Data Processing Agreement

1. Definitions#

• Personal Data — Any information relating to an identified or identifiable natural person processed via CallMissed services.
• Processing — Any operation performed on Personal Data, including collection, storage, transmission, and deletion.
• Sub-processor — A third party engaged by CallMissed to process Personal Data on our instructions.

2. Scope and roles#

The Controller determines the purposes and means of processing customer end-user data. CallMissed processes such data only on documented instructions from the Controller, as configured in the dashboard, API, or a signed order form.

For account and billing data relating to the Controller's organisation, CallMissed acts as an independent Data Fiduciary. For end-user data processed through the Controller's bots and integrations, CallMissed acts as a Data Processor.

Controller warranties. The Controller warrants that it has a valid legal basis to collect and share the end-user Personal Data it submits, that it has provided all notices and obtained all consents required under applicable law (including from data principals whose data is processed through the Service, and including notice of call recording, live monitoring, and AI interaction), that it has scrubbed outbound lists against applicable do-not-disturb registers, and that its instructions to CallMissed are lawful. The Controller's configuration of agents, tools, integrations, webhooks, and MCP connections constitutes its documented instructions, including instructions to transmit Personal Data to third-party services and endpoints the Controller selects; those recipients are not CallMissed sub-processors, and the Controller is responsible for its arrangements with them. CallMissed processes Personal Data only on the Controller's documented instructions and will inform the Controller if, in its opinion, an instruction infringes applicable data protection law.

3. Details of Processing#

• Subject matter: Provision of CallMissed's AI communication, messaging, voice, and developer-API services.
• Duration: For the term of the Controller's subscription, plus any legally required retention period.
• Nature and purpose: Hosting, storage, transmission, real-time voice processing, call recording and transcription, automated AI processing (language models, speech-to-text, text-to-speech, embeddings, web search), conversation analysis (summaries, sentiment and outcome classification, call scoring, answering-machine detection), contact and agent memory, rule-based lead scoring, CRM and support workflows, execution of agent tools and integrations configured by the Controller, analytics, and deletion, solely to provide the Service as configured by the Controller.
• Categories of data principals: The Controller's end-customers, callers, message recipients, leads, and contacts; people who report the Controller's numbers as spam; the Controller's authorised users and team members; and any individuals referenced in content the Controller submits.
• Categories of Personal Data: Contact identifiers (name, phone, email), consent and do-not-call records, message, email, social, and conversation content, live call audio, call recordings, transcripts and AI-derived analysis, facts remembered about contacts, CRM records, tickets and survey responses, order and form responses, uploaded documents and knowledge-base content, usage metadata, and any other Personal Data the Controller chooses to submit.
• Special / sensitive data: The Controller decides whether to submit sensitive data (for example, health or financial information). If it does, it is responsible for ensuring an appropriate lawful basis and safeguards.

4. Data location and cross-border transfers#

CallMissed hosts primary production systems on Microsoft Azure data centres in India (Central India region). Customer personal data and service content are ordinarily stored and processed within India unless we notify you otherwise in writing or applicable law requires a different approach.

We store and process customer personal data primarily within India. Certain service-partner categories (for example, some AI inference, web search, product analytics and session replay, push-notification delivery, telecom compliance, and global messaging, social, calendar, commerce or identity services you choose to connect) may process limited data outside India. Where this occurs we rely on contractual safeguards with each partner and transfer personal data only to jurisdictions not restricted by the Government of India, consistent with Section 16 of the DPDPA. Enterprise customers may request transfer details and the sub-processor schedule under our Data Processing Agreement.

5. Sub-processors#

We engage vetted service partners who process personal data on our instructions and only for specified purposes. We do not publish partner or sub-processor names on public marketing or legal pages; enterprise customers may request the current sub-processor schedule via karan@callmissed.com or our Data Processing Agreement.

We maintain a written sub-processor register available to enterprise Controllers on request, organised by processing category (for example, cloud hosting and storage, AI inference, speech services, embeddings, web search, telecom carriers, messaging and social platforms, email delivery, push-notification delivery, payment gateway, identity, bot protection, analytics, and CDN).

All sub-processors are bound by contracts requiring: (a) processing only on our instructions; (b) confidentiality; (c) security safeguards consistent with DPDP Rules Rule 6; (d) assistance with data principal requests; and (e) prompt breach notification.

We will notify Controllers of material sub-processor changes via email or dashboard notice at least 30 days in advance. Controllers may object on reasonable grounds relating to data protection.

6. Security measures#

CallMissed implements technical and organizational measures summarised on our Security and Trust Center pages, including encryption in transit and at rest, access controls, tenant isolation, logging, and backups within India. Personnel with access to Personal Data are bound by confidentiality obligations. Detailed control evidence is available to enterprise Controllers on request.

7. Data subject / data principal rights#

CallMissed will assist the Controller in responding to data principal requests (access, correction, erasure, grievance) where technically feasible, via API and dashboard tools or manual support within timelines prescribed under applicable law.

8. Breach notification#

CallMissed will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data. Where required, we will also notify affected data principals and the Data Protection Board of India in accordance with DPDP Rules Rule 7 (including a detailed report within 72 hours where applicable).

9. Termination and data return#

Before termination, the Controller can export Personal Data using the Service's export tools, and may request assistance with data not covered by them. Upon termination, CallMissed will delete or return Personal Data within 30 days unless retention is required by law; call recordings are erased on the Controller's request made before or during that period. A deletion confirmation is available to enterprise Controllers on request. See Account Deletion for self-service deletion steps.

10. Agencies#

Where an agency manages a client account through the Service, the agency and its client determine between themselves which of them is the Controller for end-user Personal Data. CallMissed acts as Processor, or as sub-processor to the agency, and follows instructions given through the client account by either of them. The agency is responsible for being authorised by the client to access the client account and its data.

11. Audits#

Upon reasonable notice and subject to confidentiality, enterprise Controllers may request summaries of our security controls or completed audit reports where available. Onsite audits may be conducted no more than once per year unless required by regulators.

12. Precedence and Contact#

For the processing of end-user Personal Data, this DPA prevails over any conflicting term in the Terms of Service. A signed enterprise agreement or order form, where it exists, prevails over this web version.

Privacy inquiries: support@callmissed.com
Legal / DPA countersignature: karan@callmissed.com
Grievance Officer: karan@callmissed.com