Data Processing Addendum
Last updated: October 7, 2026
This Data Processing Addendum (“DPA”) forms part of the CallsKept Terms of Service between Shamrock Market Inc. (“CallsKept”, the processor) and the business customer (“you”, the controller). It applies automatically to every business account; no signature is needed. If you need a countersigned copy, email privacy@callskept.com.
1. Roles and scope
You control the personal information of your callers, contacts and staff that flows through CallsKept (“Customer Data”). CallsKept processes Customer Data only on your behalf to provide the service.
2. Instructions
We process Customer Data only according to your documented instructions — your use and configuration of CallsKept and these terms — and not for our own purposes. We will not sell Customer Data, use it for advertising, or use it to train AI models.
3. Confidentiality
Anyone we authorize to access Customer Data is bound by confidentiality obligations.
4. Security
We maintain appropriate technical and organizational measures, including encryption in transit, hashed passwords, access controls, signature verification of telephony webhooks, rate limiting and logging.
5. Subprocessors
You authorize the subprocessors listed on our Subprocessors page. We impose data-protection obligations on them at least as protective as this DPA, remain responsible for their performance, and will update that page and email you at least 14 days before adding a new subprocessor. You may object for a reasonable reason by emailing us; if we can’t resolve it you may cancel.
6. Assistance and data-subject requests
We give you self-serve tools to access, export, correct and delete Customer Data, and will help with requests you receive from individuals and with any required assessments, to a reasonable extent.
7. Security incidents
We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting your Customer Data, with the information you reasonably need to meet your own obligations.
8. Return and deletion
You can export Customer Data at any time. When you delete your account, we delete Customer Data immediately from live systems and within 30 days from backups, except where the law requires us to keep it.
9. Location
Customer Data is processed in the United States.
10. Audits
On reasonable written request (no more than once a year), we will answer security questionnaires and provide information needed to show compliance with this DPA.
11. Liability
Liability under this DPA is subject to the limitation of liability in the Terms of Service.