CallPayWall
Data Processing Addendum
Effective date: October 14, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between Paywall Inc., a Delaware corporation ("Company", "Processor", "we", "us", "our"), and the business or enterprise customer that uses CallPayWall (the "Service") on behalf of an organization ("Customer", "Controller", "you") (together, the "Agreement"). This DPA applies where and to the extent the Company processes Personal Data on the Customer's behalf as a processor. It supplements our Privacy Policy. In the event of a conflict between this DPA and the rest of the Agreement regarding the processing of Personal Data, this DPA controls.
1. Definitions
1.1 "Personal Data" means any information relating to an identified or identifiable natural person that the Company processes on the Customer's behalf under the Agreement.
1.2 "Data Protection Laws" means all laws applicable to the processing of Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").
1.3 "Controller", "Processor", "Data Subject", "Processing", "Personal Data Breach", and "Supervisory Authority" have the meanings given in the GDPR. "Business", "Service Provider", "Sell", and "Share" have the meanings given in the CCPA/CPRA.
1.4 "Subprocessor" means any third party engaged by the Company to process Personal Data.
1.5 "Standard Contractual Clauses" (SCCs) means the clauses adopted by the European Commission (Decision 2021/914) and, for the UK, the UK International Data Transfer Addendum / IDTA.
2. Roles and Scope
2.1 As between the parties, the Customer is the Controller (or Business) and the Company is the Processor (or Service Provider) with respect to Personal Data processed under this DPA.
2.2 The subject matter of the processing is the provision of the Service. The nature and purpose of processing, the types of Personal Data, the categories of Data Subjects, and the duration are described in Annex A.
2.3 This DPA primarily covers Personal Data that the Customer captures through the Service about its own callers and leads (for example, lead and contact data), and other Personal Data the Company processes on the Customer's behalf. The Company's processing of data for which it is an independent Controller (for example, account administration, billing, security, and Service improvement) is governed by the Privacy Policy.
3. Processing Instructions
3.1 The Company will process Personal Data only on the Customer's documented instructions, including as set out in the Agreement, this DPA, and the Customer's configuration of the Service, except where required by applicable law (in which case the Company will, unless legally prohibited, inform the Customer).
3.2 The Company will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.
3.3 CCPA. The Company will not (a) Sell or Share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than the specific purpose of performing the Service, or outside the direct business relationship with the Customer; or (c) combine Personal Data with data from other sources except as permitted by the CCPA/CPRA. The Company certifies it understands and will comply with these restrictions.
4. Confidentiality
The Company ensures that personnel authorized to process Personal Data are bound by appropriate confidentiality obligations and receive appropriate data-protection training, and that access is limited to those who need it to provide the Service.
5. Security Measures
The Company implements and maintains appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, as described in Annex B. The Company may update its measures provided the overall level of protection is not materially reduced.
6. Subprocessing
6.1 The Customer provides general authorization for the Company to engage Subprocessors to process Personal Data. The categories of Subprocessors the Company uses are listed in subprocessors.md, and a list of the Company's current Subprocessors is available to the Customer on request.
6.2 The Company will impose data-protection obligations on each Subprocessor that are no less protective than those in this DPA and remains responsible for its Subprocessors' performance.
6.3 The Company will provide advance notice of any intended addition or replacement of a Subprocessor (via the subprocessor list and/or notification). The Customer may object on reasonable, documented data-protection grounds within thirty (30) days. The parties will work in good faith to resolve the objection; if they cannot, the Customer may terminate the affected portion of the Service.
7. Assistance with Data-Subject Requests
7.1 Taking into account the nature of the processing, the Company will provide reasonable assistance, through appropriate technical and organizational measures, to help the Customer respond to requests from Data Subjects exercising their rights under Data Protection Laws (access, rectification, erasure, restriction, portability, objection, and equivalent CCPA/CPRA rights).
7.2 If the Company receives such a request directly, it will, unless legally required to act, promptly notify the Customer and not respond except on the Customer's instruction or as required by law.
8. Personal Data Breach Notification
The Company will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting the Customer's Personal Data, and will provide information reasonably available to it to help the Customer meet its breach-notification obligations, including the nature of the breach, likely consequences, and measures taken or proposed.
9. Audits
9.1 The Company will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA.
9.2 The Customer may audit the Company's compliance no more than once per year (and following a Personal Data Breach), on reasonable prior written notice, during business hours, and subject to confidentiality. The Company may satisfy audit requests by providing third-party certifications, audit reports, or completed security questionnaires where these reasonably address the Customer's inquiry.
10. International Transfers
10.1 Where the processing of Personal Data involves a transfer from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses (with the Customer as data exporter and the Company as data importer) are incorporated into this DPA by reference and apply to such transfers, together with the UK Addendum / IDTA as applicable.
10.2 Module Two (Controller-to-Processor) and, where relevant, Module Three (Processor-to-Processor) apply. The Annexes to this DPA populate the corresponding SCC annexes. Where required, the Company maintains supplementary measures and provides the Customer relevant transfer documentation on request.
11. Deletion or Return on Termination
Upon termination or expiry of the Agreement, the Company will, at the Customer's choice, delete or return the Personal Data it processes on the Customer's behalf, and delete existing copies, except to the extent retention is required by applicable law. Data in routine backups is deleted in the ordinary course or rendered inaccessible until overwritten.
12. Liability
Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA limits liability to a Data Subject or Supervisory Authority to the extent such limitation is prohibited by Data Protection Laws.
13. General
This DPA is governed by the governing-law provisions of the Agreement (Delaware, USA), except where Data Protection Laws require otherwise. If any provision is held invalid, the remaining provisions remain in effect. This DPA may be updated by the Company as necessary to reflect changes in Data Protection Laws or Service operations, with notice to the Customer.
Annex A. Details of Processing
- Roles: Customer = Controller; Company = Processor.
- Subject matter: Provision of the CallPayWall Service (AI call screening, recording, transcription, classification, lead capture and delivery, voicemail, scheduling, email-pitch channel, and the caller/telemarketer portal).
- Duration: For the term of the Agreement plus the retention/deletion periods described in the Privacy Policy and Section 11.
- Nature and purpose of processing: Collection, recording, transcription, AI screening and classification, storage, organization, retrieval, disclosure to authorized recipients (as configured by the Customer), and deletion of Personal Data to operate the Service.
- Categories of Data Subjects: The Customer's callers and leads; the Customer's authorized users and personnel.
- Types of Personal Data: Caller and contact identifiers (name, phone number, email, company); call metadata; call audio recordings; transcripts; AI-generated summaries and classifications; lead details disclosed during calls; scheduling and messaging data. Special-category data is not intentionally requested; the Customer should not configure the Service to collect special-category data without an appropriate lawful basis.
- Frequency of transfer: Continuous, for the duration of the Agreement.
Annex B. Technical and Organizational Measures (TOMs)
The Company maintains the following measures, which it may update provided protection is not materially reduced:
- Encryption: Encryption of Personal Data in transit (TLS) and at rest.
- Access control: Role-based access, least-privilege permissions, unique credentials, and multi-factor authentication for administrative access; authentication managed through a dedicated cloud authentication provider.
- Network and application security: Firewalls, network segmentation, secure configuration, vulnerability management, and secure software development practices.
- Logging and monitoring: Audit logging of access to systems and Personal Data, monitoring, and alerting.
- Pseudonymization/minimization: Data minimization and, where feasible, pseudonymization or de-identification.
- Resilience: Backups, redundancy, and disaster-recovery capabilities to restore availability and access to Personal Data.
- Payment data: Full card numbers are handled by the payments Subprocessor and never stored by the Company.
- Vendor management: Due diligence and contractual data-protection commitments for Subprocessors.
- Personnel: Confidentiality obligations, background screening where lawful, and security/privacy training.
- Incident response: Documented procedures for detecting, responding to, and notifying Personal Data Breaches.
- Testing: Regular testing and evaluation of the effectiveness of security measures.
Contact
Data-protection inquiries: privacy@callpaywall.com (default: privacy@callpaywall.com) Paywall Inc., Attn: Privacy, 16192 Coastal Highway, Lewes, DE 19958 EU Representative: eu@callpaywall.com · UK Representative: uk@callpaywall.com