Data Processing Addendum

Who is controller, and who is processor

The two are not the same across all the data Callra holds, and the distinction decides which obligations fall where.

Customer is controller, Callra is processor

Call audio and transcripts, orders, appointments, and the contact details of the people who call you. You decide what is collected and why; Callra processes it to run the service for you. Everything in this Addendum concerns this data.

Callra is controller

Your own account, billing and business configuration data. This Addendum does not apply to it; the Privacy Policy does.

Subject-matter, duration, nature and purpose

Subject-matter

Provision of the Callra AI phone-agent service.

Duration

The term of the agreement, plus the retention period in “Deletion and return” below.

Nature and purpose

Answering your inbound calls; capturing and fulfilling orders (restaurants) or booking, rescheduling and cancelling appointments (salons); sending the transactional messages you configure; and providing your dashboard, reporting and support.

Type of personal data

Caller or client name and telephone number; call audio and transcript; order contents and delivery address; appointment history; message content and delivery status; and, for salon customers, allergy-alert (patch) test records.

Categories of data subjects

Your callers, customers and clients, and your own staff or stylists who hold accounts.

Processing only on your instructions

Callra processes this data only on your documented instructions, which are this Addendum, the agreement, and your own configuration of the service. Callra does not process it for its own purposes, and does not use it to train general-purpose AI models.

If law requires Callra to process beyond your instructions, Callra will tell you before doing so unless that law forbids the notice.

Confidentiality

Personnel authorised to process this data are bound by written confidentiality obligations, and access is limited to those who need it to deliver or support the service.

Security measures

Callra maintains appropriate technical and organisational measures, including:

• encryption in transit (TLS) and at rest for sensitive credentials (AES-256);
• least-privilege access control and role scoping, so a staff account sees only the data its role requires;
• audit logging of administrative actions;
• hosting in the United States;
• payment card data handled by PCI-compliant processors through hosted checkout and tokenisation, so Callra does not store raw card numbers. This applies to the restaurant product only — the salon product has no payment path and holds no card data.

Callra does not currently hold SOC 2, ISO 27001, PCI DSS or HIPAA certification, and does not operate a scheduled third-party penetration-testing programme. Nothing in this Addendum should be read as implying otherwise.

Sub-processors

You give general written authorisation for Callra to engage sub-processors, subject to all of the following:

• Callra imposes data-protection obligations on each sub-processor no less protective than those in this Addendum;
• Callra remains fully liable to you for its sub-processors’ acts and omissions;
• Callra maintains a current list of sub-processors, available to you on request and, where that list is confidential, under non-disclosure;
• Callra gives you 30 days’ notice before adding or replacing a sub-processor, during which you may object on reasonable data-protection grounds; and
• if an objection cannot be resolved, you may terminate the affected service without penalty for the remainder of the prepaid term.

Helping you answer data-subject requests

The service lets you access, correct, export and delete this data yourself. Where a request cannot be satisfied that way, Callra will assist you, taking into account the nature of the processing, within 10 business days.

If a data subject contacts Callra directly, Callra will not respond substantively. It will refer them to you and notify you promptly.

Breach notification and assessments

Callra will notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting this data, with the information reasonably available at the time. Callra will provide reasonable assistance with your own notification obligations and with any data protection impact assessment or prior consultation.

Deletion and return

On termination you may export your data for 30 days. After that, Callra deletes or anonymises it within 90 days, except where law requires retention. Backups are deleted on their ordinary cycle. Retention during the term is described in the Privacy Policy.

Information and audit

Callra makes available the information reasonably necessary to demonstrate compliance with this Addendum, and allows audits by you or an auditor you authorise: no more than once in any twelve months unless required by a supervisory authority or following a breach, on reasonable notice, during business hours, subject to confidentiality, and without disclosing another customer’s data or information that would compromise the security of the service.

International transfers

Callra hosts and processes this data in the United States. Where you are established in the United Kingdom or the European Economic Area, providing the service therefore involves a transfer of personal data outside that jurisdiction.

For those customers the parties will execute the applicable transfer mechanism — the UK International Data Transfer Agreement or Addendum, or the European Commission’s Standard Contractual Clauses — which then forms part of this Addendum. Callra will provide the relevant form on request, and will supply the information you need for your own transfer risk assessment.

Governing law and precedence

This Addendum is governed by the laws of the State of Delaware, where Anemoia LLC is organised, without regard to its conflict-of-laws rules. It adopts the jurisdiction and dispute-resolution provisions of the agreement it forms part of. Where this Addendum conflicts with the Terms, this Addendum governs for the processing it covers.

Contact

Questions about this Addendum, requests for the sub-processor list, or requests for a transfer mechanism can be sent to info@callraai.com.