Data Processing Agreement

In this DPA, the following definitions apply:

• "Controller" means the Client, who determines the purposes and means of processing personal data of their callers.
• "Processor" means SmartCallPro, operated by KF Consulting s.r.o., who processes personal data on behalf of the Controller.
• "Personal Data" means any information relating to an identified or identifiable natural person as defined in Article 4(1) of the GDPR.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Subject" means any individual whose Personal Data is processed under this DPA, primarily callers who contact the Controller's business through the Smart Call Assistant service.
• "Sub-Processor" means any third party engaged by SmartCallPro to process Personal Data in connection with the delivery of the Services.
• "Services" means the Smart Call Assistant service provided by SmartCallPro to the Client under the Client Service Agreement.
• "Supervisory Authority" means the Office for Personal Data Protection of the Czech Republic (Úřad pro ochranu osobních údajů — UOOU) or any other competent data protection authority with jurisdiction over the parties.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission under Article 46(2)(c) of the GDPR.

The details of processing carried out by SmartCallPro under this DPA are as follows:

Subject matter of processing: The provision of AI-powered call answering, call handling, transcription, summarisation, and notification services on behalf of the Client.

Duration of processing: For the duration of the Client Service Agreement and for the period during which SmartCallPro retains Personal Data in accordance with its data retention policy, as set out in Section 8 of this DPA.

Nature of processing: Collection, recording, transcription, summarisation, storage, and transmission of call data and caller information.

Purpose of processing: To deliver the Smart Call Assistant service, including answering inbound calls, generating call transcripts and summaries, sending notifications to the Client, and routing calls and enquiries.

Types of Personal Data processed:

• Caller telephone numbers
• Date, time, and duration of calls
• Call transcripts
• AI-generated call summaries
• Any personal information voluntarily provided by callers during calls, including names, enquiry details, and contact preferences

Categories of Data Subjects: Individuals who contact the Client's business by telephone and whose calls are handled by the Smart Call Assistant.

SmartCallPro, as Processor, agrees to the following obligations in respect of Personal Data processed under this DPA:

3.1 Documented instructions

SmartCallPro will process Personal Data only on the documented instructions of the Client, as set out in the Client Service Agreement and this DPA, unless required to do otherwise by applicable EU or Czech law. Where SmartCallPro is required by law to process Personal Data beyond the Client's instructions, SmartCallPro will inform the Client of that legal requirement before processing, unless the law prohibits such disclosure.

3.2 Confidentiality

SmartCallPro will ensure that all personnel authorised to process Personal Data are subject to binding confidentiality obligations and are informed of the confidential nature of the Personal Data they handle.

3.3 Security

SmartCallPro will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, in accordance with Article 32 of the GDPR. These measures include encrypted data transmission, access controls, secure storage, and regular security reviews. Details of current security measures are available upon written request.

3.4 Sub-Processors

SmartCallPro will not engage any new Sub-Processor without providing the Client with prior written notice of at least thirty (30) days. The Client may object to the engagement of a new Sub-Processor on reasonable data protection grounds by notifying SmartCallPro in writing within fourteen (14) days of receiving notice. Where the Client objects and Smart Call Pro cannot accommodate the objection, either party may terminate the Client Service Agreement with thirty (30) days written notice without penalty.

SmartCallPro will ensure that all Sub-Processors are bound by data processing agreements imposing obligations equivalent to those set out in this DPA. SmartCallPro remains fully liable to the Client for the performance of Sub-Processors' obligations.

A full list of current Sub-Processors is available upon written request as set out in Schedule 1 of this DPA.

3.5 Data Subject rights

SmartCallPro will provide reasonable assistance to the Client in responding to requests from Data Subjects exercising their rights under the GDPR, including rights of access, rectification, erasure, restriction, portability, and objection. Where a Data Subject contacts SmartCallPro directly, SmartCallPro will redirect that request to the Client without undue delay.

3.6 Assistance with compliance

SmartCallPro will provide reasonable assistance to the Client in ensuring compliance with obligations under Articles 32 to 36 of the GDPR, including obligations relating to security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities.

3.7 Deletion or return of data

Upon termination or expiry of the Client Service Agreement, SmartCallPro will, at the Client's choice, securely delete or return all Personal Data processed on behalf of the Client, and delete existing copies, unless applicable law requires retention of the Personal Data. SmartCallPro will confirm completion of deletion in writing within thirty (30) days of termination.

3.8 Audit and inspection

SmartCallPro will make available to the Client all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA, and will allow for and contribute to audits or inspections conducted by the Client or a third-party auditor mandated by the Client. The Client will give SmartCallPro at least thirty (30) days advance written notice of any audit and will ensure that audits are conducted in a manner that does not unreasonably disrupt Smart Call Pro's operations. Audit costs are borne by the Client unless the audit reveals a material breach by SmartCallPro, in which case SmartCallPro will bear reasonable audit costs.

The Client, as Controller, agrees to:

• Ensure that it has a valid legal basis under the GDPR for instructing SmartCallPro to process Personal Data on its behalf.
• Provide callers with appropriate transparency information about the use of the Smart Call Assistant, including the AI disclosure required under Article 50 of the EU AI Act, as delivered by SmartCallPro at the start of every call.
• Not instruct SmartCallPro to process Personal Data in a manner that would violate the GDPR, the EU AI Act, or any other applicable law or regulation.
• Not instruct SmartCallPro to suppress, remove, or modify the mandatory AI disclosure statement delivered to callers at the start of every call.
• Notify SmartCallPro promptly of any changes to applicable law or regulatory guidance that may affect the processing of Personal Data under this DPA.
• Ensure that any special category data that callers may voluntarily disclose during calls is handled in accordance with Article 9 of the GDPR, and that appropriate safeguards are in place where special category data is likely to be collected.

Where SmartCallPro or its Sub-Processors transfer Personal Data outside the European Economic Area ("EEA"), Smart Call Pro will ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where applicable

Details of international transfers and applicable safeguards are set out in Schedule 1 of this DPA. Copies of applicable Standard Contractual Clauses are available upon written request to compliance@smartcallpro.cz.

SmartCallPro will notify the Client without undue delay, and in any event within forty-eight (48) hours of becoming aware of a Personal Data breach affecting Personal Data processed under this DPA.

The notification will include, to the extent available at the time of notification:

• A description of the nature of the breach, including the categories and approximate number of Data Subjects and records affected
• The name and contact details of SmartCallPro's data protection contact
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach and mitigate its effects

Where not all information is available at the time of initial notification, SmartCallPro will provide further information in phases without undue delay.

The Client is responsible for notifying the relevant Supervisory Authority and affected Data Subjects in accordance with Articles 33 and 34 of the GDPR, based on information provided by SmartCallPro.

Where the Client is required to carry out a Data Protection Impact Assessment ("DPIA") under Article 35 of the GDPR in connection with processing activities involving the Smart Call Assistant service, SmartCallPro will provide reasonable assistance and relevant information to support the completion of that assessment.

SmartCallPro retains Personal Data processed under this DPA for the following periods:

Upon expiry of the applicable retention period, Personal Data is permanently and securely deleted. The Client may request a shorter retention period in writing at any time. SmartCallPro will implement the shorter retention period within fourteen (14) days of receiving the written request.

For all data protection queries relating to this DPA, please contact:

• SmartCallPro — operated by KF Consulting s.r.o.
• Email: compliance@smartcallpro.cz
• Website: https://smartcallpro.cz
• Registered address: Žirovnická 3133/6, Praha 10, 106 00, Czechia
• IČO: 09021680

This DPA enters into force on the date the Client Service Agreement is signed and remains in force for the duration of that agreement. Termination of the Client Service Agreement automatically terminates this DPA, subject to the data deletion obligations set out in Section 3.7 and any retention obligations required by applicable law.

In the event of any conflict between this DPA and the Client Service Agreement, this DPA shall prevail in respect of the processing of Personal Data. In the event of any conflict between this DPA and applicable GDPR requirements, the GDPR requirements shall prevail.

This DPA is governed by the laws of the Czech Republic. Any disputes arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the competent courts of the Czech Republic.

A full and current list of Sub-Processors engaged by SmartCallPro in the delivery of the Services, including their location, purpose, and applicable transfer safeguards, is available to clients upon written request.

To request the current Sub-Processor list, please contact compliance@smartcallpro.cz.

All Sub-Processors located outside the EEA operate under Standard Contractual Clauses approved by the European Commission. Copies of applicable SCCs are available upon written request.