Data Processing Agreement

Echo Calls — for the businesses that use Echo Calls

Version 2026-10-17. This agreement is made in Arabic and English. If the two differ, the Arabic text prevails.

Parties

1. The Business (the controller): the business named in the signature block below, or the business that accepted the Echo Calls terms of service in its workspace.
2. Echo Calls (the processor): Echo Calls, support@echocalls.ai, https://echocalls.ai.

This agreement forms part of the Echo Calls terms of service (the "Terms"). It applies whenever Echo Calls processes personal data on the Business's behalf. If it conflicts with the Terms on the protection of personal data, this agreement prevails.

1. Definitions

Words such as personal data, sensitive data, processing, controller, processor, data subject, breach and the Center have the meaning given in Egypt's Personal Data Protection Law No. 151 of 2020 (the "Law") and its Executive Regulations. Callers are the people who call the Business through its Echo Calls call link. Sub-processor means a provider Echo Calls uses to process the Business's personal data.

2. Roles

1. For the personal data of the Business's callers processed in the service (Annex 1), the Business is the controller and Echo Calls is the processor.
2. For the Business's account, its users, billing and the security of the service, Echo Calls is a controller in its own right, as described in its privacy notice. This agreement does not cover that data.

3. Instructions

1. Echo Calls processes the Business's personal data only on the Business's documented instructions. The Business gives them through: this agreement and the Terms; the settings of its workspace (its information, services, booking hours and agent, whether calls are recorded, and the tools it connects); and its written requests to support@echocalls.ai.
2. Echo Calls does not process that data for any other purpose. In particular it does not sell it, use it for advertising, use it to train artificial-intelligence models, or combine it with other businesses' data.
3. Echo Calls tells the Business without delay if it believes an instruction breaks the Law, and may decline to follow that instruction.

4. The Business's duties

The Business:

1. has a lawful basis under the Law for the processing it instructs, including for any health or other sensitive data its callers give, and obtains any consent the Law requires;
2. tells its callers, wherever it publishes its call link, that their calls are answered by an AI assistant run by Echo Calls for the Business, and points them to the Echo Calls privacy notice (https://echocalls.ai/privacy) and to its own privacy information;
3. does not instruct the assistant to collect more personal data than its bookings and answers need, and does not upload other people's personal data (such as customer lists) into its business information;
4. keeps its business information accurate, and answers its callers' requests about their data, with Echo Calls' help under section 9.

5. Confidentiality

Echo Calls allows only the staff who need it to run, support or secure the service to access the Business's personal data. Each of them is bound by a duty of confidentiality that continues after their work ends. Echo Calls staff open a call recording only to resolve a problem the Business reports or a security incident, and each opening is written to an audit log.

6. Security

Echo Calls applies the technical and organisational measures in Annex 2, and keeps them appropriate to the risk of the processing. Echo Calls may improve the measures, but will not reduce their overall level of protection.

7. Sub-processors

1. The Business authorises Echo Calls to use sub-processors.
2. Echo Calls gives each sub-processor only the data its part of the service needs, and binds it, by its terms of service or contract, to protect that data.
3. Echo Calls tells the Business by email at least 30 days before it adds or replaces a sub-processor. The Business may object in writing within that time on reasonable data protection grounds. If the parties cannot resolve the objection, the Business may end the Terms before the change takes effect, without penalty, and receive a refund of any prepaid amount for the period after the end.
4. Echo Calls remains responsible to the Business for its sub-processors' processing.

8. Transfers outside Egypt

1. The service is hosted in the European Union. Some sub-processors process data in other countries, including the United States. The Business agrees to these transfers for the purposes of this agreement.
2. Echo Calls protects transferred data with the measures in Annex 2, sends it only over encrypted connections, and gives each recipient only the data it needs.
3. Echo Calls informs the Business before it moves the service's hosting to another country.

9. Help with data subjects' requests

1. If a caller asks Echo Calls about their data, Echo Calls forwards the request to the Business within two working days, unless the Business has asked Echo Calls to answer such requests for it.
2. Echo Calls helps the Business answer requests to access, correct, complete, update, erase or limit the processing of a caller's data, within the six working days the Law sets for a reply. Where the Business cannot do this itself in its workspace, Echo Calls does it on the Business's written instruction.

10. Breach notification

1. Echo Calls notifies the Business without undue delay and in any case within 24 hours of becoming aware of a breach of the Business's personal data.
2. The notice describes, as far as then known: the nature of the breach and when it happened; the categories and approximate number of data subjects and records affected; the likely consequences; the measures taken or proposed; and a contact for more information. Echo Calls adds what it learns later without delay.
3. Echo Calls cooperates with the Business so that the Center is notified within the 72 hours the Law sets, and the data subjects affected within three working days of notifying the Center, and notifies the Center itself where the Law requires a processor to do so.
4. Echo Calls takes the measures needed to contain the breach and to limit its effects, and keeps a record of every breach.

11. Records and audits

1. Echo Calls keeps a record of the processing it carries out for the Business, including the categories of data, the purposes, the sub-processors and countries, the retention periods and the security measures.
2. On request, Echo Calls gives the Business the information it reasonably needs to show that this agreement is being met. Once a year, or after a breach, the Business may audit Echo Calls' compliance, itself or through an independent auditor bound by confidentiality, with 30 days' written notice, during working hours, and without access to other businesses' data. Each party bears its own costs.
3. Echo Calls cooperates with the Center when the Law requires it.

12. Retention and deletion

1. During the service, Echo Calls keeps and deletes data as set out in Annex 1. Transcripts, summaries, call analysis and booking change requests are deleted automatically 90 days after each call (outcome labels without words are kept with the call details). Calls are recorded while the Business's "Record calls" setting is on; their recordings are deleted automatically 90 days after each call, and earlier when the call is deleted. While the setting is off, no audio is captured. A Business's workspace starts with the setting off, so its calls are not recorded until its workspace admins switch it on in the workspace (confirming that the Business informs its callers that calls are recorded); switching it on is the Business's instruction to record (section 3.1) and its acceptance of the recording terms of this agreement and of the Terms.
2. At the end of the service, for whatever reason:
   1. within 30 days of the end, Echo Calls gives the Business, on written request, a copy of its bookings and of the call transcripts and recordings whose 90-day period has not yet run out, in a common electronic format;
   2. then, and in any case within 60 days of the end, Echo Calls deletes the Business's personal data from the service: calls, transcripts, call recordings, bookings, booking records, knowledge documents and their search indexes, its users' sign-in accounts, and the access tokens of the tools it connected;
   3. copies inside Echo Calls' encrypted backups are deleted as those backups expire: daily and monthly backups within about six months, and the last five backups taken before each kind of maintenance when newer ones replace them. Until then they stay encrypted, are not used, and would be deleted again if a backup were ever restored. Call recordings are not copied into backups;
   4. Echo Calls may keep only what the law requires it to keep (such as billing records, which hold no caller data), and the record of its own decisions on the account;
   5. Echo Calls confirms the deletion to the Business in writing.

13. Term and liability

1. This agreement lasts as long as Echo Calls processes personal data for the Business, and section 12 continues after the Terms end.
2. Each party's liability under this agreement is subject to the limits in the Terms, except where the law does not allow a limit.
3. This agreement is governed by the laws of the Arab Republic of Egypt, and disputes are settled as the Terms provide.

14. Businesses that handle health data

This section applies when the Business provides health services (for example a clinic, a medical centre, a laboratory or a pharmacy), so that its callers may give health information, which the Law treats as sensitive data. It adds to the rest of this agreement.

1. The Business confirms that it has a lawful basis for processing health information, and obtains, through its own channels, any explicit consent the Law requires for sensitive data. The call page does not collect consent.
2. Echo Calls sets up the Business's agent so that a booking asks only for the caller's name, phone number, the service and the time; the Business tells Echo Calls if its services need more. The assistant does not ask for symptoms or medical history, and Echo Calls adds no health information to bookings or booking emails beyond the name of the service booked.
3. Health information a caller volunteers stays only in the call transcript and, when the call is recorded, in its recording. The Business's own users can see and hear them (and Echo Calls staff only as point 5 allows), and they are deleted 90 days after the call. On the Business's written request, Echo Calls deletes a given call's transcript or recording earlier.
4. The Business gives access to transcripts and recordings only to the users who need it, removes the accounts of users who leave, and decides with care whether to have call recording on.
5. Echo Calls staff open such a Business's transcripts or recordings only to resolve a problem the Business reports, or a security incident.
6. A breach that involves health information is treated as high risk: Echo Calls notifies the Business at once, and in any case within 24 hours (section 10).

15. Tools the Business connects

1. When the Business's workspace admins connect a tool to Echo Calls (such as Google Calendar, Google Sheets, a customer-relationship system, a webhook address, an API key or a lookup in the Business's own system), the Business instructs Echo Calls to send that tool the data the connection needs, or to read from it, as described in the privacy notice (section 2.8).
2. The Business chooses the provider of each tool it connects, and that provider acts under the Business's own arrangements with it. It is not an Echo Calls sub-processor, and section 7 does not apply to it. The Business is responsible for having a lawful basis for that transfer.
3. Echo Calls sends each connection only what it needs; it never sends the transcript text by webhook or spreadsheet, nor the reason for a booking; it keeps a delivery log without content for 30 days; and it stores each connection's credentials encrypted.

Annex 1 — Details of the processing

Annex 2 — Security measures

1. Encryption in transit: TLS on the website, console, call links and call signalling (HSTS for two years); email sent over implicit TLS; backups uploaded over HTTPS.
2. Encryption at rest: the server's disk is encrypted; every backup is encrypted with age to keys held offline, before it leaves the server; call recordings are stored in the European Union, encrypted at rest by the storage's own encryption, which is the encryption for recordings at launch (Echo Calls adds no encryption of its own); the credentials of connected tools and webhook secrets are stored encrypted.
3. Access to the server: key-only SSH for a single administrative user, no root login and no passwords, a firewall and brute-force blocking; SSH only from the administrator's own address.
4. Access to the application: each business sees only its own data; platform administrators must sign in with two-step verification (TOTP); the Business's own users sign in with a security check. Call recordings can be played only through signed links the server makes for each request by a signed-in user of the same business, which expire within 5 minutes; every access to a recording by Echo Calls staff is written to the audit log.
5. Data minimisation: calls are recorded only while the Business's "Record calls" setting is on, and with it off no audio is captured; no worker call records or raw caller text are written in production; phone numbers are masked and caller text is redacted in technical logs, except the internet address of a connection that exceeds request limits; caller internet addresses are used as a keyed hash for limits; no phone line number is collected on call-link calls; booking emails never carry the transcript.
6. Automatic deletion: a nightly task deletes caller text and call recordings 90 days after each call, and a monitoring metric and alert fire if it falls behind or finds expired recordings left; a rule in the storage also deletes recordings after 90 days, as a backstop.
7. Network isolation: internal services (database, cache, search index) run on internal networks; the call media server is self-hosted, and only its media ports are public.
8. Backups and recovery: nightly encrypted backups kept on the server and off-site, 30 daily and 6 monthly copies; a restore drill every month, with an alert if one is missed.
9. Monitoring: alerts for service outages and failures go to Echo Calls' administrators; alerts never carry caller data.
10. People: access only for staff who need it, under confidentiality.

Signatures

A business that accepts the Echo Calls terms of service in its workspace accepts this agreement with them. Echo Calls sends it to the business before activating its workspace, and it applies from activation, before any caller data is processed; the version accepted and the time are recorded with the account.