These Data Processing Terms (the “DPA”) form part of the Acceptable Use Policy and Agreement of TextCall (the “Agreement”) between Intergo Telecom Ltd, a company registered in the Republic of Cyprus under registration number HE 352115, with its registered office at Tepeleniou 17, Office 102-103, 8010 Paphos, Cyprus (“Intergo Telecom”, “we”, “us” or “our”), and the customer using the Services (“Customer”, “you” or “your”).

This DPA applies automatically when you accept the Agreement, and no separate signature is required. It sets out the terms required by Article 28 of the GDPR for the processing of personal data that we carry out on your behalf when providing the Services. If you need a countersigned copy for your records, please contact dpo@intergotelecom.com; a countersigned copy will be on the same terms as this DPA.

1. Definitions

1.1 Capitalised terms not defined in this DPA have the meaning given in the Agreement. In this DPA:

1. “Communications Provider” means a mobile network operator, carrier, aggregator, voice or SIP carrier or other provider of electronic communications services that conveys a message or call, in whole or in part, between our platform and the recipient’s or called party’s device or line (or between the recipient or caller and our platform, in the case of replies, inbound calls and delivery reports);
2. “Customer Personal Data” means the personal data described in Annex 1 that we process on your behalf in providing the Services;
3. “Data Protection Laws” means Regulation (EU) 2016/679 (the “GDPR”), Directive 2002/58/EC (the “ePrivacy Directive”) and its national implementing laws, the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data (Law 125(I)/2018), and any other data protection laws applicable to the processing of Customer Personal Data, each as amended or replaced;
4. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data;
5. “SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914;
6. “Sub-processor” means any third party we engage to process Customer Personal Data on your behalf.

1.2 The terms “controller”, “processor”, “data subject”, “personal data”, “processing” and “supervisory authority” have the meanings given in the GDPR.

2. Scope and roles

2.1 For Customer Personal Data, you are the controller and we are your processor. Where you act as a processor on behalf of a third-party controller, we act as your sub-processor, and you confirm that the relevant controller has authorised your instructions and our engagement.

2.2 Annex 1 describes the subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects.

2.3 This DPA does not apply to personal data that we process as an independent controller. This includes your account and contact data, the identity and compliance information we collect to verify you and to allocate phone numbers, and the traffic, billing and routing data we need to invoice the Services, settle charges with our suppliers and partners, prevent fraud and misuse, maintain network and information security, meet our obligations as an electronic communications provider, and comply with legal requirements. That processing is described in our Privacy Statement at https://textcall.com/privacy-policy/.

3. Processing on your instructions

3.1 We will process Customer Personal Data only on your documented instructions, including with regard to international transfers, unless Union or Member State law requires otherwise. In that case, we will inform you of the legal requirement before processing, unless the law prohibits this on important grounds of public interest.

3.2 Your documented instructions consist of the Agreement, this DPA, and your configuration and use of the Services (including the messages, calls, recipients, numbers, sender IDs, recording and transcription settings and other settings you submit through the platform or API). Any additional instructions must be given in writing and must be consistent with the Agreement.

3.3 We will inform you immediately if, in our opinion, an instruction infringes Data Protection Laws. We may suspend the affected processing until you confirm or modify the instruction.

4. Your responsibilities

4.1 You are responsible for the lawfulness of the processing you instruct, including having a lawful basis for sending each message and making each call, providing any required information to recipients and called parties, and obtaining and recording any consents and opt-outs required by Data Protection Laws or marketing rules.

4.2 You must not include in message content, or capture in call recordings or transcripts, special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR), except to the extent strictly necessary for the purpose of the communication and permitted by a lawful basis under Article 9(2) or Article 10 GDPR. Ordinary appointment, booking, account and verification notifications (for example, the date, time, location and type of an appointment, or a booking, consent or verification link or code) are permitted, provided you limit their content to what is necessary.

4.3 You are responsible for giving the notices and obtaining the consents required by applicable law before you enable call recording or AI transcription, or otherwise record, monitor or transcribe any call, including in relation to all participants in the call.

4.4 You are responsible for configuring the security features made available to you in the Services that are appropriate to the personal data you process, including multi-factor authentication, API key management, data residency region selection where offered, and for keeping your account credentials confidential.

5. Confidentiality

5.1 We will ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it to provide the Services.

6. Security

6.1 We will implement and maintain the technical and organisational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk in accordance with Article 32 GDPR.

6.2 We may update these measures from time to time, provided that the updates do not materially reduce the overall level of security of the Services.

7. Sub-processors

7.1 You give us general written authorisation to engage Sub-processors. Annex 3 lists the Sub-processors we currently engage, their processing activities and locations.

7.2 We will notify you of any intended addition or replacement of a Sub-processor at least thirty (30) days before the change takes effect, by email to the primary contact address on your account. The notice will state the name and category of the Sub-processor, the processing location and the transfer mechanism relied on, and we will update Annex 3 accordingly.

7.3 You may object to an intended change on reasonable data protection grounds by notice to dpo@intergotelecom.com within the notice period. We will discuss your objection in good faith. If we cannot resolve it, you may terminate the affected Services by written notice before the change takes effect. Notwithstanding clauses 4 and 6 of the Agreement, no early termination charges will apply and we will refund any unused prepaid balance for the terminated Services.

7.4 Where an immediate replacement of a Sub-processor is necessary for security reasons or to maintain continuity of the Services, we may make the replacement with shorter notice. We will notify you as soon as reasonably possible, and your right to object under clause 7.3 will apply.

7.5 We will impose on each Sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA, in particular providing sufficient guarantees of appropriate technical and organisational measures. We remain fully liable to you for the performance of each Sub-processor’s obligations.

7.6 Communications Providers are not our Sub-processors. In conveying a message or call, a Communications Provider acts as a mere conduit: it does not initiate the transmission, select the recipient, or select or modify the content, and it does not store the message or call content except transiently for the sole purpose of carrying out the transmission. When conveying a message or call, each Communications Provider acts as a provider of electronic communications services in its own right: it transmits the communication over its network or interconnections and, in doing so, is bound by the confidentiality of communications and the other obligations imposed on it by the electronic communications laws of its jurisdiction (including, where it is established in the EEA, the national laws implementing the ePrivacy Directive). It processes message and call content only to convey the communication, and it processes the traffic data it generates as a controller for its own purposes, such as billing, network security and compliance with its legal obligations. The conveyance of messages and calls through Communications Providers is inherent in the Services you instruct us to provide. Clauses 7.1 to 7.5 therefore do not apply to Communications Providers.

7.7 Any provider that performs services for us beyond conveying messages or calls (for example, storing message content or call recordings, carrying out number lookups, filtering, transcribing or otherwise processing message or call content on our behalf, or delivering messages through an over-the-top messaging channel such as WhatsApp, Viber, Telegram or Google RCS) is a Sub-processor in respect of those services, and clauses 7.1 to 7.5 apply to it.

7.8 On request, we will identify the Communications Provider that delivered the messages sent to, or connected the calls made to or from, a specific recipient or number, to the extent that information is available to us, so that you can respond to a request from that recipient.

7.9 We select Communications Providers with care and require them, by contract, to keep communications confidential, to apply appropriate security measures, and to use the data they receive only to convey and bill for messages and calls, to prevent fraud and misuse, and to comply with their legal obligations.

8. International transfers

8.1 We will transfer Customer Personal Data outside the European Economic Area (“EEA”) only in compliance with Chapter V GDPR, relying on an adequacy decision of the European Commission or, where none applies, on the SCCs (Module 3, processor to processor) with the relevant Sub-processor, supplemented by additional measures where our transfer impact assessment requires them.

8.2 Where you instruct us to deliver a message to, or connect a call to or from, a number in a country outside the EEA, you acknowledge that the message or call and associated data must be conveyed to Communications Providers in or serving that country in order to be delivered or connected. Such transmission is made on your instruction and is inherent in the delivery of the message or call.

8.3 Where you are established outside the EEA and not subject to the GDPR, Module 4 (processor to controller) of the SCCs is incorporated into this DPA by reference, with Intergo Telecom as data exporter and you as data importer, and with the options set out in Annex 1.

9. Personal Data Breaches

9.1 We will notify you without undue delay, and in any event within twenty four (24) hours after becoming aware of a Personal Data Breach. We will notify the primary contact address on your account.

9.2 Our notification will include, to the extent available, the information required by Article 33(3) GDPR. Where the information is not available at the same time, we will provide it in phases without undue further delay.

9.3 We will take reasonable steps to contain, investigate and mitigate the Personal Data Breach, and will co-operate with you so that you can meet your obligations under Articles 33 and 34 GDPR. You decide whether to notify supervisory authorities or data subjects in your capacity as controller. This does not restrict our own notification obligations under laws that apply to us directly, including network and information security and electronic communications laws.

9.4 Our notification of a Personal Data Breach is not an acknowledgement of fault or liability.

10. Assistance

10.1 If we receive a request from a data subject relating to Customer Personal Data, we will forward it to you without undue delay and will not respond to it ourselves except to direct the data subject to you, unless you instruct us otherwise or the law requires it.

10.2 Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to enable you to respond to data subject requests, meet your security obligations, and carry out data protection impact assessments and prior consultations with supervisory authorities. Where available, you will first use the self-service features of the Services (including export and deletion functions). We may charge reasonable costs for assistance that goes beyond those features and our obligations under Data Protection Laws.

11. Requests from public authorities

11.1 If we receive a request from a court, law enforcement agency or other public authority for access to Customer Personal Data, we will notify you promptly unless the law prohibits this. We will review the legality of the request, including against Article 48 GDPR in the case of requests from authorities outside the EU. We will challenge the request where we consider there are reasonable grounds to do so, and we will disclose only the minimum data required.

12. Audits

12.1 We will make available to you, on written request, the information reasonably necessary to demonstrate our compliance with Article 28 GDPR. This includes a summary of our security measures and any relevant certifications or independent audit reports we hold, which you will treat as our confidential information.

12.2 If that information is insufficient to demonstrate compliance, if a supervisory authority requires it, or following a Personal Data Breach, you (or an independent auditor bound by confidentiality and reasonably acceptable to us) may carry out an audit or inspection. Audits require at least thirty (30) days’ written notice (except following a Personal Data Breach or where a supervisory authority requires otherwise), may take place no more than once in any twelve-month period, and must be conducted during normal business hours in a way that minimises disruption to our business and does not compromise the security or confidentiality of other customers’ data.

12.3 You will bear the costs of an audit under clause 12.2, unless it reveals a material breach of this DPA by us, in which case we will bear our own costs and reimburse your reasonable audit costs.

13. Deletion and return

13.1 During the term of the Agreement, you may delete Customer Personal Data through the Services. Message logs, call records, call recordings, transcripts and delivery records are retained in your account according to our Retention Policy and your configuration, unless you delete them earlier.

13.2 You may export Customer Personal Data using the export functions of the Services at any time before termination. Within thirty (30) days after termination of the Agreement, we will delete all Customer Personal Data, unless Union or Member State law requires us to store it. In that case, we will inform you of the data retained, the legal basis and the retention period, will keep it confidential, and will process it only as that law requires.

13.3 Customer Personal Data held in back-up systems will be isolated from further processing and deleted when the back-ups are overwritten in our ordinary back-up cycle, and in any event within 90 days after termination.

13.4 On written request, we will confirm in writing that deletion has taken place.

14. Liability

14.1 Our liability under or in connection with this DPA is subject to the exclusions and limitations of liability in clause 15 of the Agreement, save as set out in clause 14.2. The aggregate cap in clause 15.3 of the Agreement applies to all claims under the Agreement and this DPA taken together.

14.2 The exclusion in clause 15.2(c) of the Agreement for loss or corruption of data and for unauthorised access to or alteration of data shall not apply to losses directly caused by our breach of clause 6 of this DPA, which remain subject to the aggregate cap in clause 15.3 of the Agreement.

14.3 Nothing in this DPA limits either party’s liability to data subjects under Article 82 GDPR, or any liability that cannot be limited or excluded under applicable law.

15. Term, changes and precedence

15.1 This DPA remains in force for as long as the Agreement is in force and, after that, for as long as we process any Customer Personal Data.

15.2 We may update this DPA to reflect changes in Data Protection Laws, guidance or decisions of supervisory authorities or courts, or changes to the Services, provided that the update does not materially reduce the protection of Customer Personal Data. We will give you at least thirty (30) days’ notice of any material update by email to the primary contact address on your account. Changes to Sub-processors are governed by clause 7.

15.3 In the event of conflict: (a) this DPA prevails over the Agreement in relation to the processing of Customer Personal Data; (b) the SCCs, where they apply, prevail over this DPA; and (c) a data processing agreement signed by both you and Intergo Telecom prevails over this DPA.

16. Governing law and jurisdiction

16.1 This DPA is governed by the laws of the Republic of Cyprus. The courts of Paphos, Cyprus have exclusive jurisdiction over any dispute arising out of or in connection with it, without prejudice to the rights of data subjects or supervisory authorities under Data Protection Laws. Where the SCCs apply, their governing law and forum provisions prevail.

Annex 1 – Description of the processing

Annex 2 – Technical and organisational measures

Annex 3 – Sub-processors

This Annex lists the Sub-processors we engage to process Customer Personal Data on your behalf. Any intended addition or replacement is notified in accordance with clause 7.2 of the DPA.

Part A – Sub-processors

Part B – Providers that are not Sub-processors