Data Processing Addendum

2.Definitions

“Customer Personal Information”

Personal information in Customer Data that we process on your behalf, such as information about your callers, contacts, outreach recipients and the people who chat with or email you. It does not include information we handle for our own purposes, such as your account and billing details, which our Privacy Policy covers.

“Processing”

Any operation on personal information, including collecting, recording, transcribing, storing, using, transmitting, disclosing and deleting it.

“Security Incident”

A breach of security safeguards that leads to unauthorized access to, or the loss, theft, disclosure or alteration of, Customer Personal Information we hold (in Quebec, a “confidentiality incident”).

3.Roles

You control Customer Personal Information and decide why and how it is processed; you are the organization accountable for it under Privacy Laws. We are your service provider (sometimes called a processor) and process it only for you, under the Agreement. Where Quebec law requires a written agreement with a person to whom personal information is entrusted to carry out a mandate or a service contract, this DPA, together with the Terms, is that agreement. For information we handle for our own purposes, we are responsible as our Privacy Policy describes.

4.Processing on your instructions

We process Customer Personal Information only:

• to provide, maintain, secure and support the Service for you;
• on your documented instructions, which are the Agreement, your configuration and use of the Service (your settings, requests, campaigns and connected integrations) and any other written instructions we agree to; and
• where the law requires it, in which case we tell you first unless the law forbids it.

We will tell you if, in our opinion, an instruction breaks the law, but we are not required to check your instructions for legal compliance. We do not sell Customer Personal Information, and we do not use it for advertising or for our own purposes except as the Agreement allows (Service Data, de-identified and aggregated data, and security, fraud and abuse prevention).

5.Details of the processing

• Subject matter: the Service: AI answering of calls and messages, scheduling, texts, email and (for a business whose WhatsApp sender is approved) WhatsApp, AI outreach, and the dashboard.
• Duration: while the Agreement is in force, and then until deletion as described in Return and deletion.
• Nature and purpose: receiving, recording, transcribing and summarizing calls; understanding and answering with AI; booking appointments; sending texts, WhatsApp messages and emails; running outreach campaigns; storing, displaying and exporting records; and deleting them.
• People concerned: your callers, clients, patients, leads, voters, supporters and outreach recipients, people who use your website chat or email your inbound address, and your staff named in records.
• Information: names; phone numbers, including the number a call was forwarded from; email addresses; addresses people give; voice recordings; transcripts and AI summaries; texts, chats and emails; appointment details; reasons for calling and notes; language; consent and opt-out records; call times, durations and costs; and anything else people choose to say or write.
• Sensitive information: not intended. You must not set up the Service to collect it (see our Acceptable Use Policy), but people may volunteer it, including health information, and it is then processed as part of the recording and transcript.

6.Your obligations

You will:

• have the consent or other lawful basis, and give the notices, that Privacy Laws require for all processing under your instructions, including recording, AI processing and processing outside Canada;
• keep Customer Personal Information accurate, and give only lawful instructions;
• handle the requests and complaints of the people concerned;
• decide on, and make, any notifications to regulators and individuals about Security Incidents that affect Customer Personal Information (we will help, as set out below);
• carry out any privacy impact assessment the law requires of you, including the one Quebec law requires before personal information is communicated outside Quebec; and
• not instruct us to collect the sensitive information our Acceptable Use Policy prohibits.

7.Confidentiality of our personnel

We give access to Customer Personal Information only to personnel who need it to provide, support or secure the Service and who are bound by confidentiality obligations, and only for those purposes.

8.Security measures

We maintain technical and organizational measures appropriate to the sensitivity of the information, including those described on our Security page: encryption in transit (TLS 1.2 or higher) and at rest (AES-256), row-level security for each workspace, role-based access, Twilio webhooks verified by signature, an authenticated voice relay, and card data held only by Helcim. These measures protect the confidentiality of the information and ensure it is used only to provide the Service. We may update them, as long as we do not materially reduce the overall protection.

9.Subprocessors

You authorize us to use the Subprocessors on our Subprocessors list. We require each of them, by contract, to protect Customer Personal Information in a way that is substantially as protective as this DPA and appropriate to the service it provides, and we remain responsible for their processing as Privacy Laws require, subject to the limits of liability in the Terms.

We announce a new Subprocessor by updating the list and emailing the Account Owner at least 15 days before it starts processing Customer Personal Information, unless we must act sooner to keep the Service running or secure (for example, when a provider fails), in which case we tell you as soon as we reasonably can. You may object on reasonable data-protection grounds by emailing us within that period. We will discuss your concern in good faith; if we cannot resolve it, your sole remedy is to cancel your subscription under the Terms.

10.Storage and processing outside Canada

Customer Personal Information is stored in Canada and processed in the United States (email in the European Union only when our fallback email provider sends it), and by Google and Meta, globally, if you enable their features, as our Privacy Policy and Subprocessors list describe. Some Subprocessors keep their own copies for a limited time: our telephony provider keeps call and text records until your retention period ends, when we delete them there; our AI provider keeps what it processes for up to 30 days; our email platform keeps delivery records for up to 24 months; and our hosting providers keep logs for up to 30 days. You authorize these transfers. Information outside Canada is subject to the laws of the countries where it is processed and may be accessed by their courts, law-enforcement and national-security authorities. We use contracts with our providers to protect it. You are responsible for telling the people concerned about these transfers.

11.Requests from individuals

If someone asks us about Customer Personal Information (for access, correction, deletion, withdrawal of consent or a complaint), we will not answer it ourselves, except to tell them to contact you, and we will forward it to you promptly unless the law prevents us. Taking into account the nature of the processing, we will help you respond through the Service’s features where they allow it (for example, exporting call logs) and otherwise by reasonable assistance at your request. We may charge for assistance that goes beyond the Service’s features, where the law allows.

12.Security incidents

If we become aware of a Security Incident, we will notify you without undue delay (and, where Quebec law applies, without delay) by email to the Account Owner. Our notice will describe, as far as we then know, what happened and when, the kinds and approximate amount of information and people involved, the likely consequences, and the steps we have taken or propose. We will update you as we learn more, take reasonable steps to contain and remedy the incident, and cooperate with your investigation and any notices you give.

Because you control the information, you decide whether to notify regulators and individuals, unless the law requires us to notify them directly. We keep the record of incidents the law requires. Notifying you of an incident is not an admission of fault or liability.

13.Return and deletion

When your account closes, we email the account owner the date its data will be deleted. Until then an administrator can export all of your data from the dashboard, and we can reopen the account at your request; for 30 days after it closes you may also ask us for a copy of your Customer Data. We delete Customer Personal Information as the Retention section of our Privacy Policy describes:

• while the account is open, call recordings at the end of their retention period: 90 days by default, or the period you chose between 7 days and 2 years (a political or campaign account starts at 400 days, as the Canada Elections Act requires for election calls); a recording that captures a person’s spoken consent is kept as proof for as long as that consent stands, and until 3 years after it is withdrawn;
• when the account closes, all of it within 60 days after closing (a political or campaign account: once its election-call recordings have been kept for their 400-day period): recordings, transcripts, summaries, call logs, messages, contacts, appointments, outreach events, and consent and opt-out records;
• the copies our Subprocessors keep, as described in Storage and processing outside Canada; and
• backups as they roll off. Our database provider keeps daily backups for 7 days; then they are deleted.

We may keep information that the law requires us to keep, for as long as it requires, and it remains protected by this DPA. On written request, we will confirm the deletion in writing.

14.Demonstrating compliance

We will make available the information reasonably necessary to show that we comply with this DPA: this DPA, our Security page and Subprocessors list, summaries of our providers’ security attestations (such as SOC 2 Type II or ISO 27001 reports, where the provider allows), and answers to one reasonable security questionnaire a year. JULY Call itself does not yet hold a SOC 2 report or an ISO 27001 certification.

On-site audits and inspections are not included unless the law or a regulator requires them. If they are required, they take place on at least 30 days’ notice, during business hours, at your cost, under confidentiality, no more than once a year, and in a way that does not expose other customers’ information or our security. Where Quebec law applies, you may also carry out the verifications of our confidentiality measures that it entitles you to, on the same conditions.

15.De-identified and aggregated data

We may create de-identified or aggregated data from Customer Personal Information and use it as the Terms allow. We will not try to re-identify anyone from it, and we will not publish it in a form that identifies you or any individual.

16.Liability

Our liability under this DPA is subject to the exclusions and limits of liability in the Terms, which apply to all claims under the Agreement together; this DPA does not create a separate or additional cap. Your indemnity in the Terms covers claims arising from your instructions, from any missing consent or lawful basis, and from your breach of this DPA.

17.Term and precedence

This DPA applies for as long as we process Customer Personal Information. If it conflicts with the Terms on the processing of personal information, this DPA prevails. We may update it as the Terms describe, including to reflect changes in the law, and we give notice of material changes as the Terms require.

18.Contact

Privacy Officer, JULY Marketing Inc., 666 Burrard Street, Suite 500, Vancouver, British Columbia, Canada. Email support@july.ca.