Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between you ("Customer") and Oregon Logistics, Inc., doing business as cyberscaler ("cyberscaler," "we"). It applies whenever we process personal data on your behalf while providing the Service ("Customer Personal Data").

If this DPA conflicts with the Terms on anything about Customer Personal Data, this DPA wins. Words such as "controller," "processor," "personal data," "data subject" and "personal data breach" have the meanings given in the Data Protection Laws: the U.S. state privacy laws that apply to the Service (including the California Consumer Privacy Act as amended), and, where they apply to you, the EU and UK General Data Protection Regulations.

• You are the controller (or "business") of Customer Personal Data: you decide why and how it is processed. We are your processor (or "service provider") and process it only to provide the Service.
• If you use the Service for someone else (for example, as a reseller or for your own clients), you confirm they have authorized this arrangement. We then act as a subprocessor, and you remain our only point of contact.
• Information we handle for our own business, such as account contacts, applications, billing and payment records, and website visitors, is not Customer Personal Data. We control it, and our Privacy Policy covers it.

We process Customer Personal Data only on your documented instructions. Those instructions are: the Terms and this DPA; how you set up and use the Service (for example, turning on call recording, transcription, AI features, texting or integrations); and anything else we agree in writing. Turning on an optional feature tells us to use the subprocessors listed for it in section 7.

We will not sell or share Customer Personal Data, use it for targeted advertising, or keep, use or disclose it for any purpose other than providing the Service, or combine it with other data except as the Data Protection Laws allow a service provider to. We may create aggregated or de-identified data that no longer identifies anyone, and we will not try to re-identify it.

If the law requires us to process Customer Personal Data in another way, we will tell you first unless the law forbids it. If we believe an instruction breaks the Data Protection Laws, we will tell you and may pause that processing until you confirm or change the instruction.

• Subject matter: business phone service: calling, phone numbers, texting, voicemail, softphone apps, the customer portal, and optional recording, transcription and AI features.
• Duration: the term of the Terms, then until the data is deleted or returned under section 12.
• Nature and purpose: routing, hosting and storing calls and messages; keeping a searchable archive of the email and chat accounts you connect; showing activity in the portal and apps; support; and the optional features you turn on.
• Data subjects: your users and administrators, and the people who call, text or otherwise communicate with them through the Service.
• Personal data: names, phone numbers, extensions, email addresses, IP addresses and device details, call records (who, when, how long, outcome), text messages, voicemail, call recordings, transcripts and AI summaries, contacts, files exchanged through the Service, and full copies of the email and chat accounts you connect (messages, attachments, senders, recipients and dates).
• Sensitive data: the Service is not designed to collect sensitive or special categories of data. Such data may appear in calls or messages; you are responsible for having a legal basis for it.

Only people who need access to provide, secure or support the Service can reach Customer Personal Data, and each of them is bound by a duty of confidentiality.

We keep technical and organizational measures appropriate to the risk, including:

• Encryption in transit: HTTPS/TLS for the website, portal, apps and API; encrypted connections for calls, texts, email and chat integrations wherever the other side supports it.
• Encryption at rest: call records, transcripts, voicemail and text messages in our data store are encrypted with a separate key for each customer company, and phone numbers are stored as keyed fingerprints; tax IDs and bank details are encrypted; passwords are stored only as one-way hashes.
• Separation: each customer has its own phone-system domain, and data in the portal and apps is filtered by customer.
• Access control: production access is limited to the people who need it, using individual SSH keys; repeated failed logins are blocked automatically.
• Backups and resilience: daily backups copied offsite to a separate provider and region, a standby phone system, and minute-by-minute health monitoring with alerts.
• Retention limits: call recordings are kept on the phone system for 90 days, and old call detail records are pruned on a schedule.
• Maintenance: regular operating system and software updates.

We may improve these measures over time, but we will not lower the overall level of protection. We do not currently hold a SOC 2 or ISO 27001 certification.

You give us general authorization to use subprocessors. The current list is below. Each subprocessor is bound by a written contract with data protection terms at least as protective as this DPA, and we remain responsible to you for its work.

Not subprocessors: services you connect yourself, such as your email (Gmail, Outlook, iCloud Mail, IMAP), chat apps (Telegram, WhatsApp, Slack and others) and AI models you use with your own API key. Those providers act under your own agreement with them. The copies we make of a connected account are Customer Personal Data: we store and protect them under this DPA. Carriers, number registries and texting campaign registries receive what they require to connect calls, move numbers and register texting, as part of the telephone network. Our banking and payment providers handle our billing, not Customer Personal Data.

Changes. We will update this list and email your account's administrators at least 14 days before a new subprocessor starts processing Customer Personal Data. You may object in writing within those 14 days on reasonable data protection grounds. We will then work with you in good faith: we may stop using that subprocessor for your data or turn off the feature that needs it. If we cannot, you may end the affected part of the Service and receive a prorated refund of fees paid in advance for it. If you do not object, the change is approved.

We store Customer Personal Data in the United States. Some subprocessors, as listed in section 7, may process it in other countries.

If the EU or UK GDPR applies to your data and it is transferred to a country without an adequacy decision, the Standard Contractual Clauses approved by the European Commission (Module 2, controller to processor, or Module 3, processor to processor) and, for the UK, the UK International Data Transfer Addendum are incorporated into this DPA by reference, with this DPA supplying the details they require. On request we will sign them as a separate document.

If someone asks us to access, correct, delete or export their data, or to stop processing it, and the request concerns Customer Personal Data, we will send it to you and will not answer it ourselves except to say we have passed it on. We will help you respond, taking into account the nature of the processing, and you should first use the tools in the portal where they exist.

If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay. Our notice will describe, as far as we know at the time, what happened, the kinds and approximate number of people and records involved, the likely consequences, and what we have done or plan to do about it. We may send the information in stages as we learn more.

Unsuccessful attempts that do not compromise Customer Personal Data, such as blocked login attempts or network scans, are not breaches. Telling you about a breach is not an admission of fault.

Taking into account the nature of the processing and the information available to us, we will reasonably help you with security, breach notifications to authorities or individuals, data protection impact assessments, and consultations with regulators. Where the help goes beyond what we provide to all customers, we may charge reasonable fees.

When the Service ends, you can ask within 30 days for an export of your call records, messages, voicemail and recordings that we still hold. After that, we delete Customer Personal Data from our active systems, unless the law requires us to keep some of it, in which case we keep it only for that purpose and continue to protect it under this DPA.

Connected accounts. When you connect an email or chat account, we copy its full history, including attachments, and keep the copy up to date while it stays connected. Disconnecting stops new copying; the stored copy is kept until an administrator asks us to delete it (for one user or the whole company), or the Service ends. We delete it within 30 days of the request.

Copies in backups are removed as the backups expire on their normal rotation. Data you deleted or that aged out under our retention limits (for example, recordings older than 90 days) cannot be returned.

• We will give you the information reasonably needed to show that we meet this DPA, including written answers to a reasonable security questionnaire once a year.
• If that is not enough, or a regulator requires it, you (or an independent auditor bound by confidentiality who is not our competitor) may audit our compliance once every 12 months, with at least 30 days' written notice, during business hours, without disrupting the Service or other customers' data, and under a plan we agree on.
• Each side pays its own costs, unless the audit finds that we materially breached this DPA. Audit results and our security information are our confidential information.

• You have a lawful basis for the processing and give the people involved any notices the law requires.
• You get every consent the law requires, including consent to record calls (some states, such as Illinois and California, require everyone on the call to agree) and to send texts.
• You configure the Service, including users, recording, transcription, AI features and integrations, to fit your obligations.
• Your instructions to us comply with the Data Protection Laws.

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms. Nothing in this DPA limits rights that individuals have under the Data Protection Laws that cannot be limited by contract.

This DPA is governed by the same law and dispute terms as the Terms (Illinois law), except that the Standard Contractual Clauses, where they apply, are governed by the law they specify.

This DPA takes effect when you accept the Terms and lasts as long as we process Customer Personal Data. Sections 12 (deletion), 13 (audits) and 15 survive as long as needed. We may update this DPA by posting a new version here; we will give customers notice of material changes, and no change will lower the protection of Customer Personal Data.

Need a signed copy? Email support@cyberscaler.ai and we will send one countersigned.