Data Processing Addendum

1. Definitions and roles

Terms such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the GDPR. "Data Protection Laws" means all privacy laws that apply to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, US state privacy laws (such as the CCPA) and the Turkish Personal Data Protection Law where relevant.

For Customer Personal Data (personal data in Customer Data, mainly lead data), the Customer is the controller and franchie is the processor. Where the Customer is itself a processor for another controller, franchie is its subprocessor.

2. Subject matter and details of processing

3. Customer instructions

franchie processes Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA and the Customer's configuration of the Service are the Customer's complete instructions. franchie will tell the Customer if it believes an instruction infringes Data Protection Laws, and may then suspend that processing. If franchie is required by law to process data otherwise, it will inform the Customer first unless the law forbids it.

The Customer is responsible for the lawfulness of the data it submits and of the calls and messages it instructs the Service to make, including obtaining any consent required under the TCPA, PECR or similar laws, as set out in the AI Calling & Consent Policy.

4. Confidentiality

franchie ensures that everyone authorised to process Customer Personal Data is bound by confidentiality and has access only as needed to provide the Service.

5. Security measures

franchie maintains appropriate technical and organisational measures, including:

• encryption in transit (TLS) and at rest, plus field-level encryption of names, phone numbers, emails and conversation content,
• pseudonymisation of conversation content before it is sent to AI models, so names, phone numbers and emails are not sent to the model,
• logical separation of each customer's data,
• multi-factor authentication for administrators, Argon2 password hashing and role-based access control,
• configurable retention with automatic anonymisation (minimum 30 days),
• a do-not-contact registry that blocks further contact after an opt-out,
• audit logs, error monitoring with personal data stripped, backups and tested recovery,
• vendor review of subprocessors and a contractual ban on AI providers training on Customer Data.

franchie may update these measures as long as the overall level of protection is not reduced.

6. Subprocessors

The Customer gives general authorisation for franchie to use subprocessors. The current list is on our Subprocessors page. franchie imposes data protection terms on each subprocessor that are at least as protective as this DPA and remains responsible for their performance.

franchie will give at least 30 days' notice of a new subprocessor by updating that page and notifying Customers who subscribe to updates. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.

7. International transfers

The Service is hosted on Google Cloud in the United States and franchie is established in Turkiye. Where Customer Personal Data subject to the EU GDPR is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"), which are incorporated by reference:

• Module Two (controller to processor) or Module Three (processor to processor) applies as relevant.
• Clause 7 (docking clause) applies. Under Clause 9, option 2 (general authorisation) applies with the notice period in section 6. The optional wording in Clause 11 does not apply.
• Clauses 17 and 18: the law and courts of Ireland [to be confirmed by counsel].
• Annex I is completed by section 2 of this DPA, Annex II by section 5, and Annex III by the Subprocessors page.

For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner applies. For Swiss data, the SCCs apply with references to the GDPR read as references to the Swiss FADP. franchie will cooperate with the Customer on any transfer impact assessment.

8. Data subject requests

franchie will help the Customer respond to data subject requests through the Service's export, correction and deletion features and, where needed, through reasonable additional assistance. If franchie receives a request directly, it will forward it to the Customer without undue delay and will not respond itself except to confirm the forwarding, unless the Customer instructs otherwise. Opt-out and do-not-contact requests received by the AI agent are recorded automatically in the Customer's do-not-contact registry.

9. Personal data breaches

franchie will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include the information the Customer reasonably needs to meet its own notification duties, updated as more becomes known. franchie will take reasonable steps to contain and remedy the breach.

10. Assistance and records

franchie will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to franchie.

11. Return and deletion

During the Agreement, the Customer can export and delete Customer Personal Data at any time and set its own retention period (minimum 30 days). After the Agreement ends, the Customer has 30 days to export its data. franchie then deletes or irreversibly anonymises Customer Personal Data within a further 60 days, including from backups as they rotate, unless the law requires it to be kept.

12. Audits

franchie will make available the information reasonably needed to demonstrate compliance with this DPA, including written answers to security questionnaires and available third-party certifications of its subprocessors. If that is not enough, or a supervisory authority requires it, the Customer may carry out an audit, at its own cost, once a year with at least 30 days' notice, during business hours and under confidentiality, in a way that does not compromise other customers' data.

13. US state privacy laws

Where the CCPA or similar US state laws apply, franchie acts as a "service provider" or "processor". franchie will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service, or combine it with data from other sources except as permitted by law. franchie will notify the Customer if it can no longer meet these obligations.

14. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the SCCs do not allow it. If this DPA conflicts with the Agreement, this DPA prevails for data protection matters. If it conflicts with the SCCs, the SCCs prevail.

Version history

• October 18, 2026 · First draft.