Data Processing Agreement

1. Parties and roles

You, the account holder, are the controller of the personal data in your content. Sumgrey OÜ ("we") is your processor. If you process that data on behalf of your own clients, as an outsourced contact centre does, you are their processor and we are your sub-processor; you confirm that your clients have authorised you to use us and the providers in Annex 3.

For the data about you as an account holder we are a controller, and the Privacy Policy applies instead of this agreement.

2. What we do with the data, and on whose instructions

We process the personal data in your content only to provide the Service to you, as Annex 1 describes, and only on your documented instructions. Your instructions are the Terms, this agreement, the way you configure and use the Service, and anything further you ask of us in writing that fits within the Service. We will tell you if we believe an instruction infringes data protection law.

We do not use your content for our own purposes: not to train or improve AI models, not for advertising, and not to combine it with other customers' data.

3. Confidentiality

Everyone we authorise to access your content is bound by a duty of confidentiality. Our staff look at the content of an account only when you ask us for help, or when it is needed to fix a fault or to protect the Service.

4. Security

We apply the technical and organisational measures in Annex 2 and keep them appropriate to the risk. We may change them, but never in a way that lowers the overall level of protection.

5. Other processors

You give us a general authorisation to use other processors for parts of the Service. Those in use are listed in Annex 3. We bind each of them by contract to data protection obligations equivalent to the ones in this agreement, and we remain fully responsible to you for what they do.

We will tell you by email or in the application at least 30 days before adding or replacing one. If you object on reasonable data protection grounds, tell us within that time and we will try to find a solution; if there is none, you may end the agreement by deleting your account before the change applies.

6. Where the data is processed

Your content is processed in the European Union, in the places Annex 3 gives. We will not transfer it outside the European Economic Area, and will not let our processors do so, except to a country covered by an adequacy decision of the European Commission or under its standard contractual clauses.

7. Requests from the people the data is about

The Service gives you the means to find and delete the data of a particular person: you can search across your calls and delete a call with everything derived from it. If someone sends us a request about data in your content, we will not answer it ourselves: we will pass it to you without delay. Where the tools are not enough, we will help you respond, as far as is reasonable.

8. Helping you comply

Taking into account what we know as the provider of the Service, we will help you meet your own obligations on security, on impact assessments and on consulting the supervisory authority, by giving you the information you need about how the Service works.

9. Security breaches

If we become aware of a breach of security that affects personal data in your content, we will tell you without undue delay, at the email address of your account. We will tell you what happened, which data and roughly how many people are affected, what the likely consequences are and what we have done or propose to do, and we will add what we learn afterwards.

10. When the Service ends

You can delete any call, or your whole account, at any time, and you can ask us for a copy of your content before you do. When an account is deleted we erase all its content at once, including the recordings held by our storage provider. Copies in backups are erased within 30 days. We keep nothing afterwards, other than what the Privacy Policy says about a deleted account, which contains none of your content.

11. Information and audits

We will give you the information you need to show that this agreement is being met and will answer reasonable written questions about our measures. If that is not enough, you may carry out an audit, yourself or through an independent auditor bound by confidentiality, once a year and with at least 30 days' notice, at your own cost and without disturbing the Service or exposing other customers' data.

12. Duration and precedence

This agreement applies for as long as we hold content of yours. On data protection it takes precedence over the Terms; on everything else, including liability, the Terms apply.

Annex 1. The processing

• Subject matter and purpose: transcribing and analysing the call recordings you upload, and storing and showing you the results.
• Nature of the processing: storage, transcription, automated analysis with AI models, indexing for search, display, and deletion.
• Duration: until you delete the content or your account.
• Types of personal data: voice recordings; what is said in the calls, which may include any information the participants mention; names, phone numbers and other identifiers of the participants; the names, codes and email addresses of your agents; scores and evaluations of how your agents handled each call. Calls may incidentally contain special categories of data (such as health data) if the participants mention them.
• People concerned: the customers and other people your organisation speaks to on the phone, and the people who handle those calls for you.

Annex 2. Security measures

• Location: all content is stored and processed in the European Union.
• Encryption in transit: every connection to the Service, and between the Service and its providers, is encrypted.
• Separation: every request is authenticated and limited to its own account in the data layer; one account cannot read another's content.
• Credentials: passwords and API keys are stored only as hashes; an API key is shown once, when it is created. A new account has to confirm its email address.
• Access to recordings: audio is played through short-lived links tied to the signed-in session; stored files have no public address.
• Minimisation: the copy of a recording at the transcription provider is deleted as soon as the transcript is received; optional redaction masks identifiers in transcripts; what you delete is erased at once.
• Abuse limits: the number of sign-in codes, uploads and assistant questions is limited per account.
• Operation: access to the production systems is restricted to the people who operate the Service; secrets are kept in server-side configuration and never reach the browser; changes are tested on separate systems with invented data.
• Providers: hosting, storage, AI inference and transcription are bought from providers certified under ISO/IEC 27001.

Annex 3. Other processors in use