Data Processing Agreement (DPA)

The Data Controller ("Controller" or "Customer") is the property or business that subscribes to the service, as identified in the account and billing details. The Data Processor ("Processor") is DENTOKU DEV, Via Bullona 8, 20154 Milano, IT, VAT 13625480960, info@kallmy.com.

1. The Controller uses the kallmy service ("Service") to have an AI-based assistant answer its property's phone calls. With this agreement it entrusts the Processor with the personal data processing needed to provide the Service.
2. Terms used have the meaning given by Regulation (EU) 2016/679 ("GDPR"): personal data, processing, data subject, personal data breach, sub-processor.
3. This agreement prevails over the Terms of Service for everything concerning the protection of callers' data.

The Processor processes the data only to answer the Controller's calls, handle the requests and pass them on, for the whole duration of the subscription.

The Processor processes the data only on the Controller's instructions and protects it with the measures in Annex A.

1. Instructions. The Controller's instructions are this agreement and the settings it configures in the Service (information, transfer rules, request fields, notification recipients, numbers to block). If an instruction appears unlawful, the Processor tells the Controller immediately.
2. No other use. The Processor does not use callers' data for its own purposes, does not sell it and does not use it to train artificial intelligence models.
3. Confidentiality. Only people who need the data to provide the Service or support the Controller can access it, and they are bound by confidentiality.
4. Security. The Processor adopts technical and organisational measures appropriate to the risk (Art. 32 GDPR), described in Annex A, and updates them over time without lowering their level.
5. Records. The Processor keeps the record of processing carried out on behalf of controllers (Art. 30.2 GDPR).

The Controller gives general authorisation to the sub-processors listed in Annex B; any change is notified 15 days in advance.

1. The Processor contractually imposes on each sub-processor data protection obligations no less protective than those in this agreement, and remains liable to the Controller for their performance.
2. Before adding or replacing a sub-processor, the Processor notifies the Controller by email at least 15 days in advance.
3. Within that period the Controller may object on data protection grounds. If the parties cannot find a solution, the Controller may cancel the subscription without penalty, with a refund of the fee already paid and not used.
4. The up-to-date list of all providers is also in the Privacy Policy, section 7.

Some sub-processors process data in the United States and Singapore (Annex B); every transfer takes place with the safeguards of Chapter V GDPR.

1. For certified US providers the adequacy decision on the EU-US Data Privacy Framework applies; for the others, the European Commission's Standard Contractual Clauses (Decision 2021/914), with the necessary supplementary measures.
2. For DIDlogic (Singapore), which does not benefit from an adequacy decision, the Standard Contractual Clauses apply.
3. On request the Processor provides the Controller with a copy of the safeguards adopted for each transfer.

The Processor helps the Controller respond to data subjects and notifies it of a data breach within 48 hours of becoming aware of it.

1. Data subject requests. If a caller asks the Processor to access, correct or erase their data, the Processor forwards the request to the Controller within 5 working days and does not reply directly unless instructed. The Processor helps the Controller fulfil it, for example by deleting the recordings and transcript of a call.
2. Data breaches. In case of a personal data breach, the Processor notifies the Controller without undue delay and in any case within 48 hours, stating what is known about the nature of the breach, the data and data subjects involved, likely consequences and measures taken. Missing information follows as soon as available.
3. Impact assessments and consultations. The Processor provides the Controller with the information it holds for any data protection impact assessments (Art. 35 GDPR) and prior consultations with the supervisory authority (Art. 36 GDPR).

The Controller remains responsible for informing callers and for giving lawful instructions.

1. Notice to callers. The Controller keeps active, at the beginning of every call, the notice that the caller is speaking with an AI-based assistant and that the call may be recorded, as required by Art. 50 of Regulation (EU) 2024/1689 (AI Act) and Italian Law 132/2025. The Service already includes it in the greeting.
2. Privacy notice. The Controller gives its guests and customers the privacy notice on data collected by phone, naming the Processor and the use of artificial intelligence.
3. Legal basis. The Controller guarantees it has a valid legal basis for the processing entrusted and collects consent where needed.
4. Settings. The Controller does not configure the Service to collect special categories of data, payment card data or data not needed to handle requests.

Recordings and transcripts are deleted automatically after 12 months; at the end of the relationship all callers' data is deleted within 30 days.

1. During the relationship. Audio recordings and transcripts are kept for at most 12 months from the call, then deleted automatically both in the Processor's systems and at the voice platform provider. The essential call data (date, duration, outcome) remains for usage-based billing.
2. On request. The Controller may at any time ask for early deletion of individual calls or of all data.
3. At the end. Within 30 days of the end of the subscription the Processor deletes the callers' data, unless the Controller first asks for its return in a commonly used format. If the Controller deletes the account from the dashboard, data in the Processor's systems is deleted immediately; recordings and transcripts held by the voice sub-processor (Retell AI) and WhatsApp alerts held by Twilio within 30 days.
4. Legal obligations. Data the Processor must keep by law, such as billing documents (normally 10 years), is excluded.

The Processor makes available to the Controller the information needed to demonstrate compliance with this agreement.

1. On written request, the Processor answers security questionnaires within 30 days and provides the available documentation, including sub-processors' certifications.
2. If this information is not enough, the Controller may carry out an audit, also through an auditor bound by confidentiality, with at least 30 days' notice, during working hours and no more than once a year, except after a data breach. Audit costs are borne by the Controller.

The agreement applies for as long as the subscription lasts and the Processor holds the Controller's data.

1. Term. The agreement takes effect on acceptance of the Terms of Service, or on signature if earlier, and ends when the data has been deleted or returned under Art. 8.
2. Liability. Each party is liable under Art. 82 GDPR. Otherwise the limitations of liability in the Terms of Service apply, except where mandatory law provides otherwise.
3. Changes. Changes required by new laws or by decisions of the supervisory authority apply from their entry into force; other changes are announced to Customers at least 30 days in advance, as for the Terms of Service.
4. Law and jurisdiction. The agreement is governed by Italian law. For disputes with business Customers the Court of Milan has jurisdiction.

Measures in force on the date of the last update.

Seven providers process callers' data. The Processor's other providers (payments, website statistics, sign-in emails, mailbox) receive no callers' data and are listed in the Privacy Policy.