Data Processing Addendum

1. Scope and parties

This Data Processing Addendum (DPA) forms part of the Temsor Terms of use and applies whenever Temsor processes personal data on behalf of a business that uses the service. For that data the business is the data controller and Temsor is the data processor (and, where the GDPR applies, a processor under GDPR art. 28). For the business’s own account and sign-in data Temsor is the controller, as described in the Privacy notice, where Temsor’s identity and contact details are also given (section 1). Where this DPA and the Terms differ on data protection, this DPA prevails; liability under this DPA is subject to the limitation in section 6 of the Terms. The business accepts this DPA by using the service; where the panel asks for explicit acceptance (required before the AI voice agent is turned on), the accepted version, time and account are recorded.

2. Subject, nature, purpose and duration

Temsor processes personal data only to provide the service the business configures: answering and routing calls on its numbers, running IVR flows, voicemail, the AI voice agent, callback and appointment requests, call records (CDR), analytics and exports. Processing lasts for the life of the account plus the deletion period in section 13.

3. Data subjects and data categories

Data subjects: the business’s callers and customers, and other people whose data the business brings into the service. Data categories: phone number and call metadata (time, duration, line, outcome); voicemail recordings and their automatic transcripts where the business turns voicemail on; call transcripts the business sends in and their AI summaries (paid add-on); appointment and callback requests (name, number, short note); for AI voice agent calls, a call summary (the caller’s language, stated name, a short description of the request, appointment time and service type, callback request). Temsor does not record AI voice agent conversations and does not keep their transcripts. Special categories of personal data are not meant to be processed (section 8).

4. Documented instructions

Temsor processes the data only on the business’s documented instructions: this DPA, the Terms, the settings the business makes in the panel and its API calls. If Temsor believes an instruction breaches applicable data protection law, it tells the business without delay and may pause that processing. Temsor does not sell the data, does not use it to train AI models and does not use it for its own purposes, unless the law requires it.

5. Confidentiality and security

Everyone at Temsor with access to the data is bound by confidentiality. Temsor maintains appropriate technical and organizational measures, including: encryption in transit (TLS) for the panel, APIs and webhooks; protected storage of credentials and secrets; least-privilege, key-based administrative access and optional two-factor authentication for accounts; logs kept free of callers’ phone numbers, secrets and call content; separation of each business’s data in the application; continuous monitoring. Measures are reviewed whenever the service changes.

6. Sub-processors

The business gives Temsor general authorization to use sub-processors. Current list (name — task — location): Contabo — server hosting for the application, databases and call media — EU (France); Telnyx — phone numbers, call transport (SIP/PSTN) and browser calling — US; Microsoft Azure AI Speech — text-to-speech for IVR prompts and speech-to-text for voicemail transcripts — EU (Ireland); Google Cloud (Vertex AI Gemini Live API) — real-time voice AI for the AI voice agent on calls from withheld or unrecognised numbers and from Turkish (+90) numbers — EU (Google Cloud EU region); OpenAI — real-time voice AI for the AI voice agent, on calls from recognised international-format numbers other than Turkish (+90) numbers — US; xAI — AI model for API product features — US; Groq — AI call summaries (paid add-on) — US; Supabase — sign-in and account database for the portal — US; Resend — transactional email (sign-in codes, call summaries, notifications) — US; Polar — payments and invoicing as merchant of record — US; Cloudflare — DNS and network security — global. Each sub-processor is bound by a data processing agreement with obligations at least as protective as this DPA (and meeting GDPR art. 28(4) where it applies), and Temsor remains responsible to the business for its performance. Before adding or replacing a sub-processor, Temsor updates this list and emails the account owner at least 30 days in advance. The business may object in writing within those 30 days on reasonable data protection grounds; the parties then look for a solution in good faith, and if none is found the business may stop using the affected feature or close its account without penalty. In an emergency (for example a provider failure that threatens the service) the notice may be shorter; Temsor then informs the business as soon as possible and the objection right applies in the same way.

7. International transfers

Temsor is operated from Türkiye, by the person named in the Privacy notice, and the sub-processors in section 6 process the data in the European Union and the United States; personal data is therefore transferred to, and may be accessed from, those countries and Türkiye. Each transfer is covered by the data processing agreement with the sub-processor and, where the law of the sending country requires it, by standard contractual clauses (for example the EU standard contractual clauses offered in the sub-processor’s data processing terms) or comparable contractual safeguards. The country-specific terms in sections 16 to 20 set out how this meets US, Canadian, Australian, New Zealand and Mexican law. Calls from withheld or unrecognised numbers and from Turkish (+90) numbers are never sent to OpenAI; for them the AI voice agent uses only Google Cloud (Vertex AI, EU region). The only exception is a Temsor-internal test line used by Temsor staff who have consented, on which providers may be compared.

8. Health and special category data

The service is not designed to process special categories of personal data (for example GDPR art. 9), including health data. The business must not configure flows, prompts or forms that ask callers for health, biometric or other special category data. The AI voice agent does not diagnose, give medical advice or ask about health details, and it asks callers not to share them; summaries contain only a short description of the request, and the agent is instructed not to record health details.

9. AI voice agent and call summaries

When the business turns on the AI voice agent, callers hear at the start of the call that they are speaking with an AI assistant on behalf of the business. Audio is streamed in real time to the voice AI provider only to generate responses; the caller’s phone number is not sent to it. Temsor does not record the conversation; the provider may keep call data for a limited time for abuse monitoring under its terms (at most 30 days for OpenAI; Google Cloud may also cache it in memory for up to 24 hours). At the end of the call a summary is emailed to the address the business sets; from then on that email is the business’s own record. Temsor keeps a summary only to deliver it and does not store it.

10. Assistance to the business

Taking into account the nature of the processing, Temsor helps the business answer data subject requests (access, correction, deletion, objection) through panel exports and deletion, and forwards to the business any request it receives directly, without answering it on the merits unless the business instructs it to. Temsor also gives the information the business reasonably needs for its privacy notices, data protection impact assessments and consultations with authorities.

11. Personal data breach

Temsor notifies the business by email to the account owner without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting the business’s data. The notice describes, as far as known, the nature of the breach, the categories and approximate number of people and records concerned, likely consequences, and the measures taken or proposed; missing details follow as they become available. This supports the business’s own duty to notify the competent authority and the people affected under the law that applies to it (see sections 17 to 20).

12. Audits

Temsor makes available the information needed to show compliance with this DPA and answers one reasonable written security questionnaire per year free of charge. It allows audits by the business or an independent auditor bound by confidentiality, with at least 30 days’ notice, during business hours, without access to other customers’ data and at the business’s cost. Audits ordered by a competent authority are allowed as the law requires.

13. Deletion and return

During the account the business can export its call records and data from the panel at any time. Call records and appointment or callback requests are kept for up to 90 days and voicemail for 30 days, unless the business sets a shorter period. When the account is closed, Temsor deletes the business’s personal data within 30 days, unless the law requires it to be kept (for example invoices and accounting records).

14. GDPR art. 28

For data covered by the GDPR, sections 2 to 13 set out the terms required by GDPR art. 28(3)(a)–(h): processing on documented instructions, confidentiality, security (art. 32), conditions for sub-processors, assistance with data subject rights and arts. 32–36, deletion or return, and audits. The AI voice agent is not currently offered to businesses established in the EU or on EU phone numbers.

15. Changes to this DPA

Temsor may update this DPA to reflect changes in law or in the service. Material changes are announced to the account owner by email at least 30 days before they take effect and are accepted again in the panel; the version and date appear at the top of this page. Changes required by law or by an authority may apply sooner.

16. United States terms

For a business whose workspace country is the United States, Temsor acts as its service provider and contractor under the California Consumer Privacy Act (as amended by the CPRA) and comparable US state privacy laws, to the extent they apply. Temsor processes personal information only for the purposes in section 2; does not sell or share it; does not retain, use or disclose it outside its direct business relationship with the business, or combine it with personal information from other sources, except as those laws allow; provides the level of privacy protection those laws require and tells the business if it can no longer meet these obligations; and lets the business take reasonable steps to stop and remediate unauthorized use. Temsor certifies that it understands and will comply with these restrictions. Temsor plays the AI and recording announcement at the start of every call and the business must not remove or shorten it; the business remains responsible for any other consent its calls require. The service is not offered as a HIPAA business associate and Temsor does not sign business associate agreements: the business must not use it where HIPAA requires one (see section 8).

17. Canadian terms

For a business whose workspace country is Canada (businesses located in Québec may not use the service yet), the business remains accountable under PIPEDA for personal information it transfers to Temsor, and Temsor provides a comparable level of protection by contract: it uses the information only for the purposes in section 2, protects it with the safeguards in section 5, shares it only with the sub-processors in section 6 and deletes or returns it under section 13. Personal information is processed in the European Union and the United States and may be accessible to authorities there; the business must tell its callers this (section 10 of the Temsor Privacy notice can be used). Temsor notifies the business of a breach of security safeguards involving its personal information within the 48 hours in section 11, with the information the business needs to assess real risk of significant harm and to report it to the Office of the Privacy Commissioner of Canada and to the people affected, and keeps a record of every such breach for at least 24 months.

18. Australian terms

For a business whose workspace country is Australia, Temsor handles the personal information it receives only on the business’s behalf and on its instructions, and complies with the Australian Privacy Principles as if it were an APP entity, whether or not the small business exemption applies to Temsor. This is the contractual step the business takes under APP 8.1 before personal information leaves Australia; it also keeps the information under the business’s effective control. Personal information is processed in the European Union and the United States by the sub-processors in section 6. Temsor notifies the business of a breach within the 48 hours in section 11, with the information it needs to assess whether it is an eligible data breach and, if so, to notify the Office of the Australian Information Commissioner and the people affected under the Notifiable Data Breaches scheme, and helps it finish that assessment within 30 days. Temsor does not make decisions for the business that significantly affect individuals; the business is responsible for its own privacy policy, including any automated decision-making statement required by APP 1.7 from 10 December 2026. Proof of address the business gives for a local number is used only for the carrier’s number registration. To help with this, the Compliance kit in Temsor Studio drafts an APP 1.7 paragraph and the call notice from the business’s flow; the drafts are a tool only and do not change the business’s responsibility under this section.

19. New Zealand terms

For a business whose workspace country is New Zealand, Temsor holds personal information only as the business’s agent under section 11 of the Privacy Act 2020: it does not use or disclose it for its own purposes, and the business remains the agency responsible for it, including the IPP 3A notices owed to people whose information it collected indirectly and gives to Temsor. The sub-processors in section 6 hold it on the same basis, and where one is not acting only as an agent, Temsor binds it by contract to safeguards comparable to the Privacy Act (IPP 12). Temsor notifies the business of a privacy breach within the 48 hours in section 11, with the information it needs to assess serious harm and to notify the Privacy Commissioner and the people affected as soon as practicable, and helps it answer access and correction requests within the 20 working days the Act allows. The Compliance kit in Temsor Studio drafts the IPP 3 and 3A notice for callers from the business’s flow; the draft is a tool only and does not change the business’s responsibilities under this section.

20. Mexican terms

For a business whose workspace country is Mexico, the business is the responsable and Temsor is its encargado under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, 2025), which binds encargados directly. Temsor processes callers’ personal data only on the business’s documented instructions (section 4) and for no other purpose; keeps it confidential and protects it with the measures in section 5; passes it only to the sub-processors in section 6, each acting on the business’s behalf and bound by contract to the same obligations, or where the law requires it; and deletes or returns it when the service ends (section 13). These transfers are needed to perform the contract between the business and its callers, so they need no separate consent (LFPDPPP article 36); the business lists them in its own privacy notice (aviso de privacidad). Temsor notifies the business of a security breach within the 48 hours in section 11, with the information it needs to inform the people affected without delay, and helps it answer ARCO requests within the 20 days the law allows.

21. Contact

Data protection questions, sub-processor objections and audit requests: [email protected].