Data Processing Addendum

1. Parties, scope, and priority

This addendum forms part of a customer-specific Customer Service Order accepted by both parties that expressly incorporates this addendum ("Order"), and accompanies the Business Terms of Service, edition ha-business-terms-2026-10-09-p3. The provider identified in the Order, operating as hello, answered. ("we"), and the business customer identified there ("Customer") are the parties. Their identities, addresses, contacts and the order number are incorporated from that Order. This addendum applies when we process personal information on Customer's behalf for the selected services ("Customer Data"). It continues while we hold Customer Data for that processing, including the agreed return and deletion work.

Customer determines the purposes of its customer communications and acts as controller or business, as applicable. We act as processor, service provider, or contractor for the processing we perform on Customer's documented instructions. The actual activity and applicable law determine the role; a contractual label does not change it. If Customer is itself acting for another controller, Customer must have authority to appoint us and convey that controller's lawful instructions.

We separately handle limited information needed for our own business relationship, billing, account administration, service security, and legal obligations as described in the Privacy Policy and the order. This does not permit us to relabel caller conversations as administrative data to avoid this addendum. Independent activities of another provider must also be separately lawful and accurately disclosed.

This addendum controls a conflict about processing Customer Data. The accepted order governs the service purchased, charges, cancellation, and the parties' agreed liability allocation, subject to nonwaivable law. This addendum does not create an additional liability cap or permit a website-policy update to expand the purposes for which Customer Data may be used.

2. Instructions and permitted purposes

Customer instructs us to process Customer Data only to perform the functions selected in both the accepted Order and its matching service/data schedule: answer and process routed inbound calls, Website Chat messages or supported texts using approved business information; generate the supported replies; capture the agreed message fields; deliver messages through approved destinations; maintain the related configuration and service records; and provide directly related support, security, rights-request assistance, and deletion. Unselected channels or integrations are not authorized by this addendum.

Where expressly selected in the Order and matching authenticated configuration, these instructions can also include checking caller-provided details against a connected CRM, delivering future captured callback details to that CRM, checking a selected calendar and creating, moving or canceling supported appointments. Each function is limited to its separately authorized scope and connection. A connection alone is not an instruction to import historical data or enable additional functions.

Where selected in the Order's service/data schedule and matching authenticated configuration, Customer may also instruct us to save AI-receptionist call recordings and transcripts, generate summaries from saved transcripts, provide the business account owner access and download of available content, and perform the selected retention and deletion work. Saving starts off. Customer chooses the retention period and spoken-notification setting and acknowledges its responsibility for applicable requirements when choosing no spoken notice. These are Customer instructions, not another person's consent or a transfer of our own duties. The limits, export handling and caller-withdrawal handling in Privacy Policy section 7.10 apply. If Customer selects full transcripts without saved audio, the matching configuration instructs us to use temporary Twilio recordings and OpenAI transcription processing solely to produce those transcripts. Temporary audio is excluded from Customer’s archive, playback and downloads. The processing deadline, deletion, opt-out and withdrawal handling in Privacy Policy section 7.10 apply.

Outbound processing is excluded unless the specific accepted Order and its matching service/data schedule expressly describe and authorize that program, including its purpose, recipient categories, sources of contact information, permitted actions, providers, and required notices and permissions. The service must also be technically available and separately enabled. Neither this addendum nor the mention of a possible outbound feature activates it or supplies another person's required consent.

The order, the approved profile and settings, and subsequent authenticated written directions are Customer's documented instructions. We will follow lawful instructions and promptly tell Customer if we believe an instruction violates applicable data-protection law or if we cannot meet the agreed processing obligations. We may pause the affected processing while the parties resolve that issue. If law requires different processing, we will inform Customer before doing it unless the law prohibits that notice.

We will not sell Customer Data, use it for cross-context behavioral or targeted advertising, or use customer or caller content to train our own general-purpose AI models. We will not opt Customer Data into a provider's optional general-purpose training program without a separate lawful agreement and any required permissions. These commitments do not represent that every provider acts only as our processor; Schedule B explains the distinction and does not authorize an otherwise prohibited disclosure.

Customer supplies accurate instructions, limits unnecessary personal information, and gives the notices and obtains the permissions required for its actual communication program. These include any required AI, audio-processing or recording notice and calling or texting permission. Customer's acceptance is not consent on behalf of every caller. We remain responsible for duties that apply directly to us and for the notices or controls we agree to provide.

The ordinary service is not authorized for protected health information requiring a business associate agreement, clinical advice, emergency dispatch, payment-card entry in conversation, or deliberate collection of unnecessary sensitive information. Accidental receipt does not remove applicable legal duties. A restricted use requires a separately agreed, supported arrangement before it begins. This U.S. business-services addendum is not an international-transfer mechanism, an executed SCC package, or a representation of full GDPR compliance.

3. Confidentiality and security

We will limit access to people who need Customer Data for the permitted work and are subject to appropriate confidentiality duties. Those duties continue after their access ends. We will use reasonable administrative, technical, and physical safeguards appropriate to the information and processing, including access controls, secure application connections, protection of credentials, safeguards for selected stored content, and procedures for responding to incidents and deletion requests. We will not materially reduce the agreed protection during the service term.

These are obligations to protect the processing, not a claim of audited certification, guaranteed security, independently generated encryption keys for every record, or encryption of every field and delivered copy. Schedule A must identify any additional security requirement the parties actually accept. Customer is responsible for protecting its own authorized recipients, devices, accounts, and copies we deliver to it.

4. Service providers and changes

Customer authorizes the direct subprocessors identified for its selected service in Schedule B. Before giving a subprocessor Customer Data, we will put in place a written agreement imposing the relevant processing, confidentiality, security, and other obligations required by this addendum and applicable law. We remain responsible for the processing obligations we undertake and for our subprocessors' performance of the duties we delegate.

We will tell Customer before authorizing a new or replacement direct subprocessor to receive its Customer Data, describe the function and relevant processing location, and give Customer a reasonable opportunity to raise a specific data-protection objection. We will work in good faith to resolve it, for example by using a supported alternative or stopping the affected processing. If it cannot reasonably be resolved, Customer may end the affected service; the accepted order and applicable law govern the resulting fees and refunds. A change required immediately for law, security, or service continuity may occur sooner to the extent permitted by law, with notice as soon as reasonably possible. This does not promise that upstream providers give us a particular advance-notice period.

A provider's independent payment, telecommunications, security, or legal activities are not silently brought under our instruction-only processing commitments. We must explain the relevant activity and have a lawful basis for the disclosure. Independent processing is not a workaround for service-provider restrictions, required downstream contracts, or our own obligations.

5. Requests, assistance, and verification

Customer may send instructions and privacy requests to hello@helloanswered.com. We will reasonably verify the requester and scope the request to the correct customer and records. An unavailable dashboard does not prevent a written request. We will assist Customer with applicable access, correction, deletion, portability, and other rights requests using appropriate measures that take account of the processing and information available to us, in time to enable compliance with applicable deadlines.

If an individual contacts us about Customer Data, we will promptly route the request to Customer and assist with it, unless law requires us to respond directly or prohibits disclosure. We will not require unnecessary identity documents or treat Customer's silence as permission to disregard a legal deadline. Each party remains responsible for requests involving information it controls independently.

We will provide information reasonably needed to verify compliance and assist with applicable security obligations and data-protection assessments. We will allow and cooperate with reasonable assessments by Customer, its qualified designee, or an appropriately qualified independent assessor, and provide relevant results as required by law. The parties will use reasonable notice, confidentiality, scope, and security arrangements to protect other customers and systems; those arrangements cannot defeat a legally required assessment. We do not promise an existing SOC 2 or ISO report. Optional work beyond required assistance may be separately agreed, but a fee arrangement will not delay assistance that law requires us to provide.

6. Security incidents

A "Security Incident" is accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data in our or our subprocessors' processing. Unsuccessful attempts that do not compromise Customer Data are not, by themselves, Security Incidents.

We will notify Customer without undue delay after becoming aware of, or having reason to believe there has been, a Security Incident, and within the deadlines required by applicable law. We will not wait for a completed forensic investigation or an internal label of "confirmed" to begin a legally required notice period. We will use the incident contact in Schedule A and a reasonable alternative if that contact fails.

The initial notice will include information reasonably available about the nature of the incident, affected data or people, likely consequences, and containment or mitigation. We will provide a contact, relevant updates as facts develop, and reasonable assistance with Customer's response. We will investigate and take appropriate containment and remediation measures. We will coordinate external notices where appropriate, but neither party may prevent the other from meeting a direct legal obligation. A notice is not an admission of liability. No fixed 24-hour or 72-hour contractual guarantee is made.

7. Retention, return, and deletion

We will follow Schedule A and Customer's lawful instructions. At Customer's direction or when the processing service ends, we will return or delete Customer Data, including remaining copies, unless law requires retention. Customer may request a reasonably usable copy of data still held; this can be fulfilled manually and does not require a dashboard export button. Data already removed under the agreed ordinary schedule cannot be recreated for an export.

We will handle the request promptly, explain the scope and any permitted exception or provider dependency, and confirm what was returned or deleted. If law requires retention, we will identify the category and reason where lawful, restrict use to that requirement, protect the retained information, and delete it when the requirement ends. A generic preference to keep data does not create a legal-retention exception.

Any lawful delayed deletion from backups must use the verified cycle recorded in Schedule B, keep those copies unavailable for ordinary use, and prevent a restoration from silently undoing a deletion instruction. We will pass applicable deletion instructions to our subprocessors and follow up on their completion. A customer's cancellation does not terminate our entire provider account or automatically start that provider's account-termination deletion clock.

Copies delivered to Customer or another recipient Customer selected are controlled separately by that recipient. Data a provider lawfully holds for an independent purpose must be addressed under the applicable law and provider process; we will provide reasonable assistance for information we disclosed. This distinction does not excuse a deletion or downstream-notification duty that applies to us. Cancellation, setup Forget, provider resource retirement, and deletion are separate actions that must be coordinated; none is represented as silently completing all the others.

8. California terms, where applicable

For Customer Data received as Customer's CCPA service provider or contractor, Customer discloses it only for the specific selected communication, capture, delivery, configuration, and directly related support and security purposes in section 2 and Schedule A. We will not sell or share it, retain, use or disclose it for another purpose or commercial purpose, process it outside the direct business relationship, or combine it with information from other sources or our own consumer interactions, except as expressly permitted by the CCPA and its regulations.

We will comply with the applicable CCPA requirements, provide the required level of privacy protection, enable Customer to comply with applicable consumer requests, and notify Customer if we determine we can no longer meet those obligations. Customer may take reasonable and appropriate steps to verify compliant use and, upon notice, stop and remediate unauthorized use. Section 5 permits the reviews, assessments, audits, or testing required by applicable law, including recurring review where required; it imposes no annual-only restriction. Subcontracted processing requires a written agreement meeting the applicable CCPA requirements. We understand and will comply with these restrictions. A provider's independent activity must be separately lawful and correctly classified; this paragraph does not permit circumvention through that provider.

Schedule A. Customer order and processing instructions

The accepted Order's completed service/data schedule supplies the customer-specific entries below and is incorporated here. The identities and contacts are supplied through that Order. Blank or unselected services are not activated by accepting this addendum.

Schedule B. Provider and storage record supplied with the order

The provider/storage record attached to the Order identifies the authorized providers, their contracting entities, applicable roles/agreements, processing locations and relevant storage/deletion arrangements. We use only providers needed for the selected service. Public brand names below identify anticipated services, not a claim that all rows are active or all activities are subprocessed.

The Order's record must identify the actual providers and agreement versions, processing locations, and provider/local backup lifecycle and deletion-request method. If a proposed provider cannot support the selected obligations, we exclude that processing or the parties agree a supported arrangement before we receive that data. The record must reflect verified arrangements, not assumed defaults.