Data Processing Agreement

Version 1 — effective 21 October 2026

This Data Processing Agreement ("DPA") is part of the Terms of Service between PCGLOBALCO ("Processor", "we"), which provides Calloop, and the Consumer ("Controller", "you"). It applies whenever we process personal data on your behalf through Calloop, and meets Article 28 of the EU General Data Protection Regulation ("GDPR"). If the DPA and the Terms conflict on personal data, the DPA wins.

1. Roles

You decide why and how personal data in your Calloop account is processed: your callers', your agents' and your tenants'. You are the controller of it. We process it only to provide the Service, as its processor. Where you run Calloop for your own clients (tenants), you may be a processor yourself. Then we are your sub-processor, and you pass on to your clients the commitments this DPA gives you.

2. What we process

Subjects	People who call or are called through your account (callers); your agents and supervisors; your dashboard users
Data	Phone numbers and WhatsApp identifiers; names and other details you or the caller provide; call records (times, durations, queues, agents, outcomes, transfers); IVR inputs (digits pressed); call recordings (audio), if you enable recording; agents' identifiers, names, device labels, push tokens and IP addresses; technical connection data (SDP and ICE, kept 24 hours)
Special categories	None are required. If your callers may disclose them during a call (for example, health information on a recorded line), you're responsible for having a lawful basis and telling us of any extra requirements
Purpose	Routing, connecting, recording and reporting your calls; delivering your events and pushes; billing usage; securing and supporting the Service
Duration	While the Terms apply, then as in section 9

3. Our obligations

We will:

1. Process only on your documented instructions. These terms, your configuration of the Service (API, dashboard) and your support requests are those instructions. If the law requires other processing, we'll tell you first unless the law forbids it. If we think an instruction breaks data protection law, we'll tell you.
2. Keep it confidential. Everyone we authorise to access the data is bound to confidentiality.
3. Secure it with the measures in Annex 1, and keep them current.
4. Use sub-processors only as in section 4.
5. Help you answer data subjects' requests. The Service lets you do most of this yourself: read a caller's calls through the API, delete a tenant and everything it holds, and erase a caller across a tenant (POST /v1/tenants/{t}/customers/erase, see Calls). For anything else, email support@calloop.net.
6. Tell you of a personal data breach without undue delay, and within 48 hours of becoming aware of it, with what we know and what we're doing about it. We'll follow up as we learn more, so you can meet your own 72-hour duty to notify.
7. Help with impact assessments and consultations with supervisory authorities, where they concern our processing.
8. Make available the information you need to verify this DPA, and allow audits as in section 6.

4. Sub-processors

You authorise the sub-processors below. We'll give you 30 days' notice before adding or replacing one, by updating this page and emailing your account's contacts. You may object on reasonable data-protection grounds. If we can't resolve it, you may end the affected part of the Service. Each sub-processor is bound to data-protection terms at least as protective as this DPA, and we stay responsible for them.

Sub-processor	What for	Data	Location
Our hosting and storage providers	Servers, database, recording storage, media relays (TURN)	All data in section 2	European Union
Apple (APNs), Google (Firebase Cloud Messaging), OneSignal	Waking your agents' apps for an incoming call. Only if you use push with Calloop's platform credentials: with your own credentials, the provider works for you	Push token, call id, the caller's name and number	Their global networks (EU Standard Contractual Clauses)
Telecom carriers	Carrying phone (SIP) calls on numbers we provide to you. Your own trunks (BYOC) are your providers	Phone numbers, call audio in transit, call signalling	Varies by carrier and number

Not our sub-processors: Meta (WhatsApp calling runs on your own WhatsApp Business account, under your agreement with Meta), your own carriers and push providers, and Stripe, which handles our billing of you, not your callers' data.

5. International transfers

The Service and its stored data are hosted in the European Union. Where a sub-processor transfers personal data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

6. Audits

On request, once a year, we'll answer a reasonable security questionnaire and give you a description of our measures. If that's not enough to show compliance, or a supervisory authority requires it, you may audit us with 30 days' notice. The audit happens during business hours, by you or an independent auditor bound to confidentiality, at your cost, and without access to other consumers' data.

7. Your obligations

You're responsible for having a lawful basis for the processing you instruct, including informing callers and obtaining consent for call recording where the law requires it. You're also responsible for choosing the Service's settings (recording, retention) to suit your obligations.

8. Retention

By default, the Service keeps:

Data	Kept for
Call detail (events, connections, transfers, IVR sessions, participants)	180 days after the call
Connection data (SDP, ICE candidates)	24 hours after the call
Webhook delivery records	30 days
Server logs	14 days
Call records (the call itself: time, numbers, outcome)	While your account exists, or until you erase a caller or delete the tenant
Recordings	Until you delete them. You set your own retention, overall or per tenant (Recording policy)

Usage records used for billing are kept as accounting law requires. They hold no full phone numbers.

9. End of the Service

When the Terms end, you can export your data through the API for 30 days. After that, we delete it, including recordings, within a further 30 days. The exception is what the law requires us to keep, such as billing records. We'll confirm the deletion on request.

10. Liability and law

Liability under this DPA follows the Terms of Service, section 10, without limiting what the GDPR doesn't allow to be limited. This DPA is governed by the laws of the Republic of Cyprus.

Annex 1: security measures

• Encryption in transit. API, dashboard, console, events and agent connections use HTTPS and secure WebSockets (TLS). Agents' call audio uses WebRTC's DTLS-SRTP. Phone (SIP) calls between Calloop and carriers travel unencrypted (UDP/TCP), as is usual for carrier interconnects. Encrypted SIP (TLS/SRTP) is not available yet.
• Credentials. API keys are stored only as hashes. Webhook secrets, signing keys, channel credentials and push credentials are stored encrypted. Agents connect only with short-lived tokens your backend signs, which expire within 24 hours at most, and revoking a signing key disconnects them.
• Isolation. Every request and connection is scoped to the consumer its credentials belong to, and every query on your data is limited to your account and tenant.
• Access. Staff access to the operator console requires two-factor authentication, with a fresh code for sensitive actions, and is recorded in an audit log. Dashboard users also sign in with two-factor authentication, and their changes are audited.
• Minimisation. Connection data is removed after 24 hours and call detail after 180 days (section 8). Secrets are masked in logs.
• Monitoring. Service health, errors and security events are monitored, with alerts to the team.
• People. Access to production is limited to staff who need it, bound to confidentiality.

Contact

PCGLOBALCO — support@calloop.net