Data Processing Agreement

Overview

This DPA applies when Klientel processes personal data on behalf of customers ("the Controller") as a processor in connection with the provision of the Klientel platform. By using the Services, the Controller and Klientel agree to the terms of this DPA.

Roles & responsibilities

The Controller (you, the customer): Determines the purposes and means of processing personal data entered into the Klientel platform, including contact information, call data, and CRM information.

The Processor (Klientel): Processes personal data solely on the Controller's documented instructions and in accordance with applicable data protection legislation.

Processing details

• Subject matter: Provision of Klientel's CRM, dialer, AI, and automation platform
• Duration: For the term of the service agreement
• Nature: Storage, retrieval, analysis, and transmission of personal data as instructed
• Types of personal data: Contact names, phone numbers, email addresses, company information, call recordings, transcripts, and any other data entered by the Controller
• Categories of data subjects: The Controller's customers, leads, prospects, and business contacts

Sub-processors

Klientel uses the following categories of sub-processors to deliver the Services:

• Cloud infrastructure: Hosting and storage (EU-based, ISO 27001-certified)
• Telephony: VoIP and call-routing providers
• AI processing: Speech-to-text transcription and analysis services
• Payment processing: Invoicing and subscription management
• Email delivery: Transactional email services

We will notify you of changes to our sub-processor list with at least 30 days' notice. A current list of sub-processors is available on request at [email protected].

Security measures

Klientel implements and maintains appropriate technical and organizational measures to protect personal data, including:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access control and multi-factor authentication
• Regular penetration testing and vulnerability assessments
• SOC 2 Type II and ISO 27001 compliance program
• Physical security controls at data centers
• Incident response and disaster recovery procedures

Full details are available in our Security documentation.

Data subject rights

Klientel will assist the Controller in fulfilling its obligations to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection). The Controller is responsible for handling such requests. We will respond to verified requests within 30 days.

Data breaches

Klientel will notify the Controller without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting the Controller's data. Notifications will include: the nature of the breach, the categories and volumes of data affected, the likely consequences, and the measures taken or proposed.

International transfers

Where personal data is transferred outside the EEA, Klientel relies on Standard Contractual Clauses (SCCs) as adopted by the European Commission to ensure an adequate level of protection.

Term & termination

This DPA remains in effect for the term of the service agreement. Upon termination, Klientel will, at the Controller's choice, delete or return all personal data within 90 days and, upon request, confirm deletion in writing.

Contact

For DPA-related inquiries, contact our DPO at [email protected].