Data Processing Addendum
01How this DPA works
This Data Processing Addendum (the “DPA”) is part of the Personnect Terms of Service (the “Terms”) between Personnect.ai LLC (“Personnect”, “we”, “us”) and the business named in your account (“you”). When your account’s Terms are accepted, this DPA is accepted with them. You do not need to sign anything separately; Section 15 explains how to get a signed copy.
Personnect is not your processor for everything. For the contact lists and other material you upload, we act on your behalf. For the data the Services create, which the Terms make ours, and for data about your account, we act for ourselves. Section 3 sets out which data falls on which side.
02Definitions
“Data Protection Laws” means the United States federal and state laws that apply to the processing of personal data under the Terms, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (the “CCPA”) and the consumer privacy laws of other states.
“Customer Personal Data” means personal data in the contact lists and other material you upload to the Services, including contact records you type in or sync from your CRM, notes your users write about a contact, and details we add to your contacts through lead enrichment at your request.
“Personnect Data” means the data described in Section 10.2 of the Terms: call recordings, transcripts, call records, call outcomes, automated detections, analytics, and summaries or model output derived from them.
“Account Data” means personal data about you and your users that we need to run your account: names, work email addresses and phone numbers, login and security records, billing records, verification results under Section 7 of the Terms, and customer proprietary network information.
“Subprocessor” means a third party we use that processes Customer Personal Data for us. Words such as “personal data”, “processing”, “controller”, “processor”, “business”, “service provider”, “sell” and “share” have the meanings Data Protection Laws give them.
03Who controls which data
| Data | You | Personnect |
|---|---|---|
| Customer Personal Data | Controller (business under the CCPA) | Processor (service provider under the CCPA) |
| Personnect Data | Controller of any copy you export or use for your own purposes | Controller (a business, not a service provider, under the CCPA) |
| Account Data | Not applicable | Controller |
3.1 Customer Personal Data. You decide which contacts to load, why, and what to do with them. We process Customer Personal Data as your processor, under Section 4.
3.2 Personnect Data. The Terms make Personnect Data ours and let us use it to operate and improve the Services, to train and evaluate AI models, and to create de-identified or aggregated products. For personal data in Personnect Data (for example, the voice of the person who answers a call) we act as a controller and not on your instructions. Sections 4, 8, 9.1 and 11 of this DPA do not apply to Personnect Data.
3.3 Account Data. We are the controller of Account Data, and our Privacy Policy describes how we use it. Our duties to keep and disclose verification records and to protect telephone records come from law and our role as a voice service provider, not from your instructions.
3.4 Where the two overlap. One person can appear on both sides. A contact’s name and number in your list are Customer Personal Data. The record that we called that number, the recording of the call and its outcome are Personnect Data. Each follows its own rules.
3.5 Our duties as a controller. For Personnect Data and Account Data we will comply with Data Protection Laws as a controller, give our own notices through our Privacy Policy, answer requests from individuals ourselves, protect the data with the measures in Annex II, and keep it only as long as the Terms, our Privacy Policy and the law allow.
04How we process Customer Personal Data
4.1 Your instructions. We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, and the way you and your users set up and use the Services (for example, which list you load into which campaign, which CRM you connect, and which leads you enrich). Annex I describes the processing.
4.2 Unlawful instructions. We will tell you if we believe an instruction breaks Data Protection Laws, and we may decline to follow it until it is changed or confirmed in writing.
4.3 When law requires something else. If the law requires us to process Customer Personal Data in another way (for example, to answer a traceback request or a subpoena), we will tell you first, unless the law forbids it or notice is impractical.
4.4 Our rights under the Terms. Section 10.3 of the Terms gives us rights over your uploaded content. For Customer Personal Data, we use those rights only to: (a) provide, operate, secure and support the Services for you; (b) meet our legal, regulatory and carrier obligations; and (c) improve the Services and develop, train and evaluate AI models, using only data that has first been de-identified or aggregated so that it no longer identifies any person.
4.5 No sale. We will not sell or license your contact lists or the Customer Personal Data in them.
05Your responsibilities
5.1 You are responsible for having a lawful basis to collect Customer Personal Data, to give it to us and to call the people in it, and for giving those people any notice the law requires (Terms Section 6.4).
5.2 Where you record calls, recording starts when a call is answered, and the notice your representatives give must cover our use of recordings and transcripts as well as yours, as Section 6.10 of the Terms requires.
5.3 You will not upload sensitive personal data (Terms Section 10.7), and you will use the Services to call only people Section 6.1 of the Terms allows.
5.4 You are responsible for the accuracy of Customer Personal Data and for making sure your instructions to us comply with Data Protection Laws.
06Our personnel
Everyone we allow to process Customer Personal Data is bound by a duty of confidentiality and accesses it only as far as their work needs.
07Security
7.1 We protect Customer Personal Data with the measures in Annex II against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. We apply the same measures to Personnect Data and Account Data.
7.2 We may change those measures over time, as long as the overall level of protection does not drop.
7.3 You are responsible for your users’ credentials, for the settings you choose, and for what you do with data once you export it or send it to a product you connect (Terms Sections 5.4 and 11.5).
7.4 No system is completely secure. We do not guarantee that Customer Personal Data will never be accessed, used or lost without authorization, and our liability for any breach is limited as the Terms provide (Terms Sections 11.6 and 15).
08Subprocessors
8.1 Authorization. You give us general authorization to use Subprocessors. The categories we use are listed on our Subprocessors page, which is Annex III. The names of the providers are available on request at contact@personnect.ai.
8.2 Their obligations. Each Subprocessor processes data under a written contract with us. We remain responsible to you for each Subprocessor’s performance.
8.3 Changes. We will update the Subprocessors page before a new category of provider starts processing Customer Personal Data.
8.4 Objections. You may object to a change on reasonable data-protection grounds by writing to contact@personnect.ai. We will discuss it with you in good faith. If we cannot resolve it, you may close your account. Because the Terms have no minimum term, closing ends the agreement without any fee; payments are not refunded (Terms Section 2.6).
09Requests from individuals and other help
9.1 Requests about Customer Personal Data. If a person asks us to exercise a right over Customer Personal Data (for example access, correction or deletion), we pass the request to you without undue delay and do not answer it ourselves, except to tell the person we have passed it on.
9.2 Tools. Your users can edit contacts, and your managers and admins can remove contacts from your account and export them. Removing a contact hides it from your account; the data is kept. To ask for permanent deletion, write to contact@personnect.ai; we review each deletion request under the law that applies. Where these tools are not enough, we will help you answer a request, taking into account the nature of the processing.
9.3 Other help. We will give you information you reasonably need, and that we have, to carry out a data protection assessment or to answer a regulator about the processing under this DPA.
9.4 Requests about Personnect Data and Account Data. We answer these ourselves, under our Privacy Policy and Data Protection Laws. If a request concerns both your data and ours, we pass your part to you and answer ours.
10Personal data breaches
10.1 If we become aware of a breach affecting Customer Personal Data, we will notify your account admins without undue delay.
10.2 The notice will describe, as far as we know at the time, what happened, the kinds and approximate number of people and records involved, the likely consequences, what we have done or plan to do, and how to reach us. We will send updates as we learn more and help you meet your own notice duties.
10.3 If a breach affects Personnect Data or Account Data, we handle it as a controller, including any notice to authorities or individuals the law requires.
10.4 Notifying you of a breach is not an admission of fault or liability.
11Deletion and return
11.1 While your account is open. Your managers and admins can export your contacts at any time.
11.2 When your account ends. If an admin asks within 30 days after your account closes, we send you an export of your contacts and call history (Terms Section 13.3). That export is how we return Customer Personal Data to you.
11.3 Deletion. We keep Customer Personal Data after your account closes, and use it then only as Sections 4.4 and 11.4 allow. You may ask us in writing at contact@personnect.ai to delete it. We review each request under the law that applies and tell you our decision in writing.
11.4 What we may keep. We may keep Customer Personal Data where the law requires it, under a legal hold, and as Section 10.9 of the Terms allows. Anything kept on that basis stays protected by this DPA and is used only for the purpose it was kept for.
11.5 Personnect Data. This Section does not apply to Personnect Data. Our Privacy Policy and the Terms govern how long we keep it.
12Information and audits
12.1 Information. On request, we will give you the information reasonably needed to show that we meet this DPA, including Annex II and our answers to a reasonable security questionnaire, once in any 12 months. We do not hold a SOC 2 report or any other third-party security certification.
12.2 Audits. We answer audit requests with the written information in Section 12.1. Only where a law that applies to you requires more may you (or an independent auditor you appoint who is bound by confidentiality) audit our compliance with this DPA, and then only to the extent that law requires: at your cost, with at least 30 days’ written notice, no more than once in any 12 months, during business hours, and remotely where possible. An audit will not give access to other customers’ data or to systems where access would put the security of the Services at risk.
13California and other US state laws
13.1 Where we are your service provider. For Customer Personal Data subject to the CCPA, you are the business and we are your service provider. You disclose it to us for the limited business purpose of providing the Services described in the Terms and Annex I. We will:
- not sell or share it;
- not keep, use or disclose it for any purpose other than that business purpose, or outside our direct business relationship with you, except as the CCPA allows a service provider (including improving the Services as Section 4.4(c) describes);
- not combine it with personal information we receive from others or collect ourselves, except as the CCPA allows;
- comply with the CCPA and give it the level of privacy protection the CCPA requires;
- tell you if we can no longer meet these obligations;
- let you take reasonable and appropriate steps to stop and fix any use of it that is not authorized, starting with written notice to us.
We certify that we understand these restrictions and will comply with them.
13.2 Where we are not a service provider. For personal information in Personnect Data we are a business in our own right, not your service provider, and Section 13.1 does not apply to it. We meet the duties of a business for that data ourselves, through our Privacy Policy.
13.3 Other states. Where another state’s privacy law applies to Customer Personal Data, we act as your processor and will follow your instructions; keep it confidential; return it and handle deletion requests as Section 11 says; give you the information you need to show compliance and allow reasonable assessments under Section 12; and use Subprocessors only under a written contract, with the notice and chance to object in Section 8.
14Liability, order of precedence and changes
14.1 Liability. This DPA is part of the Terms, and Section 15 of the Terms (limitation of liability) applies to all claims under it, taken together, except where Data Protection Laws do not allow liability to be limited.
14.2 Order of precedence. For the personal data it covers, this DPA controls over the rest of the Terms (Terms Sections 10.8 and 16.8).
14.3 Changes. We may update this DPA on 30 days’ notice, the same way Section 16.9 of the Terms allows us to update the Terms, and at any time to reflect a change in Data Protection Laws.
14.4 Duration and notices. This DPA lasts as long as we process Customer Personal Data. Notices follow Section 16.5 of the Terms; write to us at contact@personnect.ai.
15Getting a signed copy
This DPA binds you once your account’s Terms are accepted. If your procurement or privacy team wants a signed copy, email contact@personnect.ai with your company’s legal name and your account admin’s email address, and we will send back this version, countersigned.
16Annex I: Description of the processing
| Parties | You, the customer named in your Personnect account, as controller, acting through your account admins. Personnect.ai LLC, 8893 Cobblestone Point Circle, Boynton Beach, FL 33472, as processor (contact@personnect.ai). |
| People concerned | The people you upload, sync, enter or enrich and call: business contacts, and anyone else who has consented to your calls. |
| Kinds of data | Name; company; job title; business telephone numbers; business email address; location; fields synced from your CRM; notes your users write; lead enrichment results (public professional profile details, phone numbers listed on the profile, phone line details and a short summary). |
| Sensitive data | None. Section 10.7 of the Terms prohibits it. |
| Frequency | Continuous, for as long as you use the Services. |
| What we do with it | Store it; organize contacts into lists and campaigns; dial the numbers you choose and connect answered calls to your representatives; apply do-not-call and wrong-number suppression; show contacts to your users; sync with the CRM you connect; enrich the leads you choose; export; removal from view. |
| Purpose | Providing the Services to you under the Terms. |
| How long | As Section 11 describes. |
| Subprocessors | As listed in Annex III. |
17Annex II: Security measures
We apply these measures to Customer Personal Data, Personnect Data and Account Data. We describe them in plain terms and make no claim to any certification.
| Area | Measure |
|---|---|
| Encryption in transit | Our website and application are served only over HTTPS, and connections to our database require TLS. |
| Encryption at rest | Our database is encrypted at rest. Two-factor login secrets are also encrypted with AES-256-GCM. |
| Backups | Our database is backed up daily. |
| Passwords | Passwords are stored only as bcrypt hashes. |
| Separation of customers | Each customer’s contacts and calls are kept in their own database schema, and every other record is tied to its account so the application shows it only to that account. |
| Staff access | Staff accounts require two-factor login. Staff access to a customer’s data through our admin tools is logged, and administrative actions are recorded in an audit log. |
| Customer access | Customer admins can require two-factor login for their users. Representatives see only their own calls; managers and admins see all calls in their account. |
| Sign-in protection | Bot protection on sign-up and password sign-in, rate limiting, and protection against cross-site request forgery. |
| Testing | We run penetration tests regularly. |
| Customer verification | Accounts set up in the application pass identity, business and sanctions checks before they can dial. |
| Abuse controls | Calls to 911 are blocked. Contacts marked “do not call” or “wrong number” are excluded from automatic dialing. Calling hours and state rules are available, and we apply limits on lines and call volume. |
| Personnel | Everyone with access to customer data is bound by confidentiality. |
| Vulnerability reports | Report security issues to contact@personnect.ai. |
18Annex III: Subprocessors
The categories of Subprocessors we use, what each does and the data it receives are published on our Subprocessors page. That page, as updated under Section 8, is Annex III of this DPA.