This Data Processing Addendum ("DPA") forms part of the Terms of Service between ProReach and the business customer ("you") and governs how personal data is handled when we provide the Service.
01Roles of the parties
For the personal data processed through the Service, you are the controller (and "business" under US state privacy laws) and ProReach is the processor (and "service provider"). You determine the purposes of the processing; we process personal data only to provide the Service and only on your documented instructions, including the instructions set out in the Terms and this DPA.
02What we process
- Categories of data: caller phone numbers, the dialed business number, call status and timestamps, and the content and delivery status of text-back messages.
- Data subjects: people who call your connected business line.
- Purpose: detecting unanswered calls and sending the text-back reply in your name.
- Duration: for the term of your account, plus a limited retention period for billing and compliance, after which data is deleted.
03Our obligations as processor
- Process personal data only on your documented instructions and for no other purpose.
- Not "sell" or "share" personal data, and not retain, use, or disclose it outside the direct business relationship or as permitted by law.
- Keep personal data confidential and limit access to personnel who need it to operate the Service.
- Apply reasonable technical and organizational security measures, including encryption of data in transit.
- Assist you, taking into account the nature of the processing, in responding to data-subject requests (access, deletion, correction) and to opt-out signals.
- On termination, delete or return personal data, except where retention is required by law.
- Make available information reasonably necessary to demonstrate compliance with this DPA.
04Sub-processors
You authorize ProReach to engage the sub-processors below to deliver the Service. Each receives only the data needed for its function. We will give notice of any new sub-processor before it begins processing.
| Sub-processor | Function |
|---|---|
| Twilio | Telephony & SMS delivery |
| Anthropic | AI generation of message text (caller numbers excluded from prompts) |
| Workflow & site hosting | Running the automation and website |
| Merchant of record (Polar) | Payment processing & billing |
05International transfers
ProReach is operated from outside the United States, and personal data may be processed in or accessed from other countries. Where data is transferred across borders, we rely on appropriate safeguards and process it consistently with this DPA and applicable law.
06Your obligations
You are responsible for the lawfulness of the data you bring into the Service, for any notices or consents required from data subjects, and for instructing us only to process data in ways permitted by applicable law.
07Conflict and contact
If this DPA conflicts with the Terms on the handling of personal data, this DPA controls. Questions: info@proreachleads.com.