Definitions

• "Agreement" means the Missional Agents Terms of Service and any order form between the parties.
• "Customer Personal Data" means personal information that we process on Customer's behalf through the services, including call audio, transcripts, text messages, summaries and other call records.
• "Data Protection Laws" means the privacy and data protection laws that apply to our processing of Customer Personal Data, including the California Consumer Privacy Act as amended ("CCPA") and comparable U.S. state laws.
• "Controller," "processor," "business," "service provider," "sensitive data," "process" and "sell" have the meanings given in Data Protection Laws.
• "Security Incident" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.
• "Subprocessor" means a third party we engage to process Customer Personal Data.

Roles and scope

Customer is the controller or business, and Missional Agents is the processor or service provider, for Customer Personal Data. Annex A describes the processing.

We process Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA, Customer's configuration of the services, and Customer's other reasonable written instructions. We will tell Customer if we believe an instruction violates Data Protection Laws.

This DPA does not cover information for which we are the controller, such as Customer's account, billing and website information. Our Privacy Policy covers that information.

Our obligations

Missional Agents will:

• Process Customer Personal Data only to provide, secure and support the services for Customer, and for other purposes Data Protection Laws allow service providers and processors;
• Not sell Customer Personal Data or share it for cross-context behavioral advertising;
• Not retain, use or disclose Customer Personal Data outside our direct business relationship with Customer, or for any purpose other than those in this DPA, and not combine it with personal information from other sources except as Data Protection Laws allow;
• Not use Customer Personal Data to train third-party AI models, and require our AI Subprocessors by contract not to use it to train their models;
• Not use voice recordings to identify individuals by voiceprint;
• Ensure that personnel who access Customer Personal Data are bound by confidentiality duties;
• Forward to Customer, within 10 business days, any request we receive from an individual about Customer Personal Data, and give reasonable help, including tools to export or delete data, so Customer can respond within legal deadlines;
• Give reasonable help with data protection assessments and consultations with regulators where Data Protection Laws require it;
• Tell Customer within 10 business days if we determine we can no longer meet our obligations under Data Protection Laws;
• Not attempt to re-identify de-identified or aggregated data we create, and keep any such data de-identified as the law requires.

Missional Agents certifies that it understands and will comply with the restrictions in this Section 3. If we use Customer Personal Data in violation of this DPA, Customer may take reasonable steps to stop and remediate that use.

Customer's obligations

Customer is responsible for:

• Having a lawful basis to collect Customer Personal Data and to give us instructions, including giving callers every notice and obtaining every consent the law requires, such as call-recording and AI-disclosure notices in the callers' states;
• Keeping those notices in its greeting and settings, since Customer can configure the greeting;
• Deciding whether it must obtain consent to process sensitive data, such as information revealing religious beliefs or health conditions, and obtaining it where required;
• Managing its users, their access, and its account credentials;
• Complying with laws on calls and text messages if it uses the services for follow-up or outreach;
• Not using the services to intentionally collect payment card numbers, government ID numbers or other data we have told Customer the services are not designed to handle.

Customer may audit our compliance on 30 days' written notice, during business hours, under confidentiality terms, and at Customer's own cost, without unreasonable disruption. If that is not enough to meet a legal requirement, Customer may audit our compliance on 30 days' written notice, during business hours, under confidentiality terms, and at Customer's own cost, without unreasonable disruption.

Subprocessors

Customer authorizes the Subprocessors listed in Annex C. We will have a written contract with each Subprocessor that requires data protection terms no less protective than this DPA, and we remain responsible for their performance.

We will give Customer at least 30 days' notice before adding or replacing a Subprocessor, by email, in the dashboard, or by updating Annex C on our website. Customer may object on reasonable data protection grounds within 15 days of notice. We will work with Customer in good faith to resolve the objection. If we cannot, Customer may terminate the affected services and receive a pro rata refund of prepaid fees for the remainder of the term.

Security

We maintain reasonable technical and organizational measures to protect Customer Personal Data, described in Annex B. Customer is responsible for securing its account credentials and for controlling which Users can access Customer Personal Data.

Security Incidents

We will notify Customer without undue delay, and within 72 hours where feasible, after we confirm a Security Incident affecting Customer Personal Data. The notice will describe, as far as we know, the nature of the incident, the data and individuals affected, the likely consequences, and the steps we are taking. We will take reasonable steps to contain and remediate the incident and will cooperate with Customer's investigation.

Customer is responsible for deciding whether to notify individuals and regulators, unless the law requires us to notify them directly. Our notice or response is not an admission of fault.

Retention, return and deletion

We keep Customer Personal Data as set out in Annex A. Customer can ask us to delete call records if desired, and we will do so within 30 days of a verified request, except where the law requires us to keep them.

When the Agreement ends, we will delete Customer Personal Data within [120] days of account closure. We may keep information the law requires us to keep, and it remains protected by this DPA.

Audits and information

On request, no more than once a year, we will give Customer the information reasonably needed to show we comply with this DPA, such as a summary of our security practices and relevant third-party security reports from our Subprocessors. If that is not enough to meet a legal requirement, Customer may audit our compliance on 30 days' written notice, during business hours, under confidentiality terms, and at Customer's own cost, without unreasonable disruption. If that is not enough to meet a legal requirement, Customer may audit our compliance on 30 days' written notice, during business hours, under confidentiality terms, and at Customer's own cost, without unreasonable disruption.

Legal requests

If we receive a subpoena, court order or other government demand for Customer Personal Data, we will tell Customer before responding, unless the law prohibits it, and will disclose only what the law requires.

Location of processing

We and our Subprocessors process Customer Personal Data in the United States. If Customer is located outside the United States, or the parties agree to serve such Customers, we will agree to additional transfer terms as needed.

General

• Liability. Each party's liability under this DPA is subject to the limits and exclusions in the Agreement.
• Precedence. If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA controls. Otherwise the Agreement controls.
• Term. This DPA lasts as long as we process Customer Personal Data for Customer, and its deletion and confidentiality terms survive.
• Changes. We may update this DPA to reflect changes in law or our services. We will give Customer 30 days' notice of material changes, and Customer may terminate if it reasonably objects.
• Governing law. The governing law and venue in the Agreement apply.

Annex A: Details of processing

Annex B: Security measures

We maintain the following measures, or measures at least as protective.

• Encryption of Customer Personal Data in transit and at rest.
• Role-based access controls and least-privilege access for our personnel.
• Logical separation of each Customer's data.
• Logging and monitoring of access to systems that hold Customer Personal Data.
• Vendor review and written data protection terms with Subprocessors.
• Vulnerability management and timely security updates.
• Confidentiality commitments and security awareness training for personnel.
• A documented incident response process.
• Backups and secure deletion procedures that follow Section 8.

We will give Customer the information reasonably needed to show we comply with this DPA, such as a summary of our security practices and relevant third-party security reports from our Subprocessors. If that is not enough to meet a legal requirement, Customer may audit our compliance on 30 days' written notice, during business hours, under confidentiality terms, and at Customer's own cost, without unreasonable disruption. If that is not enough to meet a legal requirement, Customer may audit our compliance on 30 days' written notice, during business hours, under confidentiality terms, and at Customer's own cost, without unreasonable disruption.

Annex C: Subprocessors

Stripe processes Customer billing information for us as an independent payment provider. That is account information covered by our Privacy Policy, not Customer Personal Data under this DPA.