Data Processing Agreement (DPA)

1. Preamble & Definitions

This Data Processing Agreement ("DPA") forms an integral, legally binding addendum to the CallingCRM Terms and Conditions or Master Services Agreement ("Principal Agreement") entered into by and between:

• Data Processor: M1 ENTITIES SOLUTIONS, trading as CallingCRM, having its registered operational office at D-109/1, Ground Floor, Block D, Budh Vihar Road, Tajpur Pahari, New Delhi - 110044, Delhi, India, GSTIN: 07JAJPK1867D1ZI ("Company", "CallingCRM", "Processor"); and
• Data Controller: The business organization, legal entity, or subscriber designated in the Customer account order or subscription registration ("Customer", "Controller").

Terms such as "Personal Data", "Processing", "Data Subject", "Data Controller", "Data Processor", and "Supervisory Authority" shall have the meanings attributed to them under Applicable Data Protection Legislation, including Regulation (EU) 2016/679 ("GDPR"), the UK Data Protection Act 2018 ("UK GDPR"), the California Consumer Privacy Act ("CCPA/CPRA"), and the Digital Personal Data Protection Act, 2023 of India ("DPDP Act").

2. Roles of the Parties

3. Scope, Nature & Purpose of Processing

The scope, nature, and duration of the data processing operations performed under this DPA correspond directly to the features provisioned in the Customer's active subscription. Categories of data subjects and data types include:

• Categories of Data Subjects:Customer's authorized employees, team supervisors, sales/support agents; end-user consumers, callers, leads, prospects, and account contacts dialed or receiving calls through the platform.
• Types of Personal Data: Contact information (full names, phone numbers, email addresses, geographic location/postal code); Telecommunications metadata (Calling Line Identification, dialed numbers, timestamps, call duration, SIP response codes, DTMF keystroke inputs, SMS contents); Voice recordings and synthesized voice audio streams (where call recording is activated by Controller); System access logs (IP addresses, user agent strings, audit log timestamps).
• Special Categories / Sensitive Data: Controller is strictly prohibited from configuring CallingCRM fields to store unencrypted government national identification numbers, payment card numbers (PCI-DSS PAN/CVV), biometrics, or protected health information unless protected by explicit contractual riders.

4. Obligations & Warranties of Data Controller

The Controller represents, warrants, and covenants that:

• All Personal Data transferred to CallingCRM has been lawfully collected with valid consent, legitimate business interest, or legal contractual justification.
• It has fulfilled all statutory notice obligations toward call recipients regarding electronic call recording, AI-assisted transcription, and automated dialing prior to initiating communications.
• It will refrain from issuing processing instructions that violate applicable privacy, telecom, or national telecommunications intercept regulations.
• It maintains complete operational responsibility for scrubbing contact lists against applicable national Do Not Call registries (e.g., India TRAI NDNC, US FTC DNC, UK TPS).

5. Obligations of Data Processor

CallingCRM covenants and agrees that it shall:

• Process Customer Personal Data strictly in accordance with documented instructions from Customer, including with respect to international data transfers, unless required by mandatory statutory law.
• Ensure all personnel authorized to process Customer Personal Data have committed themselves to binding non-disclosure and confidentiality obligations.
• Not sell, retain, use, or disclose Customer Personal Data for commercial marketing purposes outside the provision of the Services.
• Implement and continually maintain state-of-the-art technical and organizational measures to safeguard against unauthorized, accidental, or unlawful access, alteration, or disclosure.

6. Technical & Organizational Security Measures (TOMs)

CallingCRM maintains robust, enterprise-grade physical, network, and software safeguards detailed in Annex B:

7. Sub-Processors & Infrastructure Providers

Customer grants general written authorization to CallingCRM to engage infrastructure hosts, telecom carriers, and SMS gateway vendors to execute the services. Current categories of approved sub-processors include:

CallingCRM shall notify Customer at least thirty (30) days in advance of onboarding any new infrastructure sub-processor. Customer may submit reasonable written objections on data protection grounds within fifteen (15) days of receipt.

8. Cross-Border International Data Transfers

Where Customer Personal Data originating from the European Economic Area (EEA), United Kingdom, or Switzerland is transferred outside these territories to regions without an adequacy finding under GDPR, the parties agree to be bound by the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor) as incorporated herein by reference.

For Indian enterprise accounts subject to the DPDP Act 2023, data processing complies with Central Government cross-border transfer directives, with call audio archives stored in domestic data center facilities upon request.

9. Data Subject Rights (DSAR) Assistance

CallingCRM shall provide technical capabilities within the platform to enable Controller to fulfill Data Subject requests (access, rectification, erasure, export, or restriction of processing). If a Data Subject contacts CallingCRM directly regarding data processed on behalf of Customer, CallingCRM will redirect the individual to Customer within three (3) business days without responding substantively, unless required by legal order.

10. Security Incident & Breach Notification

In the event of a confirmed Personal Data Breach impacting Customer Personal Data, CallingCRM shall notify Customer without undue delay, and in any event within forty-eight (48) hours of becoming aware of the confirmed breach.

The notification shall furnish: (a) description of the nature of the breach; (b) categories and approximate number of Data Subjects affected; (c) identity of the contact point for inquiries; (d) likely consequences; and (e) remedial measures taken or planned.

11. Data Retention, Return & Deletion

Upon termination or expiry of the Principal Agreement, Customer may export Call Detail Records, CRM contacts, and audio archives via self-service API or administrative export tools within thirty (30) days. Following this thirty-day grace period, CallingCRM shall securely overwrite or delete all copies of Customer Personal Data from its active production databases and storage volumes, unless preservation is mandated by telecom retention directives or applicable law.

12. Audits & Compliance Verifications

Upon reasonable written notice (no less than 30 business days) and no more than once in any twelve-month calendar period, Customer or an independent third-party auditor bound by confidentiality may conduct a verification of CallingCRM's data protection practices. Audits shall be conducted during normal business hours without disrupting ongoing multi-tenant operations, and Customer shall bear all audit-related expenditures.

13. Liability & Precedence

The total aggregate liability of each party arising under or related to this DPA shall be governed by and subject to the limitation of liability provisions set forth in the Principal Agreement. In the event of any direct conflict between the terms of this DPA and the Principal Agreement, this DPA shall prevail with respect to the subject matter of data protection and privacy.