Data processing agreement

Redialler is operated by Ryan Erkal, a sole trader trading as Redialler, under the law of England and Wales.

This agreement is between the customer who holds a Redialler account (the customer) and Redialler (Redialler). It forms part of the Terms of Service.

For the personal data of the people you call and the people in your CRM, the customer is the controller and Redialler is the processor. Redialler processes that data only on the customer's instructions.

The subject matter is the personal data Redialler handles to place calls, record and transcribe them where enabled, and save results to the customer's CRM. It also includes the business and representative details supplied for calling-provider verification.

Processing lasts for as long as the customer has an active account, plus the deletion period in section 10.

Redialler reads contact details from the customer's CRM, places calls through Redialler's voice carrier, logs call events, records and transcribes calls where the customer has enabled it, produces notes from transcripts, and writes outcomes, notes, recordings, and tasks back to the CRM.

The purpose is to let the customer's team make and log outbound calls and to review the details supplied for calling-provider verification. Required business and representative details can be shared with the calling provider under the authority confirmed during signup. Saving the details does not itself submit a carrier application or establish approval.

Data subjects: the customer's staff who use Redialler; the contacts, leads, and customers the customer calls; people who call the customer's Redialler numbers; and the authorised representatives whose details the customer submits for calling-provider verification.

Data: names, phone numbers, email addresses, company names, job titles, CRM notes, call times and outcomes, call audio where recording is enabled, transcripts, and generated notes. It also includes leads the customer adds by import, through the lead API, or from integrations; consent evidence, including consent wording, page URL, IP address, and proof reference; do-not-call lists; and inbound voicemails. Business verification data includes legal business name, business type, website, registration details where applicable, business address, authorised representative contact details, and intended calling use.

Instructions: Redialler processes personal data only on the customer's documented instructions, which include the Terms, this agreement, and the settings the customer chooses in the product. Redialler will tell the customer if it believes an instruction breaks data protection law.

Confidentiality: everyone at Redialler who can access personal data is bound by a duty of confidentiality.

Security: Redialler applies the measures in section 8.

Sub-processors: Redialler uses only the sub-processors in section 6. Redialler will give notice before adding or replacing one, and the customer may object.

Assistance: Redialler will help the customer respond to data subject requests, carry out impact assessments, and deal with regulators, to the extent Redialler can.

Deletion: Redialler deletes or returns personal data as set out in section 10.

Audit: Redialler will provide the information a customer reasonably needs to show compliance, and will allow audits by the customer or an auditor the customer appoints, on reasonable notice and no more than once a year unless a regulator requires it.

Telnyx and Twilio: voice carriers that carry calls, provide phone numbers, and hold recordings while they are being processed. The carrier can also receive the business and representative information required for calling verification.

Stripe: payments and invoices for the customer's subscription and credit.

Attio: the customer's CRM. Holds contacts, notes, outcomes, and saved recordings and transcripts.

Clerk: sign-in and user accounts for the customer's staff.

OpenRouter: transcribes call audio and produces cleaned-up notes from transcripts.

Convex: stores runtime state such as queues, sessions, call logs, and number pool state.

Vercel: hosts the application.

Sentry: error monitoring for the application.

Google Analytics: optional public website analytics, after visitor consent.

Integrations the customer turns on: when an admin connects a tool, Redialler sends or receives the data that tool needs. Outcome events carry the outcome, contact name, company, phone number, call duration, callback time, and record IDs, and never recordings, transcripts, or notes. These tools act on the customer's instructions under the customer's own terms with them. They are not Redialler sub-processors.

Some sub-processors operate in the United States. Where personal data protected by UK or EU law is transferred outside the UK or EEA, Redialler relies on standard contractual clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, as required.

All data in transit is encrypted with TLS. CRM and carrier credentials are encrypted at rest. Business verification submissions are also encrypted in runtime storage and bound to the customer's workspace. Access to production systems is limited to named staff.

Redialler keeps recordings and transcripts for playback and operations. Scheduled cleanup normally removes call logs, recordings, and transcripts after 180 days. Calls still waiting for a verified CRM copy or for processing to finish can remain for up to 360 days before cleanup under the default settings. Authorised workspace administrators can change retention periods. A workspace legal hold pauses scheduled cleanup until it is released. The copy saved to the customer's CRM is under the customer's control. Reps see only their own queues and calls unless the customer gives them wider access.

Redialler reviews these measures as the product changes and will not reduce the overall level of protection during the term.

If Redialler becomes aware of a personal data breach affecting the customer's data, Redialler will tell the customer without undue delay, and in any case within 72 hours of becoming aware.

The notice will describe what happened, the data and people likely affected, the likely consequences, and the steps taken or proposed. Redialler will give further details as they become known.

When the customer closes its account, or asks in writing, Redialler deletes all personal data it holds for the customer within 30 days, unless law requires Redialler to keep it.

Before deletion, the customer can export call logs from the product and ask support about any remaining data. Copies of recordings, transcripts and notes already saved in the customer's CRM are not affected by deletion from Redialler. The retention periods in the Privacy Policy apply while the account is active. They do not extend the 30-day deletion period, except where law requires Redialler to keep data.

Each party's liability under this agreement is subject to the limits in the Terms of Service.

If this agreement and the Terms conflict on a data protection matter, this agreement prevails. On every other matter, the Terms prevail.

This agreement is governed by the law of England and Wales.

For anything about this agreement, data subject requests, or to ask for a signed copy, email hello@redialler.com with the subject Data processing.