Data Processing Agreement (DPA)

1. Subject and duration

Callwave processes personal data on behalf of the customer to provide the AI reception service. Processing lasts for the term of the main contract and ends when it terminates, subject to legal retention.

2. Nature and scope of processing

• Receiving and processing phone calls
• Creating and storing transcripts
• Appointment booking and forwarding per customer configuration
• Storing setup, prompt and knowledge base data

3. Categories of data subjects and data

• Callers (customer's end clients): phone number, conversation content, appointment requests
• Customer's employees: name, email, account data
• Other persons mentioned in conversations

4. Callwave's obligations

• Process only on documented instructions from the customer
• Confidentiality of persons authorised to process data
• Implement appropriate technical and organisational measures (TOMs)
• Assist with data subject requests and DPIAs
• Notify personal data breaches without undue delay
• Delete or return data after contract end

5. Customer's obligations

• Ensure legal basis for processing caller data
• Inform data subjects where required
• Issue documented instructions to Callwave
• Do not transmit special categories of data without legal basis

6. Technical and organisational measures

Callwave uses encryption in transit, access controls, tenant isolation, backups, logging and regular security updates. An current overview of TOMs is available on request.

7. Subprocessors

The customer authorises Callwave to use the following subprocessors. We notify material changes at least 30 days in advance:

• Twilio Inc. — telephony
• OpenAI — speech processing
• Supabase — database (EU)
• Vercel — hosting
• Stripe — payments

8. Deletion and return

After termination of the main contract Callwave deletes all customer personal data within 30 days unless legal retention applies. Export is available on request.

9. Audit rights

The customer may request evidence of DPA compliance after prior notice and within reasonable scope. Callwave may provide current certificates or audit reports to avoid on-site audits.

10. Request a DPA

A signed DPA template is available on request at dpa@callwave.ai or hello@callwave.ai. For paid contracts the DPA is deemed accepted unless individually agreed otherwise.