Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between RingKat ("Data Processor") and the business client ("Data Controller") and forms part of the service agreement between the parties.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under GDPR.

"Processing" means any operation performed on Personal Data, including collection, storage, transmission, and deletion.

"GDPR" means the General Data Protection Regulation (EU) 2016/679.

2. Roles

The Client is the Data Controller - they determine the purposes and means of processing caller data collected through their business phone line.

RingKat is the Data Processor - we process caller data solely on behalf of and under instruction from the Client.

3. Nature & Purpose of Processing

We process the following categories of personal data on behalf of the Client:

• Caller phone numbers
• Call recordings and transcripts (voice agent only)
• SMS message content

The purpose of processing is to provide the missed call SMS text-back and/or AI voice agent service as described in the service agreement.

4. Duration

We process personal data for the duration of the service agreement. Upon termination, all personal data will be deleted within 30 days unless retention is required by law.

5. Processor Obligations

RingKat agrees to:

• Process personal data only on documented instructions from the Client
• Ensure all staff with access to personal data are bound by confidentiality
• Implement appropriate technical and organisational security measures
• Assist the Client in responding to data subject rights requests
• Notify the Client within 72 hours of becoming aware of a personal data breach
• Delete or return all personal data upon termination of the service

6. Sub-processors

RingKat uses the following sub-processors to deliver the service:

• Twilio Inc. (USA) - telecommunications infrastructure
• Anthropic PBC (USA) - AI processing
• Railway Inc. (USA) - cloud hosting

Data transfers to the USA are covered by Standard Contractual Clauses or equivalent safeguards. We will notify the Client of any intended changes to sub-processors.

7. Controller Obligations

The Client confirms they have a lawful basis for collecting caller data through their business phone line, and that they have appropriate notices in place (e.g. a voicemail message informing callers their details may be used to contact them).

8. Governing Law

This DPA is governed by Irish law and subject to GDPR as applicable in Ireland.