c) if and when the Processor holds them, its independent third-party assurance reports or certifications (for example SOC 2 Type II or ISO/IEC 27001), subject to confidentiality. The Controller agrees to rely on this information in the first instance.

12.3Where the information under Section 12.2 is not sufficient to demonstrate compliance or where required by a supervisory authority, the Controller (or an independent auditor mandated by it and bound by confidentiality) may carry out an audit, including an inspection. The Controller gives at least thirty (30) days’ written notice and a proposed scope; audits take place no more than once in any twelve (12) month period (except where required by a supervisory authority), during normal business hours, and without disrupting the Processor’s operations or compromising the security or confidentiality of other customers’ data.

12.4The Controller bears its own costs of any audit and reimburses the Processor’s reasonable costs, unless the audit reveals a material breach of this DPA by the Processor. The Controller provides the Processor with a copy of any audit report, which is the Processor’s confidential information.

13Controller Obligations

13.1The Controller is responsible for the lawfulness of the processing and of its instructions, including having an appropriate legal basis, providing the required information to data subjects, and obtaining any consents required under Applicable Data Protection Law (including for call recording, transcription, AI features and the confidentiality of communications). Where Section 2.2 applies, the Controller ensures that the third-party controller complies with this Section 13.1.

13.2The Controller is responsible for configuring the service appropriately for its use case, including hosting region, retention settings, recording and AI features, and the integrations it enables. Third-party services that the Controller connects to its account (customer-enabled integrations) are engaged by the Controller and are not sub-processors of the Processor.

13.3The service is not designed to process special categories of personal data (Article 9 GDPR) as structured data. The Controller acknowledges that communications content (calls, recordings, voicemail, messages and files) may incidentally contain such data, and the Controller is responsible for ensuring that any such processing has a legal basis.

13.4The Controller provides the Processor with the information and cooperation reasonably required for the Processor to comply with its obligations under Applicable Data Protection Law.

13.5The Controller indemnifies the Processor against third-party claims arising from the Controller’s breach of this Section 13 or from processing carried out in accordance with the Controller’s instructions, except to the extent that a claim results from the Processor’s breach of this DPA or of the GDPR, subject to the limitations of liability in the Agreement.

14Liability and Governing Law

14.1Liability of each party under this DPA is subject to the limitations of liability set out in the Agreement. Nothing in this DPA limits either party’s liability to data subjects under Article 82 GDPR or its exposure to fines under Article 83 GDPR.

14.2This DPA is governed by the laws of Ireland, and the parties submit to the jurisdiction of the courts set out in the Agreement or, if none, the courts of Ireland.

15Term

This DPA takes effect on the effective date of the Agreement and remains in force for as long as the Processor processes personal data on behalf of the Controller. Sections 11, 12 and 14 survive termination to the extent necessary.

Appendix 1Details of Processing

Appendix 2Sub-processors

This list matches the sub-processors published by the Processor at ringotel.com/sub-processors. Changes are notified as set out in Section 6. Sub-processors marked as an optional feature are engaged only where the Controller enables that feature. The identity of the sub-processors engaged by the Processor’s sub-processors is available in the lists those sub-processors publish, which are linked from ringotel.com/sub-processors.

Not sub-processors under this DPA. Payment processing for the Controller’s own billing (Stripe Payments Europe, Limited) is carried out for the Processor’s own purposes as a controller and is covered by the Processor’s privacy notice (Section 2.3). Third-party services that the Controller connects to its own account are engaged by the Controller (Section 13.2); the Processor only transmits data to or from them via API according to the Controller’s configuration.

Appendix 3Technical and Organisational Measures