Data Processing Addendum

The customer is the controller (or business) of the personal data it and its callers put into the platform. Kintara Group is the customer's processor. Where an agency resells Kintara to the customer, the agency acts as processor and engages Kintara Group as sub-processor on terms no less protective than this addendum.

• Subject matter and nature: call handling, transcription, call recording, scheduling, and SMS and email messaging by AI agents.
• Duration: the term of the customer’s subscription plus the deletion period in section 9.
• Categories of data: caller names and phone numbers, voice recordings, transcripts, appointment and contact data, message content and, for healthcare customers, possibly health information.
• Data subjects: the customer’s callers, patients, clients, leads and staff.

We process personal data only on the customer’s documented instructions (these terms and the customer’s use of the platform), unless the law requires otherwise, in which case we tell the customer first where permitted. We tell the customer if an instruction appears to break data protection law. We do not sell personal data or use it to train generalized AI models.

Everyone with access to personal data is bound by confidentiality duties, and access is limited to what their role needs.

• Encryption in transit and at rest.
• Per-organization tenant isolation enforced by database row-level security.
• Access and audit logging, and least-privilege access for staff.
• Multi-factor authentication for accounts.
• Regular backups, and testing of recovery and security controls.

The customer authorizes the sub-processors listed at /legal/subprocessors. We give at least 30 days’ notice of additions or replacements; the customer may object on reasonable data protection grounds within that time, and if we cannot resolve the objection it may end the affected service. We stay responsible for our sub-processors and bind them to obligations no less protective than these.

Taking into account the nature of processing, we help the customer respond to requests from data subjects (access, correction, deletion, portability, objection) and meet its obligations on security, breach notification, impact assessments and consultations with regulators. Contact us at privacy@kintaragroup.com.

We notify the customer without undue delay and in any case within 72 hours of becoming aware of a breach affecting its personal data, with the information we have about its nature, the data and people affected, likely consequences and the measures taken.

When the service ends the customer can export its data for 30 days. After that we delete or anonymize it within 90 days, unless the law requires us to keep it, and on request confirm the deletion in writing.

We make available the information needed to show compliance with this addendum and allow reasonable audits by the customer or its auditor, on 30 days’ notice, during business hours, subject to confidentiality and without unreasonable disruption.

Personal data is processed in the United States and other countries where our sub-processors operate. For transfers of personal data from the EEA, UK or Switzerland to countries without an adequacy decision, the Standard Contractual Clauses (and the UK Addendum) are incorporated into this addendum: Module Two (controller to processor) or Module Three (processor to processor) as applicable.

For personal information subject to the CCPA, we are the customer’s service provider. We process it only for the business purposes in the terms, do not sell or share it, do not retain, use or disclose it outside our direct business relationship with the customer or for any other purpose, do not combine it with other data except as the CCPA allows, and will tell the customer if we can no longer meet our obligations.

Protected health information is also subject to a Business Associate Agreement, which prevails over this addendum where they conflict for PHI.