Draft — pending counsel review. This document describes how the service works today and will be finalised before general availability.

Version 1.0-draft · effective 2026-10-06

Data Processing Addendum

This addendum ("DPA") forms part of the agreement between the iCall.tel operating company ("we", the "Processor") and the customer using iCall.tel (the "Customer", the "Controller"), including the Terms of Service. It applies whenever we process personal information on the Customer's behalf. Where the Customer and we have signed a different data-processing agreement, that one prevails.

1. Scope and roles

The Customer is the controller (or "business") of the personal information in its organization's calls, meetings, chat and recordings ("Customer Data"). We process Customer Data only as the Customer's processor (or "service provider"). For account security and the operation of the service we act as an independent controller, as described in the Privacy Policy.

2. Details of the processing

3. Our obligations

We will:

1. process Customer Data only on the Customer's documented instructions — the agreement, these terms and the Customer's use of the service's settings — unless the law requires otherwise, in which case we tell the Customer first where allowed;
2. not sell or share Customer Data, not use it for our own purposes, and not combine it with other data except as needed to provide the service;
3. ensure everyone authorised to process it is bound by confidentiality;
4. apply the security measures in Annex 1;
5. assist the Customer, taking into account the nature of the processing, in answering data-subject requests and in meeting its obligations on security, breach notification, and impact assessments;
6. notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal-data breach affecting Customer Data, with the information then available;
7. make available the information reasonably needed to demonstrate compliance with this DPA, and allow reasonable audits on 30 days' notice, no more than once a year unless a breach or regulator requires it.

4. Sub-processors

The Customer authorises the sub-processors listed at Sub-processors. We impose data-protection terms on each that are no less protective than this DPA, and remain responsible for their performance. We give at least 30 days' notice of a new sub-processor on that page; the Customer may object on reasonable data-protection grounds, and if we cannot resolve the objection the Customer may terminate the affected service.

5. International transfers

Customer Data is hosted in the United States. Where the law applicable to the Customer requires a transfer mechanism (for example, the EU Standard Contractual Clauses), the parties agree to incorporate it on request.

6. Customer responsibilities

The Customer is responsible for the lawfulness of its instructions and of the Customer Data, including providing notices and obtaining consents — in particular for recording calls, where some places require every participant's consent.

7. Requests from authorities

We will refer a request for Customer Data to the Customer unless the law prohibits it, challenge requests we consider unlawful, and disclose only what is legally required.

8. Data-subject requests

If we receive a request about Customer Data, we will forward it to the Customer without undue delay and not answer it ourselves unless the Customer instructs us to.

9. Return and deletion

When the agreement ends, we make Customer Data available for export on request for 30 days, then delete it, including from backups as they rotate, unless the law requires us to keep it.

10. Liability

Liability under this DPA is subject to the limitations in the Terms of Service.

Annex 1 — Security measures