Data Processing Addendum

Last Updated: 31-03-2026

This Data Processing Addendum (“DPA”) forms part of the Master Services Agreement (“Agreement”) between Demand Connect (“Processor”) and the Customer (“Controller”).

This DPA applies where Demand Connect processes Personal Data on behalf of the Customer.

• “Controller” means the entity determining purposes and means of processing
• “Processor” means the entity processing data on behalf of Controller
• “Personal Data” means any information relating to an identifiable individual
• “Processing” means any operation performed on Personal Data
• “Sub-processor” means any third party engaged by Processor

Applicable laws include:

• GDPR (EU 2016/679)
• UK Data Protection Act 2018
• Any applicable privacy regulations

• Customer acts as the Data Controller
• Demand Connect acts as the Data Processor

Processor processes Personal Data solely on behalf of Controller.

Subject Matter

Provision of:

• Cloud dialing services
• SMS/MMS messaging
• AI-based analytics and transcription

Categories of Data Subjects

• Customers
• Leads / prospects
• Employees
• Business contacts

Categories of Personal Data

• Names and identifiers
• Phone numbers and email addresses
• Call metadata (timestamps, duration)
• Audio recordings and voicemails
• AI-generated transcripts and summaries

Duration

Processing continues for the duration of the Agreement unless otherwise required by law.

Processor shall:

• Process data only on documented instructions from Controller
• Not use data for its own purposes

Controller warrants:

• It has lawful basis (e.g., consent or legitimate interest)
• Data collection complies with applicable laws

Controller authorizes Processor to engage sub-processors including:

• Cloud infrastructure providers
• Telecom carriers
• AI/ML service providers

Processor obligations:

• Maintain updated sub-processor list
• Ensure equivalent data protection obligations
• Notify Controller of changes

Processor implements appropriate technical and organizational measures, including:

• Encryption in transit (TLS 1.3)
• Encryption at rest (AES-256)
• Role-based access control (RBAC)
• Audit logs and monitoring
• Secure data isolation per tenant

Processor shall assist Controller in responding to requests such as:

• Access
• Rectification
• Erasure (Right to be Forgotten)
• Data portability
• Restriction of processing

Processor will:

• Notify Controller of requests
• Not respond directly unless authorized

In case of a breach:

• Processor will notify Controller without undue delay
• Notification will occur within 48 hours where feasible
• Processor will provide:
• Nature of breach
• Affected data categories
• Mitigation steps

Upon termination:

• Data will be deleted or returned at Controller’s request
• Copies will be securely erased unless required by law

Where data is transferred outside the EEA/UK:

• Standard Contractual Clauses (SCCs) will apply
• Adequate safeguards will be ensured

Strict Data Protection Policy:

• Customer data is NOT used to train AI models
• No data is used for public or shared model training
• Processing is limited to:
• Transcription
• Analysis
• Feature delivery

All processing occurs in secure environments.

Processor ensures:

• All personnel are bound by confidentiality obligations
• Access to data is limited to authorized personnel

Controller may:

• Request information regarding compliance
• Conduct audits (subject to reasonable notice)

Processor may:

• Provide third-party certifications instead of direct audits

Liability is governed by the main Agreement.

Processor is not responsible for:

• Data unlawfully collected by Controller
• Non-compliance with consent or telemarketing laws

This DPA shall be governed by:

[Insert Jurisdiction – Recommended: Delaware, USA or Ireland for GDPR-heavy clients]

For data protection inquiries:

📧 Email: [Insert Email]

Nature of Processing

• Collection
• Storage
• Analysis
• Transmission

Purpose

• Communication services
• Campaign execution
• AI analytics

• Encryption (TLS 1.3, AES-256)
• Access control policies
• Logging and monitoring
• Incident response procedures
• Regular security audits