Data Processing Addendum

2. Roles of the parties

For the content of the conversations you translate through Kall It AI — live call audio, and any recording or transcript you've opted into — you (the Customer) are the data controller and Kall It AI is the data processor, acting only on your instructions as set out in the Terms of Service and this DPA. For account, billing, and security data, each party acts as an independent controller for its own purposes, as described in our Privacy Policy. Our accompanying Record of Processing Activities (ROPA) and Data Protection Impact Assessment (DPIA) describe this in full detail, available on request at privacy@kallit.ai.

3. Our processing of your data

We process call audio and any associated recordings or transcripts only (a) to provide the translation service itself, (b) as necessary to operate the service (support, security, fraud prevention, and technical troubleshooting), and (c) as you separately instruct us in writing. We do not use this content for any other purpose, including training AI models, and we do not sell it or share it for marketing or advertising purposes of any kind.

You are responsible for ensuring your own instructions to us, and your use of the service, comply with data protection law — including having a proper legal basis and, where required, the informed consent of the other call participant before a call is translated or recorded. Section 5 of our Terms of Service covers this in detail.

4. Confidentiality

Anyone at Kall It AI with access to call content is bound by confidentiality obligations, and access is restricted by role — only members of your own business can reach your business's data through the platform, and department owners are scoped further to their own department. Every access to a stored recording or transcript through the platform is logged. A limited number of Kall It AI administrators can also access stored content directly in our database. This is restricted to authorised administrators protected by two-step authentication, used only for support at your request, security investigations or legal requirements, and recorded.

5. Sub-processors

You give general authorisation for us to engage the sub-processors listed in Section 4 of our Privacy Policy, which we keep current as sub-processors change. Each sub-processor is bound by a written agreement imposing data protection obligations equivalent to those in this DPA, including confidentiality and appropriate technical and organisational security measures. If we appoint a new sub-processor, we will update that published list with the effective date of the change; if you have a reasonable, data-protection-related objection to a new sub-processor, contact us at privacy@kallit.ai and we will work with you in good faith to address it, which may include not using that sub-processor for your account where reasonably possible.

6. International transfers

Most of our infrastructure runs entirely within the UK/EEA, including the servers that relay live call audio, which are in Germany. Three sub-processors involve a transfer outside the UK/EEA: OpenAI (which processes live call audio in the US to generate the translation for additional languages Soniox doesn't cover, only where the business has switched OpenAI languages on -- off by default), Soniox (which processes live call audio in its European region for the language pairs it supports, but as a US company may carry out limited security and support processing outside it), and Telnyx (our telephony provider for phone-based access to the service). Each has its own Data Processing Addendum covering this transfer under UK-recognised Standard Contractual Clauses or the equivalent International Data Transfer Addendum — for OpenAI and Telnyx, automatically incorporated into their standard terms, and for Soniox, a Data Processing Agreement we have signed with it. Where any other sub-processor transfers data outside the UK/EEA, we rely on the same kind of recognised safeguard.

7. Security measures

Data is encrypted in transit and at rest. Access is controlled by role, with optional two-step authentication and forced sign-out available if an account looks compromised. Stored recordings and transcripts are opt-in (off by default) and automatically, permanently deleted 30 days after the call, regardless of any other action. Every access to a stored recording or transcript through the platform is logged in your business's own Activity Log. Full detail is in our Privacy Policy and the accompanying DPIA.

8. Data subject requests and assistance

Where practical, we provide self-service tools for this directly — for example, deleting a specific call recording or transcript at any time from the Sessions tab of the Translation page, without needing to contact us. For anything else, we will provide reasonable assistance, at your cost where the request requires meaningful additional work on our part, to help you respond to a data subject's request or to a data protection impact assessment or regulator consultation concerning the processing under this DPA.

9. Personal data breach notification

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and will notify the ICO within 72 hours where UK GDPR Article 33 requires it.

10. Deletion of data on termination

Stored recordings and transcripts are already auto-deleted 30 days after each call regardless of your account status. On closing your account, we handle remaining data as described in our Privacy Policy and Terms of Service Section 12, including any retention we're required to keep for financial record-keeping or other legal obligations.

11. Audit

On reasonable written request, no more than once per year unless required by a regulator or following a security incident, we will provide you with the information reasonably necessary to demonstrate compliance with this DPA, such as a summary of our current security measures and sub-processor list. We may satisfy this by providing existing audit reports or certifications where available, rather than a bespoke audit, and any on-site audit would need to be agreed in advance and carried out in a way that doesn't expose other customers' data.