Data Processing Addendum.
GDPR Article 28 & DPDP compliance.
Effective Date: September 1, 2026 • Governs all automated customer call data processing.
1. Scope and Roles
This Data Processing Addendum ("DPA") forms part of the Master Services Agreement between Answrable Inc. ("Processor") and the Customer ("Controller"). It applies to the processing of personal data included in customer call audio, phone numbers, transcripts, and metadata.
2. Processing Instructions & Compliance
Processor agrees to process Customer Personal Data only on documented instructions from Customer, including with respect to transfers of personal data outside the jurisdiction. Processor complies with GDPR (EU 2016/679), UK GDPR, and the Digital Personal Data Protection (DPDP) Act of India.
3. Confidentiality & Security Measures
Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including FIPS 140-2 validated encryption, strict employee confidentiality obligations, and annual SOC 2 Type II audit verifications.
4. Subprocessors
Customer provides general authorization for Processor to engage Subprocessors (such as cloud host infrastructure, speech recognition engines, and telephony gateways). A full list of authorized subprocessors is available at /subprocessors.
5. Data Subject Rights & Breach Notification
Processor will assist Controller in fulfilling data subject rights requests (access, rectification, deletion). In the event of a confirmed Security Incident involving Customer Personal Data, Processor will notify Controller without undue delay within 48 hours.