Data Processing Addendum

1. Definitions and roles

"Caller Personal Information" means personal information about the Customer's callers and contacts that CrewAnswer processes on the Customer's behalf to provide the service — including call recordings, transcripts, summaries, caller phone numbers and contact details, and call metadata. "Applicable Privacy Law" means the privacy laws that apply to the Customer's use of the service, which may include Canada's PIPEDA, Québec's Law 25, and United States state privacy laws.

For Caller Personal Information, the Customer is the controller (the organization responsible for the information — under PIPEDA and Law 25, the organization accountable for it) and CrewAnswer is the processor/service provider acting on the Customer's documented instructions. For the Customer's own account and billing information, CrewAnswer acts as the party responsible on its own behalf, as described in the Privacy Policy.

2. The Customer's instructions and responsibilities

The Customer's documented instructions are the Terms, this DPA, the service's configuration, and the Customer's use of the service. The Customer is responsible for: (a) having a lawful basis to collect and process Caller Personal Information; (b) giving callers all notices and obtaining all consents required by Applicable Privacy Law, including for call recording and including all-party-consent requirements where they apply; and (c) the accuracy and lawfulness of the instructions it gives. CrewAnswer will inform the Customer if, in its reasonable opinion, an instruction infringes Applicable Privacy Law.

3. CrewAnswer's processing obligations

CrewAnswer will: (a) process Caller Personal Information only on the Customer's documented instructions, including for international transfers, unless required by law (in which case it will inform the Customer unless legally prohibited); (b) ensure personnel authorized to process Caller Personal Information are bound by confidentiality; (c) implement and maintain the technical and organizational security measures described in Annex B; (d) taking into account the nature of the processing, provide reasonable assistance to help the Customer respond to requests from individuals exercising their rights; and (e) provide reasonable assistance to the Customer with security, breach notification, and privacy-impact assessments, including the cross-border transfer assessment described in Section 5, taking into account the information available to CrewAnswer.

4. Subprocessors

The Customer authorizes CrewAnswer to engage the subprocessors listed at our subprocessors page (Annex C) to process Caller Personal Information. CrewAnswer will impose data-protection obligations on each subprocessor that are materially consistent with this DPA, and remains responsible to the Customer for its subprocessors' performance. CrewAnswer will update the subprocessors page and, where the Customer has contractual notice rights, provide notice before adding or replacing a material subprocessor, so the Customer can raise a reasonable objection.

5. International transfers and comparable protection

CrewAnswer processes Caller Personal Information in the United States, as described in the Privacy Policy and Annex C. CrewAnswer applies protections intended to provide a level of protection comparable to that required by Applicable Privacy Law, evidenced by the technical and contractual measures in Annex B and Section 4 (including per-tenant encryption, deletion controls, access auditing, and subprocessor flow-down). The Customer acknowledges that information stored or processed in the United States may be subject to access by US courts, law enforcement, or national-security authorities under US law, and is responsible for making any disclosure to its callers about cross-border processing that Applicable Privacy Law requires. On the Customer's reasonable request, CrewAnswer will provide the information the Customer needs to complete its own cross-border transfer assessment — including a privacy-impact assessment under Québec Law 25 § 17 — such as the destination jurisdictions, the categories of data transferred, the subprocessor categories involved (Annex C), and the security measures applied (Annex B).

6. Personal data breach

CrewAnswer will notify the Customer without undue delay after becoming aware of a breach of security safeguards affecting Caller Personal Information, and will provide the information reasonably available to it — including the nature of the incident, its timing, the categories and approximate number of individuals and records involved, and the measures taken or proposed — to help the Customer meet its own obligations under Applicable Privacy Law, including breach notification and the maintenance of a confidentiality-incident register (for example, the register required by Québec Law 25). CrewAnswer's notification is not an acknowledgement of fault or liability.

7. Assistance and audits

On the Customer's reasonable written request, and no more than once per year unless required by a regulator or following a breach, CrewAnswer will make available information reasonably necessary to demonstrate compliance with this DPA, such as its current security overview and relevant third-party reports where available. Any audit will be at the Customer's expense, on reasonable notice, during business hours, subject to confidentiality, and conducted so as not to disrupt CrewAnswer's operations or the security of other customers' data.

8. Return and deletion

On termination of the service, or on the Customer's earlier request, CrewAnswer will delete or return Caller Personal Information in accordance with the retention terms in the Privacy Policy. The Customer authorizes CrewAnswer to retain the limited records described in the Privacy Policy's "Billing, consent, and dispute-evidence records" — billing statements, subscription and payment records, usage and call metadata, and the Customer's recorded acceptance of the Terms — where CrewAnswer needs them to comply with law or to establish, exercise, or defend a legal or financial claim. The Customer also authorizes CrewAnswer to preserve charge-linked Tier 1 caller content for the Privacy Policy's 150-day chargeback evidence floor even before a dispute is filed, because CrewAnswer cannot know which paid charge will later be disputed. If a card dispute is actually open, CrewAnswer may preserve the disputed charge's recording, transcript, usage row, and necessary encryption material until the dispute closes plus the Privacy Policy's 30-day buffer. Unrelated caller content and non-charge-linked caller content remain subject to deletion. This retention is permitted despite the "only on the Customer's instructions" rule in Section 3(a); CrewAnswer protects these records and deletes them when they are no longer needed.

9. Liability, governing law, and precedence

Each party's liability under this DPA is subject to the limitations of liability in the Terms, and this DPA is governed by the same law as the Terms. This DPA controls over the Terms only on the subject of data processing. This DPA takes effect for a Customer when the Customer accepts the Terms and remains in effect while CrewAnswer processes Caller Personal Information. CrewAnswer may review and update this DPA, the Terms of Service, and the Privacy Policy at its discretion. The latest versions are always available at Terms of Service, Privacy Policy, and Data Processing Addendum, or by contacting [email protected] or [email protected].