Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Callario and the customer ("Customer") for the Services, and applies to Callario's processing of personal data on the Customer's behalf.

For this DPA, the Customer is the controller (or a processor for its own controllers) and Callario is the processor (or subprocessor) of Customer Personal Data processed through the Services. Each party will comply with its own obligations under applicable data protection law.

Where Callario processes personal information as a controller for its own purposes, that processing is governed by our Privacy Policy, not this DPA.

Callario will process Customer Personal Data only to provide the Services and on the Customer's documented instructions, including those in the agreement, this DPA and the Customer's own configuration of the Services.

The subject matter of the processing is the provision of the Services; its duration is the term of the agreement; its nature and purpose are operating the customer-support platform and its features for the Customer; and the types of personal data and categories of data subjects are determined by the Customer's use of the Services.

If Callario believes an instruction breaks applicable data protection law, it will tell the Customer, unless the law prevents it from doing so.

Callario will ensure that anyone authorised to process Customer Personal Data is bound by appropriate confidentiality obligations.

Callario will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, taking into account the state of the art, the nature of the data and the risks involved.

Those measures include role-based access control, optional workspace-wide two-factor authentication, per-workspace data isolation, encryption in transit, a hash-chained audit log and controls over AI features. Callario's security programme is still maturing, and Callario does not hold a SOC 2 attestation. The current controls are described on our Security page.

The Customer authorises Callario to engage subprocessors to help provide the Services. Callario lists its subprocessor categories, organised by function, on its Subprocessors page.

Callario will impose data protection obligations on its subprocessors that are substantially similar to those in this DPA, and remains responsible for its subprocessors' performance of those obligations.

Callario will give the Customer a way to learn of intended changes to its subprocessors, so that the Customer can object on reasonable data protection grounds.

Taking into account the nature of the processing, Callario will give reasonable help so the Customer can respond to data subjects exercising their rights, where the Customer cannot do so with the Services' own tools — which include exporting and erasing a customer's personal data.

Taking into account the nature of the processing and the information available to it, Callario will help the Customer meet its obligations on security, breach notification, data protection impact assessments and consultation with supervisory authorities.

If Callario receives a request directly from a data subject about Customer Personal Data, it will, where permitted, pass the request to the Customer.

Callario will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably available to it to help the Customer meet its own notification obligations.

When the Services end, Callario will delete or return Customer Personal Data in line with the agreement, except where the law requires it to be kept.

Callario will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits as required by applicable law, subject to reasonable confidentiality, security and scheduling safeguards.

Where Customer Personal Data is transferred across borders, the parties will rely on a lawful transfer mechanism as required by applicable data protection law, with supplementary measures where appropriate.

Callario currently runs in a single hosting region and does not offer a choice of data-residency region. The Customer can ask Callario for the current processing location through the contact page, and a change of location will be notified in the same way as a change of subprocessors.

If this DPA and the agreement conflict about the processing of Customer Personal Data, this DPA prevails to the extent of the conflict.