Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Crulon, Inc. (“Crulon”, “we”) and the business that uses Crulon (“you”). It applies when we process Customer Personal Data on your behalf in providing the Service. Words defined in the Terms have the same meaning here.

• Customer Personal Data means personal data in Customer Data that we process on your behalf.
• Data Protection Laws means the laws that apply to that processing, including, where they apply, the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, US state privacy laws such as the California Consumer Privacy Act (“CCPA”), Canada’s PIPEDA, Australia’s Privacy Act 1988 and New Zealand’s Privacy Act 2020.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Customer Personal Data.

Where this DPA and the Terms differ on the processing of Customer Personal Data, this DPA applies.

You are the controller (or, under US state laws, the business) of Customer Personal Data, and we are your processor (or service provider). If you are yourself a processor for someone else, we are your subprocessor, and you are responsible for getting any authorisation this DPA needs from that controller.

You are responsible for having a lawful basis for the processing, and for giving the notices and getting the consents Data Protection Laws require, including for recording calls and using AI on them.

We process Customer Personal Data only on your documented instructions. The Terms, this DPA and the way you configure and use the Service are your complete instructions. We may also process it where the law requires, and if so we will tell you first unless the law forbids it.

If we believe an instruction breaks Data Protection Laws, we will tell you, and we may decline to follow it.

• Subject matter and purpose: providing the Service: phone numbers, calls and texts, AI agents, recording, transcription and summaries, contacts and tickets, connected Apps, and support.
• Nature of the processing: collecting, recording, storing, transcribing, analysing, transmitting and deleting.
• Duration: for as long as you use the Service, and afterwards as set out in “When the Service ends”.
• Data subjects: your workspace’s members, and the people they and your AI agents call, text or keep as contacts, such as your customers.
• Types of personal data: names, phone numbers, email addresses and other contact details; call recordings, transcripts, summaries and voicemail; texts; notes, tickets and account details you add or bring in from connected Apps; and usage and device data.
• Special categories: we don’t ask for special categories of data. Don’t use the Service for them except as our Acceptable Use Policy allows.

We make sure that anyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, and has access only as needed to provide the Service.

We maintain technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit, and at rest in our databases, backups and file storage, with keys we manage and rotate.
• Permissions by role, so people in a workspace see and do only what their role allows.
• A record of who played, downloaded or read each call’s recording and transcript.
• Staff access through single sign-on and a private network, limited to people who need it.
• Monitoring of our systems for threats, and backups of our databases.

We may update these measures, as long as we don’t reduce the overall protection of Customer Personal Data. You are responsible for your own use of the Service, including keeping logins secure and setting roles and recording to suit your needs.

You authorise us to use the subprocessors listed on our subprocessors page. We will give each one data protection obligations that are no less protective than this DPA, and we remain responsible for them as Data Protection Laws require.

We will update the subprocessors page at least 30 days before a new subprocessor starts processing Customer Personal Data. You may object on reasonable data protection grounds within that time by emailing privacy@crulon.ai. If we can’t resolve the objection, your remedy is to stop using the affected part of the Service, or to cancel.

If we receive a request from a person exercising their rights over Customer Personal Data, we will pass it to you and not respond ourselves, unless the law requires. Taking into account the nature of the processing, we will give you reasonable help to respond, mainly through the features of the Service.

We will tell you without undue delay after becoming aware of a Personal Data Breach. We will give you the information we reasonably can to help you meet your own obligations, and update it as we learn more. We will take reasonable steps to contain the breach and limit its effects. Telling you about a breach is not an admission of fault.

Where Data Protection Laws require, we will give you reasonable help with data protection impact assessments and consultations with supervisory authorities about the Service, taking into account the information available to us.

On written request, we will give you information reasonably needed to show that we meet this DPA, such as security documentation or third-party reports we hold. If Data Protection Laws require more, you may audit our compliance no more than once a year, on at least 30 days’ notice, during business hours, under confidentiality, and at your cost, in a way that avoids disrupting the Service.

We host the Service in the United States, and our subprocessors may process Customer Personal Data in other countries.

• From the EEA: the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 apply, Module 2 (controller to processor) and, where you are a processor, Module 3 (processor to processor). Clause 7 doesn’t apply; under Clause 9 option 2 applies, with the notice period in “Subprocessors”; the option in Clause 11 doesn’t apply; Clauses 17 and 18 are governed by the laws and courts of Ireland. The annexes are completed by “Details of the processing”, “Security” and the subprocessors page.
• From the UK: the International Data Transfer Addendum issued by the UK Information Commissioner applies to the Standard Contractual Clauses.
• From Switzerland: the Standard Contractual Clauses apply with the changes Swiss law requires, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.
• From other places that restrict transfers, such as Canada, Australia and New Zealand: we take the steps their laws require, including contracts with appropriate safeguards.

If the Standard Contractual Clauses conflict with this DPA, the Clauses apply.

Where US state privacy laws apply, we act as your service provider or contractor, and we:

• don’t sell or share Customer Personal Data, as those laws define selling and sharing;
• don’t keep, use or disclose it outside our direct business relationship with you, or for any purpose other than providing the Service;
• don’t combine it with personal data we get from others, except as those laws allow;
• comply with those laws, and tell you if we can no longer meet them.

You may take reasonable steps to stop and fix unauthorised use of Customer Personal Data.

When your plan ends, we keep Customer Personal Data for 90 days, then delete it, unless the law requires us to keep it. Before then, you can ask support for a copy. Copies in our backups are deleted as the backups are replaced. We keep billing records, and records of what was agreed to, for as long as the law requires.

Each side’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms, as far as Data Protection Laws allow.

We may update this DPA to reflect changes in Data Protection Laws or in the Service, as long as the update doesn’t reduce the overall protection of Customer Personal Data. We tell you about material changes the way the Terms say we tell you about changes to the Terms.

Crulon, Inc., 2810 N Church St, Suite 88431, Wilmington, DE 19802. Email privacy@crulon.ai.