DialLink Data Processing Addendum

Version 2.0 · Effective November 2, 2026 · Previous versions: Legal Archive

This Data Processing Addendum (the "DPA") forms part of the DialLink Terms of Service or other agreement governing the Services (the "Agreement") between DialLink Corp., 1688 Meridian Ave, Suite 700, Miami Beach, FL 33139, United States ("DialLink") and the customer that accepted the Agreement ("Customer"). It applies whenever DialLink processes Customer Personal Data on Customer's behalf. It applies automatically; no signature is required. Customers who need a countersigned copy for their records may request one from legal@diallink.com, and DialLink will return a signed PDF of this version. In the event of a conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA prevails; the Standard Contractual Clauses prevail over this DPA for the transfers they govern.

1. Definitions

• "Customer Personal Data" means Personal Data contained in Customer Data that DialLink processes on Customer's behalf under the Agreement.
• "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Agreement, including (as applicable) the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as incorporated into United Kingdom law ("UK GDPR") and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), the other U.S. State Privacy Laws, and 47 U.S.C. § 222.
• "U.S. State Privacy Laws" means the comprehensive consumer privacy laws of U.S. states that apply to the processing of Customer Personal Data, including those of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Nebraska, Maryland, Minnesota, Kentucky and Rhode Island.
• "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meanings given in the GDPR; "Business", "Service Provider", "Consumer", "Sell", "Share" and "Personal Information" have the meanings given in the CCPA; equivalent terms in other Data Protection Laws (for example "Controller" and "Processor" under U.S. State Privacy Laws) are read accordingly.
• "EEA" means the European Economic Area.
• "Restricted Transfer" means a transfer of Customer Personal Data that would be prohibited by the GDPR, the UK GDPR or the FADP in the absence of an appropriate transfer mechanism.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, in force 21 March 2022.
• "Sub-processor" means any third party engaged by DialLink to process Customer Personal Data on DialLink's behalf.
• Other capitalized terms have the meanings given in the Agreement.

2. Scope, Roles and Instructions

2.1 Roles. For Customer Personal Data, Customer is the Controller (or Business) — or, where Customer processes Personal Data on behalf of its own clients, a Processor acting on their behalf — and DialLink is the Processor (or Service Provider). DialLink is an independent Controller of Account Data and Usage Data (including call detail records and other CPNI, which DialLink uses only as 47 U.S.C. § 222 and the Privacy Policy permit) for the purposes of billing, network operation, fraud prevention and legal compliance, as described in the Agreement and the Privacy Policy; those data are not Customer Personal Data. The same records as displayed in Customer's Account (call logs and contacts) are processed on Customer's behalf as Customer Data.

2.2 Details of processing. The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are described in Annex I.

2.3 Customer's instructions. DialLink will process Customer Personal Data only on Customer's documented instructions, which consist of: (a) the Agreement, including this DPA; (b) Customer's and its Users' configuration and use of the Services, including AI Agent instructions, recording and AI settings; and (c) other written instructions agreed between the parties. DialLink will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the instruction until it is clarified. DialLink may process Customer Personal Data where required by law to which DialLink is subject; in that case DialLink will inform Customer of the requirement before processing unless the law prohibits it.

2.4 Customer's responsibilities. Customer is responsible for: (a) establishing a lawful basis for the processing, including obtaining consents and providing notices to Users and Callers for call recording, transcription, AI processing and messaging; (b) the accuracy, quality and legality of Customer Personal Data and the means by which it was obtained; (c) responding to Data Subjects and Supervisory Authorities; (d) configuring the Services (including recording, access and AI settings) appropriately and deleting Customer Personal Data it no longer needs; (e) not submitting protected health information (DialLink does not currently offer a Business Associate Agreement; see Section 10.9 of the Terms of Service), not configuring AI Agents to collect payment card data unless and until DialLink documents a payment flow as supported, pausing recording (using the pause control in the Services) where Users take payment card data on recorded calls, and not submitting children's data without required consents; and (f) where Customer acts as a Processor for its own clients, ensuring that it has the authority to appoint DialLink as a Sub-processor and to give the instructions in this DPA.

3. DialLink's Obligations

3.1 Confidentiality. DialLink ensures that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations, and limits access to those who need it to perform their duties.

3.2 Security. DialLink implements and maintains the technical and organizational measures described in Annex II, which are designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature of the processing. The Security Overview published at diallink.com/security is for information only; Annex II is the binding description of DialLink's measures. DialLink may update those measures provided the update does not materially reduce the overall level of protection.

3.3 Assistance. Taking into account the nature of the processing and the information available to it, DialLink will assist Customer, by appropriate technical and organizational measures and at Customer's reasonable request, in (a) responding to Data Subject requests (Section 5); (b) meeting its obligations regarding security, Personal Data Breaches, data protection impact assessments and prior consultation with Supervisory Authorities; and (c) demonstrating compliance with Data Protection Laws. DialLink may charge reasonable fees for assistance that goes beyond the self-service tools and standard documentation it provides.

3.4 Records and cooperation. DialLink maintains records of its processing activities as required by Data Protection Laws and will cooperate with Supervisory Authorities in the performance of their tasks.

4. Sub-processors

4.1 Authorization. Customer gives DialLink general authorization to engage Sub-processors to process Customer Personal Data, subject to this Section. DialLink's current Sub-processors, their locations and functions are listed at diallink.com/sub-processors (the "Sub-processor List"). Customer acknowledges that DialLink's hosting, telecommunications carrier, messaging, speech and language model, email delivery, support and monitoring providers listed there are Sub-processors.

4.2 Notice of changes. Before a new Sub-processor processes Customer Personal Data, DialLink will update the Sub-processor List and notify Administrators by email, or by notice in the Services, at least 30 days in advance. Customers may subscribe to change notifications on the Sub-processor List page. Where a Sub-processor must be replaced urgently for security, availability or legal reasons, DialLink will notify Customer without undue delay after the replacement.

4.3 Objection. Customer may object to a new Sub-processor on reasonable, documented data protection grounds by emailing privacy@diallink.com within 30 days after the notice. The parties will discuss the objection in good faith; DialLink may propose a change to the Services or a reasonable alternative. If no solution is found within 30 days after the objection, Customer may terminate the affected Services on written notice, and DialLink will refund prepaid Fees for the terminated Services for the remainder of the Subscription Term.

4.4 Flow-down and liability. DialLink will impose on each Sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA, to the extent applicable to the services the Sub-processor provides, and will remain liable to Customer for the performance of the Sub-processor's obligations.

5. Data Subject Rights

If DialLink receives a request from a Data Subject relating to Customer Personal Data, DialLink will not respond substantively except to refer the Data Subject to Customer, unless the law requires otherwise, and will notify Customer of the request without undue delay where the Customer can be identified. DialLink provides tools within the Services and the API that allow Customer to access, correct and delete Customer Personal Data and to download recordings and voicemails and, where a request cannot be completed with those tools (including a request for a copy of Customer Personal Data), will carry it out on request; DialLink will provide reasonable additional assistance on request.

6. Personal Data Breach

6.1 Notification. DialLink will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, except where and for so long as notification is prohibited or delayed by law or by a law-enforcement agency (including under the FCC's CPNI breach rules, 47 C.F.R. § 64.2011), in which case DialLink will notify Customer as soon as the law permits. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach, and a contact point; DialLink may provide information in phases as it becomes available.

6.2 Cooperation. DialLink will take reasonable steps to contain, investigate and mitigate the breach and will cooperate with Customer's reasonable requests for information. Customer is responsible for notifying Supervisory Authorities and Data Subjects where Data Protection Laws require, except where the law requires DialLink to do so (for example under the FCC's CPNI breach rules or state breach laws applicable to DialLink). DialLink's notification of, or response to, a Personal Data Breach is not an acknowledgment of fault or liability.

7. Return and Deletion

During the Subscription Term, Customer may delete Customer Personal Data through the Services and the API and may obtain a copy of it as described in Section 10.6 of the Terms of Service. After termination, DialLink retains Customer Personal Data so that Customer can reactivate the Account or obtain that copy (on written request within 30 days after termination), and deletes Customer Personal Data from its production systems within 30 days after Customer's written instruction to delete it, or immediately when Customer deletes the Account; backup copies expire within 30 days after deletion from production. Data Protection Laws or other laws may require DialLink to retain certain data, in which case DialLink will protect the retained data under this DPA and process it only for the purpose that requires retention. On written request, DialLink will confirm deletion in writing.

8. Audits

8.1 Information. On request, no more than once in any 12-month period (unless a Personal Data Breach affecting Customer Personal Data has occurred or a Supervisory Authority requires it), DialLink will make available information reasonably necessary to demonstrate compliance with this DPA, including responses to a reasonable security questionnaire, summaries of penetration test results, and, where DialLink holds one, its most recent independent audit report (for example a SOC 2 report), subject to confidentiality.

8.2 On-site audit. If the information provided under Section 8.1 is not sufficient to demonstrate compliance, or where a Supervisory Authority requires it, Customer (or an independent auditor it appoints that is not a competitor of DialLink and is bound by confidentiality) may conduct an audit of DialLink's processing of Customer Personal Data, on at least 30 days' written notice, during business hours, no more than once in any 12-month period, in a manner that does not unreasonably disrupt DialLink's operations and does not include access to other customers' data or to Sub-processor facilities. Customer bears the costs of the audit and will reimburse DialLink's reasonable costs of assisting with it. The parties will agree the scope and timing in advance. Customer will provide DialLink with a copy of the audit findings.

9. International Transfers

9.1 Location. DialLink processes Customer Personal Data in the United States and in the locations of its Sub-processors listed on the Sub-processor List.

9.2 EEA transfers. Where the GDPR applies to Customer's processing and Customer's use of the Services involves a Restricted Transfer to DialLink, the parties enter into the SCCs, which are incorporated by reference into this DPA and completed as follows:

• Module Two (controller to processor) applies where Customer is a Controller; Module Three (processor to processor) applies where Customer is a Processor acting for its own clients. Customer is the "data exporter" and DialLink is the "data importer".
• Clause 7 (docking clause) applies.
• Clause 9(a): Option 2 (general written authorization) applies, with the notice period in Section 4.2 of this DPA.
• Clause 11(a): the optional language is not included.
• Clause 13: the Supervisory Authority is determined in accordance with Clause 13 and Annex I.C: where the data exporter is established in an EU Member State, the authority of that Member State; where it is not established in a Member State but has appointed a representative under Article 27 GDPR, the authority of the Member State in which the representative is established; otherwise, the authority of one of the Member States in which the Data Subjects are located.
• Clause 17: Option 1 applies; the SCCs are governed by the law of Ireland.
• Clause 18(b): disputes are resolved before the courts of Ireland.
• Annex I of the SCCs is completed by Annex I of this DPA; Annex II of the SCCs is completed by Annex II of this DPA; Annex III of the SCCs is the Sub-processor List.
• Where the SCCs conflict with this DPA, the SCCs prevail.

9.3 UK transfers. Where the UK GDPR applies and Customer's use of the Services involves a Restricted Transfer to DialLink, the SCCs as completed in Section 9.2 apply as amended by the UK Addendum, which is incorporated by reference and completed as follows: Table 1 (parties) and Table 3 (appendix information) are completed with the information in Annex I, Annex II and the Sub-processor List; Table 2 refers to the SCCs as completed in Section 9.2; in Table 4, both the importer and the exporter may end the UK Addendum as set out in its Section 19.

9.4 Swiss transfers. Where the FADP applies, the SCCs as completed in Section 9.2 apply with the following adaptations: references to the GDPR are read as references to the FADP; the competent Supervisory Authority under Clause 13 is the Swiss Federal Data Protection and Information Commissioner; and the term "Member State" is interpreted so as not to exclude Data Subjects in Switzerland from the possibility of suing for their rights in Switzerland under Clause 18(c).

9.5 Other transfer mechanisms. If the European Commission, the UK Information Commissioner or the Swiss authorities adopt a replacement transfer mechanism, or if DialLink becomes certified under an adequacy framework such as the EU-U.S. Data Privacy Framework, DialLink may notify Customer that transfers will rely on that mechanism, and the parties will cooperate in good faith to implement it. Until then the mechanisms in Sections 9.2 to 9.4 apply.

9.6 Government access requests. DialLink will notify Customer of any legally binding request for access to Customer Personal Data by a public authority, unless prohibited by law; will review the legality of the request and challenge it where there are reasonable grounds; will disclose only the minimum amount of data required; and will document its handling of the request. DialLink has implemented the measures in Annex II, including encryption, to protect Customer Personal Data in transit and at rest, maintains a transfer impact assessment for the transfers covered by this DPA, and will provide a summary of it to Customer on request.

10. U.S. State Privacy Law Addendum

This Section applies to the extent the CCPA or another U.S. State Privacy Law applies to Customer Personal Data, and the terms "Business", "Service Provider", "Consumer", "Sell", "Share" and "Personal Information" have the meanings given in the CCPA (and the equivalent terms under other U.S. State Privacy Laws).

10.1 Service Provider and Processor. DialLink is a Service Provider (CCPA) and a Processor (other U.S. State Privacy Laws) with respect to Customer Personal Data. Customer discloses Customer Personal Data to DialLink only for the limited and specified business purposes described in Annex I and the Agreement.

10.2 DialLink's obligations. DialLink will: (a) not Sell or Share Customer Personal Data; (b) not retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement, including for any commercial purpose other than providing the Services, or outside the direct business relationship between DialLink and Customer; (c) not combine Customer Personal Data with Personal Information it receives from other sources, except as permitted by the CCPA and its regulations (for example to detect security incidents or protect against fraud); (d) comply with the Data Protection Laws applicable to it and provide the same level of privacy protection as the CCPA requires of Businesses; (e) notify Customer within 10 business days if it determines that it can no longer meet its obligations under the CCPA; (f) grant Customer the right, upon reasonable notice, to take reasonable and appropriate steps to ensure that DialLink uses Customer Personal Data consistently with Customer's obligations under the CCPA, and to stop and remediate unauthorized use, including through the audit rights in Section 8; (g) engage Sub-processors only under written contracts that impose the obligations in this Section 10; (h) implement reasonable security procedures and practices appropriate to the nature of the Personal Information; (i) assist Customer in responding to Consumer requests as provided in Section 5; and (j) comply with Customer's instructions regarding the deletion of Customer Personal Data in accordance with Section 7. DialLink certifies that it understands the restrictions in this Section and will comply with them.

10.3 De-identified data. If DialLink creates de-identified data from Customer Personal Data, it will take reasonable measures to ensure the data cannot be associated with an individual, publicly commit to maintain and use the data only in de-identified form and not attempt to re-identify it, and contractually obligate any recipient to do the same.

10.4 Customer's obligations. Customer will comply with the CCPA and other U.S. State Privacy Laws, including providing notices at collection, honoring Consumer rights, and not instructing DialLink to process Customer Personal Data in a way that would violate those laws.

11. Liability

Each party's liability arising out of or relating to this DPA, including the SCCs and the UK Addendum, is subject to the exclusions and limitations of liability in the Agreement, and the parties' aggregate liability under the Agreement and this DPA is as set out there. Nothing in this Section limits the rights of Data Subjects under the SCCs or Data Protection Laws, or any liability that cannot be limited by law.

12. General

12.1 Term. This DPA applies for as long as DialLink processes Customer Personal Data on Customer's behalf and survives termination of the Agreement for that period.

12.2 Changes. DialLink may update this DPA in accordance with the Agreement where required by Data Protection Laws or a change in the Services, provided the update does not materially reduce the protection of Customer Personal Data; DialLink will give notice of material updates as provided in the Agreement.

12.3 Governing law. This DPA is governed by the law governing the Agreement, except that the SCCs and the UK Addendum are governed by the law stated in them.

12.4 Severability. If a provision of this DPA is held invalid, the remaining provisions remain in effect and the parties will replace the invalid provision with a valid one that achieves the same purpose as closely as possible.

12.5 Contact. Privacy matters: privacy@diallink.com. Countersigned copies and legal notices: legal@diallink.com.

---

Annex I — Details of the Processing

A. List of parties

• Data exporter / Controller (or Processor): Customer, as identified in the Account and the Agreement. Contact: the Administrator's email address on the Account. Role: Controller (Module Two) or Processor (Module Three).
• Data importer / Processor: DialLink Corp., 1688 Meridian Ave, Suite 700, Miami Beach, FL 33139, United States. Contact: privacy@diallink.com. Role: Processor.

B. Description of the processing

• Categories of Data Subjects: Customer's Users (employees, contractors and agents) and Callers (customers, prospects, clients, suppliers and other persons who call, message or interact with Customer or its AI Agents, or whom Customer calls or messages).
• Categories of Personal Data: names, phone numbers, email addresses and other contact details; call audio and recordings; voicemails; transcripts, summaries and AI-generated analysis; SMS, MMS and WhatsApp message content; contact list and CRM data synchronized by Customer; AI Agent instructions, knowledge content, conversation logs and outputs; metadata embedded in recordings, transcripts and messages and the call logs and contacts displayed in Customer's Account; data from third-party systems connected by Customer; and any other Personal Data that Customer or Callers submit through the Services.
• Special categories of data: Not intentionally processed. Customer Personal Data may incidentally contain special categories of data (for example health information mentioned by a Caller) that Customer chooses to process; protected health information regulated by HIPAA may be processed only under a Business Associate Agreement. DialLink applies the measures in Annex II to all Customer Personal Data.
• Frequency of the transfer: Continuous, for the duration of the Agreement.
• Nature of the processing: Hosting, storage, transmission, routing, recording, transcription, analysis and generation of outputs through AI Features at Customer's direction, display, export, deletion, backup and related support.
• Purpose: Provision of the Services to Customer in accordance with the Agreement, including cloud telephony, messaging, call recording and transcription, AI Features and integrations configured by Customer.
• Duration: The Subscription Term plus the retention period in Section 7.
• Transfers to Sub-processors: As described on the Sub-processor List, for the functions, locations and retention periods stated there, and for the duration of this DPA unless a shorter period is stated.

C. Competent Supervisory Authority: Determined in accordance with Section 9.2 (Clause 13).

Annex II — Technical and Organizational Measures

DialLink maintains the following measures, which it may update from time to time in accordance with Section 3.2. The Security Overview provides further detail.

1. Hosting and physical security. The Services are hosted on Amazon Web Services infrastructure in the United States, in data centers with physical access controls, environmental protections and certifications maintained by the hosting provider (including SOC 2 and ISO 27001).
2. Encryption. Data exchanged between the web, desktop and mobile applications, the APIs, the websites and DialLink's platform is encrypted in transit using TLS 1.2 or higher. Customer Personal Data is encrypted at rest — including databases, stored recordings, voicemails, transcripts and database backups — using AES-256 server-side encryption managed by the hosting provider.
3. Access control. Access to production systems and Customer Personal Data is restricted to named engineering and support personnel on a need-to-know basis, granted through individual credentials and role-based access, with direct infrastructure access only through a private network connection, and revoked promptly on role change or departure.
4. Customer-side controls. Customers control User roles (Owner, Administrator and User) and Users' access to recordings, transcripts and call records; sign-in with Google, Microsoft or Apple accounts; a verification code sent by text message when a User signs in from a new location; recording settings and the ability to pause or stop recording during a call; and deletion of Customer Personal Data through the Services and the API.
5. Logging and monitoring. Activity on production systems is logged centrally; logs are retained for periods between 7 days and 12 months depending on the type of log; automated alerts on errors and unusual charges are sent to the engineering team and investigated.
6. Vulnerability and change management. Systems are patched in the ordinary course; code changes are reviewed and tested before deployment; dependencies, code and infrastructure are scanned for vulnerabilities with automated tools, and findings are remediated according to severity.
7. Network security. Production networks are segmented, protected by firewalls and security groups, and exposed to the internet only through hardened endpoints; administrative access is through secured channels.
8. Resilience and backups. Databases are backed up automatically every day, with point-in-time recovery for 30 days, to encrypted storage within the same region; stored media (recordings and voicemails) is kept in durable object storage that the hosting provider replicates across availability zones; the platform runs across multiple availability zones with redundant components; a disaster recovery plan is maintained.
9. Incident response. DialLink maintains an incident response plan covering detection, severity classification, containment, escalation and post-incident review, and gives the notifications required by Section 6 and by the FCC's rules.
10. Personnel. Personnel with access to Customer Personal Data are subject to written confidentiality obligations; access by engineering and support contractors is governed by written agreements and the same controls.
11. Sub-processor management. Sub-processors are engaged under written terms that include data protection obligations, are listed on the Sub-processor List with their function, location and retention, and are notified as Section 4 provides; AI model providers are used under terms that exclude training on Customer Personal Data.
12. Data segregation and deletion. Customer Personal Data is logically segregated by Account; deletion follows Section 7 and uses secure deletion practices for storage media retired by the hosting provider.
13. Secure development. Development follows code review and separation of development, test and production environments; production data is not copied to development or test environments.
14. Assistance measures. Deletion and correction tools in the Services and the API, individual download of recordings and voicemails, copies of Customer Personal Data on request, and documentation are provided to help Customer meet Data Subject requests and accountability obligations.

Annex III — Sub-processors

The Sub-processor List at diallink.com/sub-processors, as updated in accordance with Section 4.