GotAI Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the GotAI Terms of Service.

It applies where GotAI processes personal data on behalf of a business customer in connection with the GotAI AI phone answering service.

1. Parties

This DPA is between:

Customer The business, sole trader, partnership, company, or other organisation that uses GotAI.

Processor David Kirwan, trading as GotAI (“GotAI”, “we”, “us”).

For the purposes of this DPA:

• the Customer is the controller of Caller Data;
• GotAI is the processor of Caller Data;
• GotAI may use authorised sub-processors to provide the service.

2. How this DPA is accepted

The Customer accepts this DPA by doing any of the following:

• creating a GotAI account;
• starting a GotAI trial;
• paying for GotAI;
• using GotAI;
• diverting calls to GotAI;
• instructing GotAI to answer calls, process caller enquiries, generate transcripts, generate summaries, or send notifications.

If the Customer does not agree to this DPA, the Customer must not use GotAI.

The Customer must ensure that the person accepting this DPA has authority to bind the Customer.

3. Relationship with the Terms of Service

This DPA forms part of the GotAI Terms of Service.

If there is a conflict between this DPA and the Terms of Service on the processing of Caller Data, this DPA takes priority for that data-processing issue.

If there is a conflict between this DPA and mandatory data-protection law, mandatory data-protection law takes priority.

Commercial issues, payment, fair use, suspension, liability, and termination are governed by the Terms of Service unless this DPA says otherwise.

4. Definitions

In this DPA:

Applicable Data Protection Law means the GDPR, Irish data-protection law, and any other data-protection law that applies to the processing.

Caller means a person who phones or otherwise contacts the Customer and whose call or enquiry is handled by GotAI.

Caller Data means personal data processed by GotAI on behalf of the Customer through the service, including call content, caller contact details, transcripts, summaries, extracted enquiry fields, recordings where enabled, and related call metadata.

Customer means the business customer using GotAI.

Customer Account Data means personal data processed by GotAI for GotAI’s own account administration, billing, payment, service management, tax, accounting, security, support, and legal purposes. Customer Account Data is not Caller Data and is covered by the GotAI Privacy Policy.

GDPR means Regulation (EU) 2016/679, the General Data Protection Regulation.

Personal data, controller, processor, sub-processor, processing, data subject, and personal data breach have the meanings given to them under the GDPR.

Service means the GotAI AI phone answering, call handling, transcription, summarisation, notification, call-routing, and related support services.

Sub-processor means another processor engaged by GotAI to process Caller Data on behalf of the Customer.

5. Scope of this DPA

This DPA applies only to Caller Data processed by GotAI as processor on behalf of the Customer.

This DPA does not apply to Customer Account Data or other personal data for which GotAI acts as controller, including:

• GotAI customer account administration;
• GotAI billing and payment administration;
• GotAI tax and accounting records;
• GotAI sales communications;
• GotAI service security logs used for GotAI’s own security purposes;
• GotAI website enquiries;
• GotAI internal business records;
• legal claims, disputes, or compliance records held by GotAI.

Those activities are covered by the GotAI Privacy Policy.

6. Processing details

The processing details required under GDPR are set out below and in Annex 1.

6.1 Subject matter

GotAI processes Caller Data to provide AI phone answering and enquiry capture services for the Customer.

6.2 Duration

Processing continues for:

• the duration of the Customer’s trial or subscription;
• any additional period needed to provide the service;
• any agreed retention period;
• any period needed for deletion, backup expiry, security, billing reconciliation, legal compliance, dispute handling, or accounting.

6.3 Nature of processing

GotAI may perform the following processing activities:

• receive or handle calls;
• process caller speech;
• convert speech to text;
• create transcripts;
• create call summaries;
• extract enquiry fields;
• classify urgency;
• send notifications by SMS, email, webhook, or another configured channel;
• store enquiry records temporarily;
• store call metadata;
• route calls;
• configure AI answering agents;
• troubleshoot service issues;
• monitor service performance;
• maintain security logs;
• delete or export data where required.

6.4 Purpose of processing

The purpose of processing is to allow the Customer to:

• answer missed, diverted, or overflow calls;
• capture business enquiries;
• receive caller details;
• understand the nature and urgency of the enquiry;
• return calls with context;
• avoid losing business because calls were missed;
• maintain a limited operational record of enquiries.

6.5 Types of personal data

Caller Data may include:

• caller name;
• caller phone number;
• caller email address, if provided;
• general area or location;
• full address where configured by the Customer and necessary for the enquiry;
• job type, claim type, service type, or enquiry type;
• description of the issue;
• urgency;
• preferred callback time;
• call timestamp;
• call duration;
• call status;
• call recording, where enabled;
• transcript;
• summary;
• extracted enquiry fields;
• technical call metadata;
• information volunteered by the caller during the call.

6.6 Categories of data subjects

The data subjects may include:

• callers;
• prospective customers of the Customer;
• existing customers of the Customer;
• Customer staff or representatives;
• people mentioned by callers during a call.

6.7 Special categories of data

GotAI is not designed to intentionally collect special category data or highly sensitive personal data.

The Customer must not configure GotAI to intentionally collect:

• health data;
• medical information;
• biometric data;
• religious beliefs;
• political opinions;
• trade union membership;
• sexual orientation;
• criminal offence data;
• PPS numbers;
• passport numbers;
• driver’s licence numbers;
• bank details;
• card details;
• passwords;
• insurance policy numbers;
• security codes;
• detailed financial information;

unless this has been separately agreed in writing and the Customer has confirmed the required lawful basis, necessity, safeguards, notices, and legal compliance.

If a caller volunteers sensitive information during a call, GotAI may process it incidentally as part of the call handling, transcript, summary, or call record. Where practical and appropriate, GotAI may minimise, delete, or redact such information.

7. Customer responsibilities

The Customer is responsible for:

• deciding the purpose of processing Caller Data;
• deciding what Caller Data GotAI should collect;
• having a lawful basis for collecting and using Caller Data;
• providing appropriate privacy information to callers;
• approving the call-opening notice used by GotAI;
• complying with any call-recording, telecoms, industry, or professional rules that apply to the Customer;
• ensuring the service is suitable for the Customer’s industry and use case;
• not using GotAI for emergency calls or urgent services requiring immediate human intervention;
• not configuring GotAI to collect unnecessary or excessive data;
• not configuring GotAI to collect sensitive data unless legally justified;
• responding to caller requests where the Customer is controller;
• securing any Caller Data received from GotAI;
• managing Customer-side retention after GotAI sends summaries, emails, SMS messages, exports, webhooks, or notifications;
• ensuring that Customer staff, contractors, and representatives use the service lawfully.

The Customer must not use GotAI in a way that would cause GotAI to breach Applicable Data Protection Law.

The Customer acknowledges that GotAI does not decide the Customer’s lawful basis, caller notice wording, call-recording basis, retention policy, or industry-specific compliance obligations.

8. GotAI processor obligations

GotAI will:

• process Caller Data only on the Customer’s documented instructions;
• process Caller Data only for the purposes of providing, securing, supporting, maintaining, and operating the Customer’s service;
• ensure authorised persons with access to Caller Data are subject to confidentiality obligations;
• use reasonable technical and organisational security measures;
• use sub-processors only as permitted by this DPA;
• reasonably assist the Customer with data subject requests;
• reasonably assist the Customer with personal data breach handling;
• delete or return Caller Data as required by this DPA;
• make available reasonable information needed to demonstrate compliance with this DPA;
• inform the Customer if, in GotAI’s opinion, an instruction breaches Applicable Data Protection Law, unless legally prohibited from doing so.

GotAI is not responsible for determining whether the Customer’s lawful basis, privacy notice, call notice, call recording practice, retention period, or industry-specific compliance position is valid.

9. Documented instructions

The Customer instructs GotAI to process Caller Data as necessary to:

• provide the service;
• answer and handle calls;
• generate transcripts and summaries;
• extract enquiry fields;
• send notifications;
• store Caller Data for the agreed or default retention period;
• troubleshoot and support the service;
• maintain security and reliability;
• use authorised sub-processors;
• comply with the Terms of Service;
• comply with applicable law.

The Customer may give additional documented instructions by email, written configuration, support request, account setting, or another agreed method.

GotAI may decline or suspend an instruction that is unlawful, unreasonable, technically impractical, insecure, outside the service scope, inconsistent with the Terms of Service, or likely to create material risk for GotAI, the Customer, callers, or third parties.

10. Confidentiality

GotAI will ensure that any person authorised to process Caller Data is under an appropriate duty of confidentiality.

This may include contractual confidentiality, professional confidentiality, employment confidentiality, or equivalent obligations.

11. Security measures

GotAI will implement reasonable technical and organisational measures appropriate to the risk of the processing.

These may include, as applicable:

• access controls;
• limited internal access to Caller Data;
• use of reputable cloud, telecoms, AI, email, SMS, and infrastructure providers;
• encryption in transit where supported;
• password-protected administrative systems;
• multi-factor authentication where available and practical;
• role-based or least-privilege access where practical;
• service monitoring;
• logging for security and debugging;
• separation of customer configurations where practical;
• minimisation of Caller Data collected;
• retention limits;
• deletion of data no longer needed;
• supplier review where practical;
• backup and recovery measures where applicable.

GotAI may update its security measures over time, provided the updated measures do not materially reduce the overall protection of Caller Data.

No service is perfectly secure. The Customer must not send or request unnecessary sensitive information through GotAI.

12. Sub-processors

The Customer gives GotAI general written authorisation to use sub-processors to provide the service.

GotAI may use sub-processors for:

• AI voice processing;
• speech-to-text;
• transcription;
• call summarisation;
• call routing;
• telecoms;
• SMS delivery;
• email delivery;
• hosting;
• database storage;
• DNS;
• security;
• logging;
• monitoring;
• support;
• service operations.

Current authorised sub-processor categories are listed in Annex 3.

GotAI will take reasonable steps to ensure that sub-processors are bound by appropriate data-protection obligations.

GotAI remains responsible to the Customer for the performance of its sub-processors’ data-processing obligations where required by Applicable Data Protection Law.

Customer Account Data processors, such as payment processors used only for GotAI billing, are covered by the GotAI Privacy Policy and are not listed as Caller Data sub-processors unless they process Caller Data.

13. Changes to sub-processors

GotAI may add, remove, or replace sub-processors.

Where a change materially affects the processing of Caller Data, GotAI will take reasonable steps to notify active Customers before the change takes effect, unless urgent replacement is needed for security, availability, legal, or operational reasons.

The Customer may object to a new sub-processor on reasonable data-protection grounds by contacting GotAI promptly after notice.

The objection must explain the specific data-protection concern.

GotAI may respond by:

• addressing the concern;
• changing configuration where practical;
• using a different provider where commercially and technically reasonable;
• confirming that the sub-processor is necessary for the service;
• suspending or terminating the affected service.

If the Customer reasonably objects and GotAI cannot provide the affected service without that sub-processor, either party may terminate the affected service. The Customer’s only remedy in that case is termination of the affected service and any refund required by the Terms of Service or applicable law.

14. International transfers

Some sub-processors may process Caller Data outside the European Economic Area.

Where GotAI transfers Caller Data outside the EEA, GotAI will use appropriate transfer mechanisms where required, such as:

• European Commission Standard Contractual Clauses;
• adequacy decisions;
• UK transfer mechanisms where relevant;
• supplementary contractual, technical, or organisational safeguards where required.

The Customer authorises GotAI to make international transfers as reasonably necessary to provide the service, subject to the safeguards described in this DPA.

Where Standard Contractual Clauses are required for a transfer from GotAI to a non-EEA sub-processor, GotAI will use the appropriate module where available and applicable.

This DPA does not itself replace any mandatory Standard Contractual Clauses that are legally required for a restricted transfer.

15. Data subject requests

If GotAI receives a request from a caller or other data subject relating to Caller Data, GotAI may:

• forward the request to the Customer;
• tell the requester to contact the Customer directly;
• request information needed to identify the relevant Customer or call;
• assist the Customer in responding, where required.

The Customer is responsible for responding to data subject requests where the Customer is controller.

GotAI will not independently respond to a data subject request concerning Caller Data unless:

• instructed by the Customer;
• required by law;
• the request relates to data for which GotAI is controller.

GotAI may charge a reasonable fee for assistance that is excessive, repetitive, complex, outside normal support, or caused by the Customer’s own configuration or legal obligations.

16. Personal data breaches

If GotAI becomes aware of a personal data breach affecting Caller Data processed on behalf of the Customer, GotAI will notify the Customer without undue delay.

The notification will include available information reasonably needed by the Customer to assess the breach, which may include:

• the nature of the breach;
• affected data categories;
• affected data subjects, where known;
• likely consequences, where known;
• measures taken or proposed by GotAI;
• information needed for the Customer’s own notification assessment.

GotAI will provide further reasonable information as it becomes available.

GotAI’s notification of a breach is not an admission of fault or liability.

The Customer is responsible for deciding whether a breach must be notified to a supervisory authority or affected individuals where the Customer is controller.

17. Assistance with compliance

Taking into account the nature of the processing and the information available to GotAI, GotAI will reasonably assist the Customer with:

• data subject rights requests;
• security obligations;
• breach assessment and notification;
• data protection impact assessments;
• prior consultation with a supervisory authority, where required.

GotAI’s assistance is limited to the processing carried out by GotAI under this DPA.

GotAI is not responsible for the Customer’s wider GDPR compliance, privacy notices, lawful basis assessments, retention policies, call recording policies, DPIAs, records of processing, or industry-specific legal obligations.

GotAI may charge a reasonable fee for assistance that is excessive, repetitive, complex, outside normal support, or caused by the Customer’s own configuration or legal obligations.

18. Deletion or return of Caller Data

At the end of the service, GotAI will delete or return Caller Data on the Customer’s reasonable instruction, unless GotAI is required or permitted to retain it by law, accounting rules, security obligations, dispute handling, or legitimate legal reasons.

If the Customer does not give a specific instruction, GotAI may delete Caller Data after the applicable retention period.

Data contained in backups may remain until overwritten or deleted in the ordinary backup cycle.

Customer copies of Caller Data are outside GotAI’s control after they have been sent to the Customer by SMS, email, webhook, CRM integration, download, export, or another notification channel.

19. Default retention periods

Unless otherwise agreed in writing, GotAI’s default retention periods for Caller Data are:

GotAI may retain Caller Data for longer where reasonably necessary for:

• legal compliance;
• fraud prevention;
• security investigation;
• dispute resolution;
• enforcing the Terms of Service;
• protecting GotAI’s legal rights.

The Customer is responsible for setting its own retention rules for Caller Data once received from GotAI.

Customer Account Data, invoices, billing records, tax records, and accounting records are covered by the GotAI Privacy Policy and are not governed by this DPA’s Caller Data retention table.

20. Audits and compliance information

GotAI will make available reasonable information necessary to demonstrate compliance with this DPA.

The Customer may request reasonable information about GotAI’s processing, security measures, sub-processors, and compliance with this DPA.

GotAI will allow for and contribute to audits, including inspections, where required by Applicable Data Protection Law, subject to reasonable confidentiality, security, operational, and proportionality controls.

Any audit or information request must be:

• reasonable;
• proportionate;
• limited to Caller Data processed for the Customer;
• subject to confidentiality;
• conducted in a way that does not compromise GotAI’s security, other customers’ data, trade secrets, systems, or operations;
• limited to once per year unless required by a serious security incident, material compliance concern, or supervisory authority.

GotAI may satisfy audit requests by providing:

• written answers;
• security summaries;
• policy summaries;
• sub-processor information;
• relevant certifications or reports, if available;
• other reasonable evidence of compliance.

GotAI may charge a reasonable fee for audit support that is excessive, repetitive, complex, or outside normal support.

21. Customer audits of sub-processors

The Customer does not have a direct audit right over GotAI’s sub-processors under this DPA.

GotAI will rely on contractual rights, published security documentation, certifications, compliance materials, data-processing terms, or reasonable supplier review to assess sub-processors.

22. Return, export, and portability

Where technically available and reasonable, GotAI may provide Caller Data exports to the Customer.

Exports may include:

• enquiry summaries;
• transcripts;
• call metadata;
• configuration records containing Caller Data;
• other available service records.

GotAI is not required to create custom export formats, rebuild deleted data, recover expired backups, or provide data that is no longer retained.

23. No sale of Caller Data

GotAI will not sell Caller Data.

GotAI will not use Caller Data to market directly to callers.

GotAI will not disclose Caller Data except as needed to provide the service, comply with law, use authorised sub-processors, protect legal rights, investigate abuse, or follow the Customer’s documented instructions.

24. AI processing and model training

GotAI may use AI systems to answer calls, process speech, transcribe calls, generate summaries, extract enquiry fields, classify urgency, and support service operation.

GotAI will not use Caller Data to train general-purpose AI models unless separately agreed in writing.

GotAI may use limited operational data to test, debug, monitor, secure, and improve the operation of the service for the Customer, provided this is done consistently with this DPA and the Terms of Service.

The Customer is responsible for ensuring that callers receive appropriate notice of AI answering, transcription, summarisation, and recording where applicable.

25. No automated legal or significant decisions

GotAI does not use Caller Data to make decisions that produce legal effects or similarly significant effects on callers.

GotAI produces call summaries, enquiry notifications, and operational outputs for the Customer.

The Customer remains responsible for deciding whether and how to respond to the caller.

GotAI does not provide legal, medical, financial, insurance, emergency, or professional advice.

26. Emergency and high-risk use

The Customer must not use GotAI as an emergency service, emergency call handler, medical triage service, legal advice service, financial advice service, insurance decision service, safeguarding service, crisis service, or any service where immediate human response is required by law, safety, or the nature of the service.

GotAI is designed for business enquiry capture, not emergency response.

27. Customer-side systems

GotAI is not responsible for the Customer’s own systems, devices, email inboxes, SMS inboxes, CRM systems, spreadsheets, phones, staff, contractors, or data-handling practices.

Once Caller Data is sent to the Customer, the Customer is responsible for protecting it.

This includes Caller Data sent by:

• SMS;
• email;
• webhook;
• CRM integration;
• export;
• download;
• manual copy;
• any other delivery method configured by or for the Customer.

28. Legal requests

If GotAI receives a lawful request from a public authority, court, regulator, or law enforcement body for Caller Data, GotAI may respond where legally required.

Where legally permitted and practical, GotAI will notify the Customer before disclosing Caller Data.

GotAI may refuse, challenge, or narrow a request where GotAI considers it unlawful, excessive, or inappropriate.

29. Suspension of processing

GotAI may suspend processing of Caller Data if:

• the Customer breaches this DPA;
• the Customer breaches the Terms of Service;
• the Customer uses GotAI unlawfully;
• the Customer instructs GotAI to process data unlawfully;
• processing creates a security, legal, operational, or reputational risk;
• required by law;
• necessary to protect GotAI, the Customer, callers, or third parties.

30. Liability

Liability under this DPA is subject to the limitations and exclusions in the GotAI Terms of Service, except where such limitations are not permitted by applicable law.

Nothing in this DPA limits liability where liability cannot legally be limited.

31. Termination

This DPA ends when GotAI no longer processes Caller Data on behalf of the Customer, except for clauses that need to continue after termination.

Clauses that may continue include:

• confidentiality;
• deletion and retention;
• audit and compliance information;
• liability;
• international transfers;
• legal requests;
• governing law;
• any clause necessary to interpret or enforce this DPA.

32. Changes to this DPA

GotAI may update this DPA from time to time.

Where practical, GotAI will notify active Customers of material changes.

If a Customer continues to use GotAI after the updated DPA takes effect, the Customer is treated as having accepted the updated DPA.

If a Customer does not agree to a material change, the Customer must stop using GotAI and may terminate the affected service.

33. Governing law

This DPA is governed by the laws of Ireland, unless mandatory data-protection law provides otherwise.

34. Contact

Questions about this DPA should be sent to:

hello@gotai.ie

Annex 1: Processing Description

A. Subject matter

AI phone answering, caller enquiry capture, transcription, summarisation, notification delivery, and related support services provided by GotAI to the Customer.

B. Duration

For the duration of the Customer’s trial or subscription, plus any applicable retention, deletion, backup, legal, security, or dispute period.

C. Nature of processing

Collection, recording where enabled, transmission, storage, transcription, summarisation, extraction, classification, routing, notification, retrieval, deletion, export, support, security monitoring, and troubleshooting.

D. Purpose of processing

To help the Customer answer missed, diverted, or overflow calls and receive structured business enquiry details from callers.

E. Types of personal data

• caller name;
• caller phone number;
• caller email, if provided;
• general area or location;
• address, if configured and necessary;
• enquiry type;
• job, claim, or service details;
• urgency;
• preferred callback time;
• call timestamp;
• call duration;
• call status;
• call recording, if enabled;
• transcript;
• summary;
• extracted fields;
• technical metadata.

F. Categories of data subjects

• callers;
• prospective customers of the Customer;
• existing customers of the Customer;
• Customer staff or representatives;
• people mentioned during calls.

G. Special category data

Not intentionally collected unless separately agreed in writing.

May be incidentally captured if volunteered by a caller.

H. Frequency of processing

Continuous or on-demand, depending on call volume and Customer use.

I. Location of processing

Ireland, the EEA, the United Kingdom, the United States, or other locations used by GotAI’s authorised sub-processors, subject to applicable transfer safeguards.

Annex 2: Technical and Organisational Measures

GotAI’s technical and organisational measures may include:

1. Access control

• limiting access to systems and data;
• use of password-protected accounts;
• use of multi-factor authentication where available and practical;
• limiting administrative access to people who need it;
• removing access when no longer needed.

2. Data minimisation

• collecting only enquiry information needed for the service;
• configuring agents to avoid unnecessary sensitive data;
• keeping default retention periods limited;
• deleting data no longer needed.

3. Transmission security

• encryption in transit where supported;
• use of HTTPS, TLS, or provider-secured APIs where available;
• use of reputable telecoms, email, SMS, AI, hosting, and infrastructure providers.

4. Storage security

• use of reputable cloud and infrastructure providers;
• limiting retained transcripts, summaries, recordings, and metadata;
• backup retention limits where applicable.

5. Operational security

• service monitoring;
• logs for debugging and abuse detection;
• investigation of suspected misuse;
• supplier review where practical;
• separation of customer configurations where practical.

6. Confidentiality

• confidentiality obligations for authorised personnel;
• limiting data access to service, support, security, legal, or operational need.

7. Availability and resilience

• use of third-party infrastructure providers;
• backup or recovery mechanisms where applicable;
• operational monitoring where practical.

8. Incident response

• investigation of suspected data breaches;
• customer notification without undue delay where Caller Data is affected;
• mitigation steps where practical.

9. Sub-processor controls

• use of appropriate vendor terms where available;
• use of data-protection terms, DPAs, SCCs, or equivalent mechanisms where required;
• replacement or suspension of sub-processors where necessary.

Annex 3: Authorised Sub-Processor Categories

The Customer gives general written authorisation for GotAI to use sub-processors in the following categories.

Current or expected providers may include Retell, VoIPLine, Twilio, Sinch, Resend, Zoho, Cloudflare, and equivalent providers, depending on service configuration.

Payment processors used only for GotAI billing, such as Stripe, are not Caller Data sub-processors unless they process Caller Data.

GotAI should maintain an up-to-date internal or public list of active sub-processors used for Caller Data.

Annex 4: Call Notice Requirements

The Customer must ensure that callers receive appropriate information about GotAI’s involvement.

Where GotAI answers a call, the call should include a short notice at or near the start of the call.

Example notice where transcription and summarisation are enabled:

Example notice where recording is enabled:

The Customer is responsible for approving the final wording and ensuring that it is lawful and suitable for the Customer’s business, sector, callers, and lawful basis.