Data Processing Addendum

This Data Processing Addendum (this "Addendum") forms part of, and is incorporated into, the online Terms of Service, Order Form, or other written or electronic agreement governing the Services (the "Agreement") between the customer identified in the Agreement ("Customer" or "Controller") and Dialfyne ("Dialfyne" or "Processor"), headquartered in Vancouver, Washington, USA. This Addendum is effective without a separate signature when incorporated into the Agreement, including by Customer's acceptance of the Terms at dialfyne.com/terms-of-service.

This Addendum applies only to the extent Dialfyne Processes Customer Personal Data on behalf of Customer in connection with the Services.

1.1 "Adequacy Decision," "Controller," "Data Subject," "Personal Data Breach," "Process" or "Processing," "Processor," "Sub-Processor," and "Supervisory Authority" have the meanings given under applicable Data Protection Laws.

1.2 "Aggregated Data" has the meaning given in the Agreement.

1.3 "CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its implementing regulations.

1.4 "Customer Personal Data" means Personal Data Processed by Processor on behalf of Controller in connection with the Services, as described in Annex 1.

1.5 "Data Protection Laws" means all applicable privacy, data protection, and data security laws applicable to the Processing of Customer Personal Data, including, where applicable, the GDPR, UK GDPR, the Swiss Federal Act on Data Protection, the CCPA, and other applicable U.S. state privacy laws.

1.6 "Data Subject Request" means a request from a Data Subject to exercise rights under applicable Data Protection Laws.

1.7 "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as retained in UK law.

1.8 "Sensitive Personal Data" means Personal Data subject to heightened protection, including special categories under GDPR Article 9 and sensitive personal information under the CCPA.

1.9 "Services" means the services Dialfyne provides under the Agreement (currently Dial, Email, Roleplay, analytics, related integrations, and optional Managed Outbound).

1.10 "Standard Contractual Clauses" or "SCCs" means the clauses approved by European Commission Implementing Decision (EU) 2021/914, as amended.

1.11 "UK Addendum" means the UK International Data Transfer Addendum issued by the ICO, as amended.

2.1 With respect to Customer Personal Data, Customer is the Controller or Business, and Dialfyne is the Processor or Service Provider, as applicable.

2.2 If Customer acts as a Processor for a third-party controller, Customer represents that its instructions to Dialfyne have been authorized by that controller.

2.3 Dialfyne acts as a Controller for its own website, billing, security, and product-improvement activities described in the Privacy Policy. Those activities are outside this Addendum except where they Process Customer Personal Data on Customer's documented instructions.

3.1 Processor shall Process Customer Personal Data only on documented instructions from Controller, including the Agreement, this Addendum, and Controller's use and configuration of the Services, unless required by applicable law. Processor shall inform Controller of that legal requirement before Processing unless the law prohibits notice.

3.2 Processor shall Process Customer Personal Data only for the limited purposes necessary to provide the Services, to perform the Agreement and this Addendum, and as otherwise permitted by Data Protection Laws.

3.3 To the extent Processor Processes Personal Information subject to the CCPA, Processor shall: (a) Process it only for the business purposes described in the Agreement and this Addendum; (b) not sell or share it (as defined under the CCPA); (c) not retain, use, or disclose it except for those purposes, except as permitted by the CCPA; (d) not retain, use, or disclose it outside the direct business relationship except as permitted by the CCPA; and (e) not combine it with Personal Information from another person or from Processor's own interaction with a consumer, except as permitted by the CCPA. Processor certifies that it understands these restrictions.

3.4 Processor shall not use Customer Personal Data to train third-party generative artificial intelligence models. Processor may create and use Aggregated Data in accordance with the Agreement. Aggregated Data is not Customer Personal Data for purposes of this Addendum.

3.5 Controller shall not submit Sensitive Personal Data to the Services without Processor's prior written consent, except incidental voice content that may arise on a sales call without Controller intending to collect special-category data.

3.6 If Processor receives a Data Subject Request relating to Customer Personal Data, Processor shall promptly notify Controller and shall not respond except on Controller's documented instructions or as required by law.

3.7 If Processor believes an instruction infringes Data Protection Laws, Processor shall promptly inform Controller.

4.1 Processor shall ensure that personnel authorized to Process Customer Personal Data are subject to a contractual, professional, or statutory duty of confidentiality.

4.2 Access to Customer Personal Data is limited to personnel who need it to perform the Agreement and this Addendum.

5.1 Processor shall implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, cost, nature, scope, context, purposes, and risk. Those measures are described in Annex 2.

5.2 Processor shall regularly review and, where appropriate, update those measures.

6.1 Processor shall notify Controller without undue delay, and in any event no later than seventy-two (72) hours after becoming aware of a Personal Data Breach affecting Customer Personal Data.

6.2 Notification shall include, to the extent available: (a) a description of the nature of the breach; (b) a contact point; and (c) measures taken or proposed, including mitigation.

6.3 Processor shall promptly provide further information and assistance Controller reasonably requires in connection with a Personal Data Breach.

7.1 Controller provides a general written authorization for Processor to engage Sub-Processors.

7.2 A current list is maintained at dialfyne.com/subprocessors (the "Sub-Processor List").

7.3 Processor shall notify Controller of additions or replacements by updating the Sub-Processor List. Customers who wish to receive email notice may request it at [email protected].

7.4 Controller may object in writing within fourteen (14) days on documented, reasonable grounds relating to a Sub-Processor's inability to comply with Data Protection Laws or this Addendum.

7.5 If Controller objects, the parties shall work in good faith for thirty (30) days to find a workaround. If none is reached, Processor may refrain from using the Sub-Processor for Controller's Customer Personal Data, or permit Controller to terminate the affected Service as its sole and exclusive remedy.

8.1 Processor will enter into a written agreement with each Sub-Processor containing data-protection obligations no less protective than those in this Addendum, including appropriate security measures.

8.2 Processor remains liable to Controller for the Sub-Processor's performance of those obligations to the extent required by Data Protection Laws.

9.1 Taking into account the nature of the Processing, Processor shall provide reasonable assistance to Controller for Data Subject Requests.

9.2 Taking into account the nature of the Processing and information available to Processor, Processor shall provide reasonable assistance with DPIAs, prior consultations, and similar assessments where required.

9.3 Unless prohibited by law, Processor shall promptly notify Controller if Processor receives a legally binding government request for disclosure of Customer Personal Data before making such disclosure.

10.1 Processor shall make available to Controller, upon reasonable written request, information reasonably necessary to demonstrate compliance with this Addendum.

10.2 Subject to confidentiality and appropriate safeguards, and only to the extent Processor's then-current documentation (including reports from infrastructure providers such as SOC 2 Type II reports for those providers) does not reasonably satisfy Controller, Processor shall allow reasonable audits by Controller or an independent auditor, provided that: (a) Controller gives at least thirty (30) days' prior written notice; (b) audits occur no more than once per calendar year unless required by a competent authority or following a confirmed Personal Data Breach; (c) audits occur during normal business hours and minimize disruption; and (d) Controller bears its own costs and reimburses Processor's reasonable costs, except where the audit reveals a material breach of this Addendum by Processor.

Dialfyne itself is not currently SOC 2 or ISO 27001 certified. Processor does not represent otherwise.

11.1 Upon termination or expiration of the Agreement, Processor shall, at Controller's written request, delete or return Customer Personal Data promptly, unless applicable law requires retention. This Section does not apply to Aggregated Data.

11.2 Where law requires retention, Processor shall continue to protect such Customer Personal Data in accordance with this Addendum and shall not Process it except to comply with that legal obligation.

12.1 Processor is established in the United States. Processor does not currently rely on the EU-U.S. Data Privacy Framework. For transfers of Customer Personal Data from the EEA, UK, or Switzerland to a country without an Adequacy Decision, the transfer mechanisms in this Section apply.

12.2 For GDPR transfers from the EEA, the SCCs are incorporated by reference: (a) Module Two (Controller to Processor) applies, or Module Three where Customer is itself a Processor; (b) the optional docking clause in Clause 7 applies; (c) in Clause 9, Option 2 applies, with fourteen (14) days' prior notice of Sub-Processor changes; (d) in Clause 11, the optional language does not apply; (e) in Clause 17, Option 1 applies and the SCCs are governed by the laws of Ireland; (f) in Clause 18(b), disputes are resolved before the courts of Ireland; (g) Annex I is deemed completed with Annex 1 of this Addendum; (h) Annex II is deemed completed with Annex 2 of this Addendum.

12.3 For UK GDPR transfers, the SCCs as modified by the UK Addendum are incorporated. Tables and appendices are deemed completed using Annex 1 and Annex 2.

12.4 For Swiss transfers, the SCCs apply with references to the GDPR read as references to the Swiss FADP; "EU," "Union," and "Member State" include Switzerland; the competent Supervisory Authority is the FDPIC; and data subjects in Switzerland may enforce rights in Switzerland as required by Swiss law.

13.1 This Addendum remains in effect for so long as Processor Processes Customer Personal Data on behalf of Controller under the Agreement.

13.2 Obligations that by their nature should survive (confidentiality, return or deletion, liability, international transfers, and audit) survive.

14.1 Each party is liable for damages caused by its breach of this Addendum to the extent provided by applicable law and the Agreement.

14.2 Claims arising under this Addendum are subject to the limitations and exclusions of liability in the Agreement, except to the extent prohibited by Data Protection Laws or the SCCs.

15.1 If this Addendum conflicts with the Agreement on the subject matter of this Addendum, this Addendum prevails.

15.2 Dialfyne may update this Addendum by posting an updated version at this URL, provided that no update will materially reduce the level of protection for Customer Personal Data during the then-current subscription term unless required to comply with Data Protection Laws. The version in effect as of the effective date of the applicable Order Form applies to that Order Form unless the parties agree otherwise or law requires the updated version.

15.3 This Addendum is governed by the governing law and jurisdiction in the Agreement, except as required by the SCCs or UK Addendum for international transfers.

This Addendum is effective as of the effective date of the Agreement or the date Customer first accesses or uses the Services, whichever is earlier.

A. Parties

• Data Exporter: the Customer identified in the Agreement. Role: Controller, or Processor where applicable. Activities: receipt and use of the Services.
• Data Importer: Dialfyne, Vancouver, Washington, USA. Role: Processor. Activities: provision of the Services. Stored data location: United States.

B. Description of Processing

• Categories of Data Subjects: Customer's authorized users, employees, contractors, and agents; Customer's prospects, leads, business contacts, and communication recipients.
• Categories of Personal Data: contact and identification data (name, email, phone, job title, company); authentication and account data; CRM and sales engagement data; communication data including call recordings, transcripts, email content, metadata, and attachments; product usage data; technical data such as IP address, browser, and session data.
• Sensitive Personal Data: not intended to be transferred unless expressly authorized in writing.
• Frequency: continuous.
• Nature and purpose: to provide the Services as described in the Agreement, including placing and receiving calls, transcription, recording, coaching and scoring, roleplay, email sequencing, CRM write-back, and analytics.
• Retention: for the term of the Agreement and thereafter in accordance with Section 11.

C. Competent Supervisory Authority

Determined in accordance with Clause 13 of the SCCs. For UK transfers, the ICO. For Swiss transfers, the FDPIC.

Processor implements measures appropriate to the Services and risk profile, including:

• Personnel training on security and confidentiality
• Customer Personal Data stored on secured servers; production databases password-protected and isolated by workspace (row-level security)
• Network monitoring and logging of access to production systems
• Multi-factor authentication or equivalent for production access where supported by the hosting provider
• Least-privilege employee access; segregation of duties
• Encryption in transit with TLS 1.2 or higher, and encryption at rest with AES-256 or equivalent on the primary database
• Backup and restore processes for the primary database (provider-managed daily backups with a short retention window)
• Vendor due diligence and contractual data-protection terms for Sub-Processors
• Consent, DNC, and calling-hour controls made available in the Services for Customer to configure
• Processes to restore availability after a physical or technical incident
• Annual review of information-security practices

Reconcile these measures against actual controls before relying on them in an enterprise review. Dialfyne does not claim SOC 2 or ISO 27001 certification for itself.

A current list is maintained at dialfyne.com/subprocessors.