Data Processing Addendum: AI Receptionist

2. Roles of the parties

For the calls the AI Receptionist answers on your behalf — the caller's voice, the details the caller gives, the message written for you, and any recording, transcript or uploaded document — you (the Customer) are the data controller and Kall It AI is the data processor, acting only on your instructions as set out in the AI Receptionist Terms and this DPA. Your instructions are the set-up you publish: what the receptionist says, what it asks each kind of caller for, who it may put callers through to, whether calls are recorded or transcribed, and where messages are sent. For account, billing, and security data, each party acts as an independent controller for its own purposes, as described in our Privacy Policy. Our accompanying Record of Processing Activities (ROPA) and Data Protection Impact Assessment (DPIA) describe this in full detail, available on request at privacy@kallit.ai.

3. Our processing of your data

We process call content and the details callers give only (a) to answer the call and take the message as you have set the receptionist up to do, including checking an address against the postcode, sending a confirmation text to the caller where you have switched that on, and scanning any uploaded file for malware before you open it; (b) as necessary to operate the service (support, security, fraud prevention, and technical troubleshooting); and (c) as you separately instruct us in writing. We do not use this content for any other purpose, including training AI models, and we do not sell it or share it for marketing or advertising purposes of any kind.

You are responsible for ensuring your own instructions to us, and your use of the service, comply with data protection law — including having a proper legal basis for automated call handling and recording, telling your callers how their calls are handled beyond the receptionist's own announcement, and not asking the receptionist to collect special category data, criminal offence data or payment card details. Sections 5, 9 and 12 of our AI Receptionist Terms cover this in detail.

4. Confidentiality

Anyone at Kall It AI with access to call content is bound by confidentiality obligations, and access is restricted by role — only members of your own business can reach your business's calls and messages through the platform. A limited number of Kall It AI administrators can also access stored content directly in our database. This is restricted to authorised administrators protected by two-step authentication, used only for support at your request, security investigations or legal requirements, and recorded.

5. Sub-processors

You give general authorisation for us to engage the sub-processors listed in Section 4 of our AI Receptionist Privacy Policy, which we keep current as sub-processors change. Each sub-processor is bound by a written agreement imposing data protection obligations equivalent to those in this DPA, including confidentiality and appropriate technical and organisational security measures. If we appoint a new sub-processor, we will update that published list with the effective date of the change; if you have a reasonable, data-protection-related objection to a new sub-processor, contact us at privacy@kallit.ai and we will work with you in good faith to address it, which may include not using that sub-processor for your account where reasonably possible.

6. International transfers

Our own servers that answer the calls are in Germany, and our database is in Ireland. Speech recognition and voice (Soniox) and the language model (Google Cloud Vertex AI) run in their European regions, though both are US companies that may carry out limited security and support processing outside them. Telnyx, which supplies your number, connects the calls and sends text messages, is a US company, as is OpenAI, which we use only as a fallback to produce the spoken greeting (no caller data). Each has its own Data Processing Addendum covering any transfer under UK-recognised Standard Contractual Clauses or the equivalent International Data Transfer Addendum — for Telnyx, OpenAI and Google, incorporated into their standard terms, and for Soniox, a Data Processing Agreement we have signed with it. Where any other sub-processor transfers data outside the UK/EEA, we rely on the same kind of recognised safeguard.

7. Security measures

Data is encrypted in transit and at rest. Access is controlled by role, with optional two-step authentication and forced sign-out available if an account looks compromised. Recordings and transcripts are separate settings you control, and whatever is kept is automatically, permanently deleted 30 days after the call, regardless of any other action. Files uploaded by callers are scanned for malware before you can open them. Full detail is in our Privacy Policy and the accompanying DPIA.

8. Data subject requests and assistance

A caller who wants to see, correct or delete what they told the receptionist should contact you, as the controller; your call history holds everything the receptionist took. We will provide reasonable assistance, at your cost where the request requires meaningful additional work on our part, to help you respond to a data subject's request or to a data protection impact assessment or regulator consultation concerning the processing under this DPA. If a caller contacts us directly, we will pass the request to you and help you answer it.

9. Personal data breach notification

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and will notify the ICO within 72 hours where UK GDPR Article 33 requires it.

10. Deletion of data on termination

Recordings and transcripts are already auto-deleted 30 days after each call regardless of your account status. On closing your account, we handle the remaining data — your call history and the messages in it, uploaded files, and your business's set-up — as described in our Privacy Policy and Terms of Service Section 12, including any retention we're required to keep for financial record-keeping or other legal obligations.

11. Audit

On reasonable written request, no more than once per year unless required by a regulator or following a security incident, we will provide you with the information reasonably necessary to demonstrate compliance with this DPA, such as a summary of our current security measures and sub-processor list. We may satisfy this by providing existing audit reports or certifications where available, rather than a bespoke audit, and any on-site audit would need to be agreed in advance and carried out in a way that doesn't expose other customers' data.