This English version is legally binding for Agreements whose Order is drawn up in English. For all other Agreements, the Swedish version is binding and prevails – see the section “Order of precedence” in the Service Agreement.
This is the agreement that applies between us for the processing of personal data when you use Callmaker. It constitutes Appendix 1 to the Service Agreement and applies without a separate signature when the Order is entered into.
Applies from 2026-10-09.
(1) The Customer under the Order (the “Controller”); and
(2) CM Software Callmaker AB, Reg. No. 556999-9971, Stora Badhusgatan 18, 411 21 Göteborg, Sweden (the “Processor”).
The Processor and the Controller are each referred to as a “Party” and together as the “Parties”.
A. The Parties have entered into an agreement for the Processor’s provision of the Service, consisting of the Order, the Service Agreement and its appendices (the “Agreement”). This Data Processing Agreement constitutes Appendix 1 to the Agreement.
B. Within the framework of the Service, the Processor processes personal data for which the Controller is responsible. The subject matter, nature, purpose and duration of the processing and the categories of Data Subjects and Personal Data are set out in Appendix 1.1. The Sub-processors engaged are set out in Appendix 1.2. This Data Processing Agreement governs how the Processor shall Process Personal Data on behalf of the Controller in accordance with Article 28 of the GDPR.
C. In the event of a conflict between a provision of this Data Processing Agreement and a provision of the Agreement, this Data Processing Agreement prevails in matters concerning the Processing of Personal Data, to the extent that the provision provides better protection for the Personal Data processed. Provisions on liability, limitation of liability, compensation, fees, payment and termination do not constitute protection for Personal Data in this sense; they are governed by section 7 below and the Agreement.
D. This Data Processing Agreement is accepted through the Order and requires no separate signature.
In this Data Processing Agreement, the following definitions shall have the meanings set out below:
“Processing”, “Controller”, “Personal Data”, “Processor”, “Personal Data Breach” and “Data Subject” have the same meaning as in the GDPR.
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
“Applicable Data Protection Legislation” means the GDPR, the Swedish Act (2018:218) containing supplementary provisions to the EU General Data Protection Regulation, and other legislation, regulations and rules on the protection of Personal Data in force from time to time, including rules and binding decisions of the Swedish Authority for Privacy Protection (“IMY”) or another competent supervisory authority, that are applicable to the Processor or the Controller.
“Applicable Legislation” means legislation, regulations and rules in force from time to time in the EU and relevant Member States that are applicable to a Party.
“Data Processing Agreement” means this Data Processing Agreement together with Appendix 1.1 and Appendix 1.2.
“Sub-processor” means a subcontractor engaged by the Processor that processes Personal Data on behalf of the Controller.
“Third Country” means a state that is part of neither the European Union (EU) nor the European Economic Area (EEA).
“the Service”, “the Order”, “the Service Agreement”, “the Service Price List”, “Customer Data”, “User”, “Fixed Fees”, “Commitment Period”, “Remaining Contract Period” and “the Payment Condition” have the meaning given in the Service Agreement.
2.1 The Controller determines the purposes and means of the Processing of the Personal Data and is therefore responsible for the Processing. The Processor processes Personal Data on behalf of the Controller and is therefore to be regarded as a processor. Section 2.4 applies if the Controller itself processes the Personal Data as a processor on behalf of another party.
2.2 The Controller is responsible for ensuring that the Processing takes place in accordance with Applicable Data Protection Legislation. This includes, among other things, the Controller (i) having a legal basis for the Processing and for the contact made with Data Subjects through the Service, (ii) informing the Data Subjects about the Processing, (iii) ensuring that recording, transcription and other processing of calls and messages is permitted under Applicable Legislation, including the Swedish Electronic Communications Act (2022:482) and the Swedish Marketing Practices Act (2008:486), (iv) ensuring that personal identity numbers, coordination numbers and credit information are processed in the Service only where permitted under Chapter 3, Section 10 of the Swedish Act (2018:218) containing supplementary provisions to the EU General Data Protection Regulation and other Applicable Data Protection Legislation, and (v) not entering special categories of Personal Data or Personal Data relating to criminal offences into the Service without the Processor’s prior written approval.
2.3 The Controller’s documented instructions consist of this Data Processing Agreement, Appendix 1.1, the Agreement, the settings made in the Service by the Controller or its Users, and such further written instructions as the Parties agree under section 3.2.
2.4 If the Controller processes the Personal Data in the Service as a processor on behalf of one or more other controllers (each a “Principal”), the Processor is a sub-processor to the Controller under Article 28(4) of the GDPR. References in this Data Processing Agreement to the Controller then refer to the Customer in its capacity as processor, and the following also applies.
2.4.1 The Controller warrants that each Principal has approved in writing the engagement of the Processor and the Sub-processors listed in Appendix 1.2, and that the instructions and approvals given by the Controller under this Data Processing Agreement, including the instructions in Appendix 1.1 and approvals under section 10.1 (ii), fall within the Principal’s instructions.
2.4.2 The Controller is responsible for ensuring that the obligations in section 2.2 are fulfilled, by the Controller or by the Principal, and that this Data Processing Agreement meets the requirements that the agreement with the Principal imposes on sub-processors. The Processor does not assume obligations beyond those that follow from this Data Processing Agreement unless the Parties have agreed otherwise in writing.
2.4.3 The Processor accepts instructions only from the Controller and provides notifications, information and assistance under this Data Processing Agreement, including under sections 4.2 and 8.2, only to the Controller; information under section 5.3 is provided by publication in accordance with that section. The Controller is responsible for forwarding them to the Principal and for conveying the Principal’s instructions, objections and requests to the Processor. An objection under section 5.4 shall be made by the Controller within the time stated there, even where it is based on an objection from the Principal.
2.4.4 An audit under section 4.3.2 requested by a Principal is carried out through the Controller, and the Principal or an auditor appointed by the Principal may participate on the terms stated there. Such audits count towards the number of audits stated in section 4.3.2, regardless of the number of Principals.
2.4.5 The Processor has no obligations towards the Principal under this Data Processing Agreement, and the Principal’s claims arising from the Processing shall be directed against the Controller. The Controller’s indemnity under section 7.5 also covers claims from the Principal or others that arise from the Controller’s instructions or from the warranty in section 2.4.1 being inaccurate.
3.1 The Processor undertakes to Process Personal Data only in accordance with the Controller’s documented instructions and the provisions of this Data Processing Agreement and the Agreement. The Processor shall not Process Personal Data for which the Controller is the controller for any other purposes.
3.2 If the Controller issues new instructions that go beyond what follows from this Data Processing Agreement or the Agreement, such instructions shall be given in writing. The Processor is not obliged to follow instructions that require changes to the Service, and is entitled to compensation for work arising from new instructions in accordance with the Service Price List or as agreed between the Parties.
3.3 Notwithstanding section 3.1, the Processor is entitled to Process Personal Data to the extent required for the Processor to fulfil obligations incumbent on it under Applicable Legislation. The Processor shall inform the Controller of that legal obligation before the Processing takes place, unless the Processor is prohibited by Applicable Legislation from providing such information.
3.4 Notwithstanding any choice-of-law provisions in the Agreement, Applicable Data Protection Legislation shall apply to the Processing of Personal Data covered by this Data Processing Agreement.
3.5 The Processor shall inform the Controller without undue delay if the Processor cannot fulfil its obligations under this Data Processing Agreement, or if the Processor considers that an instruction given by the Controller infringes Applicable Data Protection Legislation, unless the Processor is prohibited by Applicable Legislation from providing such information. In such a case, the Processor is entitled to wait before carrying out the instruction until the Controller has confirmed or changed it. The Processor is not obliged to make any independent legal assessment of the Controller’s instructions.
3.6 The Processor shall keep a record of the categories of Processing carried out on behalf of the Controller in accordance with Article 30(2) of the GDPR.
4.1.1 The Processor takes appropriate technical and organisational measures to protect the Personal Data Processed against Personal Data Breaches, in accordance with Article 32 of the GDPR. Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing and the risks to the Data Subjects, the measures shall achieve a level of security appropriate to the risk. An overview of the measures is set out in section G of Appendix 1.1. The Processor is entitled to update the measures provided that the level of security is not reduced.
4.1.2 The Processor shall assist the Controller in fulfilling its obligations under Articles 32–36 of the GDPR, to the extent possible taking into account the nature of the Processing and the information available to the Processor. This includes providing, on request, the information necessary for the Controller to carry out a data protection impact assessment and prior consultation with IMY regarding the Processing covered by this Data Processing Agreement. The Processor is entitled to compensation in accordance with the Service Price List for assistance that goes beyond what follows from the Agreement, this Data Processing Agreement or mandatory Applicable Data Protection Legislation, and for assistance with an impact assessment that the Controller requests even though there is no obligation to carry one out.
4.2.1 If a Personal Data Breach occurs involving Personal Data Processed on behalf of the Controller, the Processor shall notify the Controller in writing without undue delay, and no later than forty-eight (48) hours after the Processor became aware of the Personal Data Breach. Notification is given to the contact details that the Controller stated in the Order or has subsequently notified to the Processor in writing.
4.2.2 The Processor shall, without undue delay, take appropriate remedial measures to limit the adverse effects of the Personal Data Breach.
4.2.3 The notification under section 4.2.1 shall, to the extent the information is available to the Processor, contain:
4.2.3.1 a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of personal data records concerned;
4.2.3.2 the likely consequences of the Personal Data Breach; and
4.2.3.3 a description of the measures taken or proposed to be taken by the Processor to address the Personal Data Breach and limit its adverse effects.
Where, and to the extent that, it is not possible to provide the information at the same time, the information may be provided in phases without further undue delay.
4.2.4 The Processor’s notification of, or measures in response to, a Personal Data Breach does not constitute an admission of fault or liability. The Controller is responsible for notifying IMY and informing Data Subjects under Articles 33 and 34 of the GDPR. Notification and information under sections 4.2.1–4.2.3 are provided free of charge. For further assistance under this section 4.2, the Processor is entitled to compensation in accordance with the Service Price List to the extent that the Personal Data Breach was not caused by the Processor’s breach of this Data Processing Agreement.
4.3.1 The Processor continuously documents the measures it has taken to fulfil its obligations under this Data Processing Agreement. The Controller is entitled, on request, to access the latest version of such documentation and any available audit reports, certifications or equivalent material from the Processor and its Sub-processors.
4.3.2 The Processor shall make available to the Controller the information necessary to demonstrate that the Processor has fulfilled its obligations under Article 28 of the GDPR, and allow for and contribute to audits, including inspections, conducted by the Controller or by an independent auditor appointed by the Controller and reasonably approved by the Processor. An audit may be carried out no more than once per calendar year, unless a Personal Data Breach or an order from IMY gives reason for an additional audit. An audit shall be preceded by written notice at least thirty (30) days in advance, be carried out during office hours in a way that does not disrupt the Processor’s business or other customers, and cover only information necessary to assess compliance with Article 28. Information about the Processor’s business in general, other customers or security details that could increase the risks to the Service is not covered. The Controller bears its own costs for the audit and reimburses the Processor’s reasonable costs of participation in accordance with the Service Price List, unless the audit reveals a material breach of this Data Processing Agreement by the Processor. The Controller shall ensure that the auditor engaged is bound by confidentiality at least equivalent to section 6.
4.3.3 Neither Party is entitled to represent the other Party before IMY or any other third party.
5.1 The Controller hereby gives the Processor general prior authorisation to engage Sub-processors to Process Personal Data on behalf of the Controller. The Sub-processors engaged when this Data Processing Agreement is entered into are listed in Appendix 1.2 and are approved by the Controller.
5.2 The Processor shall enter into a written agreement with each Sub-processor imposing on the Sub-processor data protection obligations that are substantively equivalent to, and no less restrictive than, those that follow from this Data Processing Agreement. The Controller accepts that the Processor, where circumstances so require, enters into the Sub-processor’s standard agreement for the processing of personal data, provided that such standard agreement meets the requirements of Article 28 of the GDPR.
5.3 The Processor shall inform the Controller of planned changes involving the engagement of new Sub-processors or the replacement of Sub-processors. The information is provided solely by the Processor publishing an updated Appendix 1.2 on its website at least thirty (30) days before the new Sub-processor starts Processing Personal Data. Appendix 1.2 shall state the date of publication for each new Sub-processor. The Controller is responsible for monitoring such updates. The information shall include:
5.3.1 the Sub-processor’s identity (business name, company registration number or equivalent, and address);
5.3.2 the type of service the Sub-processor performs; and
5.3.3 where the Sub-processor will Process Personal Data and, where applicable, the applicable transfer mechanism under section 10.
5.4 The Controller is entitled to object in writing to the engagement of a new Sub-processor within thirty (30) days of the date on which the updated Appendix 1.2 was published under section 5.3 or 5.5. An objection shall state objective reasons relating to data protection. An objection is justified if the engagement of the Sub-processor would prevent the Controller from fulfilling its obligations under Applicable Data Protection Legislation, for example because the Sub-processor does not provide sufficient guarantees to implement appropriate technical and organisational measures. If the objection is justified and the Parties do not agree on a solution within thirty (30) days of the objection, the Controller may, as its sole remedy, terminate the part of the Service affected by the new Sub-processor, or, if the Service cannot be provided without the Sub-processor, the entire Agreement, with thirty (30) days’ notice. Such termination does not constitute a breach of contract. The Processor will refund prepaid Fixed Fees relating to what has been terminated for the period after termination, and no compensation for the Remaining Contract Period is payable for what has been terminated. The Controller is not entitled to damages as a result of the termination. An objection that is not justified does not give a right of termination under this section. If the Controller does not object within the time limit, the new Sub-processor is deemed approved.
5.5 If necessary to maintain the security or continuity of the Service, for example in the event of a Sub-processor’s sudden unavailability or a Personal Data Breach, the Processor may replace a Sub-processor with immediate effect. In such a case, the Processor shall, without undue delay, publish an updated Appendix 1.2, after which section 5.4 applies.
5.6 At the Controller’s request, the Processor shall provide a summary of the data protection terms that apply between the Processor and a Sub-processor and, to the extent the information is available to the Processor, information about the subcontractors that the Sub-processor in turn engages for the Processing. Commercial terms and information subject to confidentiality towards the Sub-processor may be excluded.
5.7 The Processor is liable to the Controller for the Sub-processors’ Processing of Personal Data as for its own Processing, subject to the limitations that follow from section 7.
6.1 Without prejudice to the confidentiality undertakings in the Agreement, the Processor shall keep all Personal Data Processed on behalf of the Controller strictly confidential. Accordingly, the Processor shall not, directly or indirectly, disclose any Personal Data to a third party unless the Controller has approved this in writing in advance, the Processor is required by Applicable Legislation or a decision of a court or authority to disclose the Personal Data, or disclosure is necessary for the performance of the Agreement or this Data Processing Agreement, including disclosure to Sub-processors and telecom operators in accordance with the Agreement. When disclosing Personal Data to a third party under a decision of a court or authority, the Processor shall inform the Controller of the disclosure, unless prevented by Applicable Legislation or the decision.
6.2 The Processor shall ensure that the persons authorised to Process the Personal Data, including employees and consultants of the Processor and its Sub-processors, have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they Process Personal Data only in accordance with the Controller’s instructions.
6.3 The Processor accepts that the confidentiality undertaking under this section 6 shall continue to apply after this Data Processing Agreement has terminated and until all Personal Data has been returned to the Controller or deleted in accordance with section 9.
6.4 The Controller undertakes to keep strictly confidential all information it receives concerning the Processor’s security measures, procedures, IT systems or Sub-processors, or that is otherwise of a confidential nature, and not to disclose such information to any third party, other than what the Controller is required to disclose under Applicable Legislation, the Agreement or this Data Processing Agreement. This undertaking also applies after this Data Processing Agreement has terminated.
7.1 Each Party is liable for damage it causes the other Party through breach of this Data Processing Agreement or Applicable Data Protection Legislation, subject to the limitations set out below.
7.2 The Processor’s liability under this Data Processing Agreement is limited to direct damage. The Processor is not liable for indirect or consequential damage, such as loss of profit, loss of revenue, loss of business opportunities, loss of production, loss of data, costs of a replacement service or third-party claims, regardless of whether the damage was foreseeable. The Processor’s aggregate liability for all damage under this Data Processing Agreement and the Agreement together is limited to the amount that follows from the limitation of liability in the Service Agreement’s section “Liability and limitation of liability”, i.e., for each twelve-month period counted from the first event giving rise to damage, the lower of the Fixed Fees paid by the Controller for the Service during the six (6) months immediately preceding the event giving rise to the damage and two (2) price base amounts under Chapter 2, Section 7 of the Swedish Social Insurance Code for the year in which the event giving rise to the damage occurred. The limitation of liability constitutes a shared cap for the Agreement, this Data Processing Agreement, Appendix 3 – Cybersecurity Incidents and Appendix 4 – AI Features; amounts paid under one of the documents are counted against the cap for the others. For damage resulting from a Cybersecurity Incident under Appendix 3, the limitation of liability set out in Appendix 3, section 7, applies instead. However, recourse claims under section 7.3 are always subject to the limitation of liability in this section 7.2, even where the damage arises from a Cybersecurity Incident.
7.3 If a Party has paid compensation to a Data Subject under Article 82 of the GDPR, that Party is entitled to claim back from the other Party the part of the compensation corresponding to the other Party’s share of responsibility for the damage, in accordance with Article 82(5). The Processor’s liability under this section is subject to the limitation of liability in section 7.2. The Party receiving a claim from a Data Subject shall inform the other Party without undue delay and shall not admit liability or enter into a settlement affecting the other Party without the other Party’s written approval.
7.4 Each Party is responsible for administrative fines imposed on it by a supervisory authority. Neither Party is obliged to compensate the other Party for such a fine, except as follows from section 7.5.
7.5 The Controller’s indemnity under the Service Agreement’s section “The customer’s indemnity” also covers claims, administrative fines, damages and costs directed at or incurred by the Processor that arise from (i) the Controller’s instructions, (ii) the absence of a legal basis for the Processing or for contact with Data Subjects through the Service, (iii) recording, transcription or other processing of calls or messages decided on by the Controller, (iv) the Controller having entered personal identity numbers, coordination numbers, credit information, special categories of Personal Data or Personal Data relating to criminal offences into the Service in breach of section 2.2, or (v) any other breach by the Controller of section 2.2 or Applicable Data Protection Legislation. The limitation of liability in section 7.2 does not apply to this undertaking.
7.6 The limitations in this section 7 do not apply to damage caused intentionally or through gross negligence, nor to liability that cannot be limited under mandatory law.
7.7 Claims for compensation under this Data Processing Agreement shall be made in writing to the other Party without undue delay, and no later than three (3) months after the damage was discovered or should have been discovered. Claims made later are forfeited.
8.1 Taking into account the nature of the Processing and insofar as possible, the Processor shall assist the Controller by appropriate technical and organisational measures so that the Controller can fulfil its obligation to respond to requests for the exercise of Data Subjects’ rights under Chapter III of the GDPR. Assistance is provided primarily through the search, export, rectification and deletion functions available in the Service, which the Controller can use itself. The Processor is entitled to compensation in accordance with the Service Price List for assistance beyond this.
8.2 If a Data Subject contacts the Processor directly with a request concerning Processing carried out on behalf of the Controller, the Processor shall forward the request to the Controller without undue delay and shall not itself respond to it on the merits, other than by referring the Data Subject to the Controller.
9.1 On termination of the Agreement, the Controller shall instruct the Processor in writing whether the Personal Data that the Processor has Processed on behalf of the Controller is to be (i) returned to the Controller or (ii) deleted. Return takes place by the Processor making the Personal Data available once in the format and manner set out in Appendix 2 – Data Portability, after which the Personal Data is deleted. Return is subject to the Payment Condition being met; if it is not met, Appendix 2, section 8.3, applies. If the Controller does not provide an instruction within thirty (30) days of the Agreement ceasing to apply, the Processor shall delete the Personal Data without undue delay. If a Retrieval Period under Appendix 2 is running at that time, the Personal Data is instead deleted in connection with deletion under Appendix 2, section 9.
9.2 Deletion covers existing copies, except for (i) Personal Data that the Processor is required to retain under Applicable Legislation, which continues to be processed only for that purpose and is deleted when the obligation ceases, and (ii) backups, which are deleted through routine procedures within the period set out in Appendix 1.1 and are not used for any other purpose in the meantime. On request, the Processor confirms in writing that deletion has taken place.
9.3 The obligation to delete Personal Data under this section 9 and assistance under Appendix 2, section 6.5, apply regardless of whether the Controller has fulfilled its payment obligations under the Agreement. Return under section 9.1 (i) is subject to the Payment Condition being met.
10.1 The Processor may not transfer Personal Data to, or give access to Personal Data from, a Third Country unless (i) the transfer is made to a Sub-processor approved under section 5 and using the transfer mechanism set out in Appendix 1.2, or (ii) the Controller has approved the transfer in writing in advance.
10.2 Every transfer to a Third Country shall take place in accordance with Chapter V of the GDPR, on the basis of an adequacy decision under Article 45, standard contractual clauses adopted by the European Commission under Article 46(2)(c) together with the supplementary safeguards that an assessment of the recipient country shows to be necessary, or another valid transfer mechanism. The Processor may enter into such agreements with Sub-processors on behalf of the Controller.
10.3 If a transfer mechanism ceases to be valid, the Processor shall without undue delay switch to another valid mechanism or cease the transfer, and inform the Controller. Such a change does not entitle the Controller to damages.
11.1 This Data Processing Agreement enters into force when the Agreement is entered into and applies for the term of the Agreement and thereafter until the Processor, and Sub-processors engaged by the Processor, have ceased to Process Personal Data on behalf of the Controller in accordance with section 9.
11.2 Sections 6, 7, 9 and 14 continue to apply after this Data Processing Agreement has otherwise terminated.
The provisions on assignment in the Agreement apply correspondingly to this Data Processing Agreement.
13.1 The provisions on amendments in the Agreement apply correspondingly to this Data Processing Agreement.
13.2 In addition, the Processor is entitled to update Appendix 1.2 in accordance with section 5 and to update Appendix 1.1 to reflect changes in the Service’s features, security measures or Applicable Data Protection Legislation, provided that the update does not reduce the protection of the Personal Data. Such updates are notified by publication on the Processor’s website. Section 5.3 also applies to planned changes involving the engagement of new Sub-processors or the replacement of Sub-processors.
The provisions on applicable law and disputes in the Agreement apply correspondingly to this Data Processing Agreement.
This appendix constitutes the Controller’s documented instructions under section 2.3 and describes the Processing carried out by the Processor.
The Processor processes Personal Data on behalf of the Controller for the purpose of providing the Service: a system for outbound and inbound telephony, SMS and related customer contact (Callmaker Dialer or an equivalent service agreed between the Parties from time to time), technical support, quality and compliance monitoring and related administration. The Processing comprises storage, structuring, dialling and sending, display to Users, logging, reporting, backup and deletion.
In addition, to the extent the Controller enables such features in the Service, the Processing may include recording of inbound and outbound calls, transcription of calls, structuring and automated processing of audio files, transcripts and associated metadata, including summarisation, analysis and assessment of Users’ work performance, and anonymisation or pseudonymisation of such material. The Controller is responsible for ensuring that enabling such features is permitted under Applicable Legislation.
The Processor may also Process Personal Data to the extent required for support, troubleshooting, system maintenance and technical operations. The Processing further includes Assistant Features under Appendix 4 – AI Features, i.e. automated answering of Users’ questions about how to use the Service and assistance in designing automations, including storage of Users’ questions and the Assistant Feature’s answers without any link to the User, account or customer. Permissions and settings in the Service are administered by the Controller.
The Controller instructs the Processor to anonymise Personal Data in transcripts, Output under Appendix 4 – AI Features and associated metadata, in Users’ conversations with Assistant Features, and in Customer Data appearing in support cases and other communication with the Processor’s support, for the purpose of developing and improving the Service’s AI Features. The instruction does not cover audio files. Anonymisation takes place within the framework of the security measures set out in section G, and data that has been anonymised is not covered by this Data Processing Agreement.
The Controller further instructs the Processor to produce Aggregated Data under the Service Agreement’s section “Aggregated data and feedback” by aggregating or anonymising Personal Data. Data that has been aggregated or anonymised in this way is not covered by this Data Processing Agreement.
The Processing covers the following categories of Data Subjects:
(i) the Controller’s customers and prospective customers, both private individuals and contact persons at companies and organisations, whom the Controller contacts or intends to contact through the Service;
(ii) persons appearing in the lead, call and contact lists that the Controller enters into or imports into the Service, including lists from third-party lead suppliers;
(iii) recipients of SMS and other messages sent through the Service, and persons calling numbers handled in the Service;
(iv) the Controller’s Users, i.e. employees, consultants and others to whom the Controller gives access to the Service.
For Data Subjects under B (i)–(iii): name, address, telephone number, email address, company and job title, customer or case number, data on contact attempts and calls (time, duration, outcome, disposition, call status, recording where applicable), content of SMS and other messages, transcripts and summaries produced from them where applicable, notes and content of free-text fields, answers to questions asked in calls, data on booked meetings, including calendar events in calendars connected to the Service, and data appearing in the lists that the Controller enters into the Service. Where applicable, and only if the Controller itself chooses to enter them into the Service in accordance with section 2.2: personal identity numbers or coordination numbers, credit information and data on agreements and orders.
For Users under B (iv): name, email address, telephone number, username and login credentials, role and permissions, voice in recorded calls, activity and access logs, IP address, calendar events when a calendar integration has been enabled, and performance and statistical data generated by the Service about the User’s work in the Service.
The Service is not intended for the Processing of special categories of Personal Data under Article 9 of the GDPR or Personal Data relating to criminal offences under Article 10. The Controller shall not enter such data into the Service without the Processor’s prior written approval under section 2.2. The Controller is aware that such data may nevertheless appear in recordings, transcripts and free-text fields as a result of what Data Subjects themselves say, and is responsible for ensuring that this is handled in accordance with Applicable Data Protection Legislation.
The Processing continues for the term of the Agreement and thereafter until deletion has taken place under section 9. The following retention periods apply as the Controller’s instruction, unless otherwise provided by the Order or by settings the Controller makes in the Service:
(i) Customer Data in the Service: in accordance with the deletion rule sets that the Controller configures in the Service’s GDPR module. The settings made by the Controller count as instructions under this Data Processing Agreement.
(ii) Audio files: deleted after ninety (90) days and order audio files after three hundred and ninety (390) days, in accordance with the Service Agreement’s section “Audio files”, unless otherwise agreed.
(iii) Backups: seven (7) days.
(iv) Logs: one hundred and eighty (180) days or as set by the Controller. Logs generated by the AI Features are retained in accordance with Appendix 4 – AI Features, section 5.6.
(v) Conversations with Assistant Features: stored without any link to the User, account or customer; content not yet anonymised is deleted or anonymised within thirty (30) days.
Personal Data is stored and Processed in Sweden, Germany, Italy and Ireland and, for the Assistant Features, in the European region stated in Appendix 1.2, which comprises the EU/EEA and Switzerland, by the Processor and the Sub-processors listed in Appendix 1.2. Any access from or transfer to a Third Country takes place only in accordance with section 10 and the transfer mechanisms set out in Appendix 1.2.
The Processor applies measures including the following: encryption of Personal Data in transit over public networks and at rest, including encrypted backups; logical separation of each customer’s Customer Data and backups from those of other customers; access control based on the principle of least privilege, with individual accounts and the option of multi-factor authentication for Users; logging of access to Personal Data with the possibility of subsequent review; procedures for secure deletion and for testing restoration from backup; physical protection of premises and equipment; confidentiality undertakings and ongoing training for staff with access to Personal Data; and an annual review of the security policy and security measures. A current and more detailed description is provided on request under section 4.3.1.
Notifications under this Data Processing Agreement are given to the contact details stated by the Parties under the Agreement’s section “Notices”. The Processor can be reached on data protection matters at privacy@cmsoftware.se.
On entering into this Data Processing Agreement, the Controller approves the Processor’s engagement of the following Sub-processors to fulfil its commitments under the Agreement. The list is updated in accordance with section 5. Last updated: 2026-10-09.
Akamai Technologies International AG
Reg. No.: CHE-115.356.067 (UID, Switzerland)
Address: Grafenauweg 8, 6300 Zug, Switzerland
Service: Virtual servers, storage and encrypted backup storage (Akamai Cloud, formerly Linode).
Location of the Processing: Sweden (Stockholm), Germany (Frankfurt) and Italy (Milan).
Transfer mechanism to Third Countries: Switzerland is covered by a European Commission adequacy decision. For any support access from group companies in India and the USA: the European Commission’s standard contractual clauses (Decision (EU) 2021/914) under Akamai’s data processing agreement.
Amazon Web Services EMEA SARL
Reg. No.: B186284 (RCS Luxembourg)
Address: 38 Avenue John F. Kennedy, L-1855 Luxembourg
Service: Virtual machine instances with GPUs for running and automated processing of audio and text.
Location of the Processing: Ireland (the AWS Europe (Ireland) Region), through Amazon Data Services Ireland Limited.
Transfer mechanism to Third Countries: Not applicable to the processing. For any support access from the USA: the European Commission’s standard contractual clauses (Decision (EU) 2021/914) under AWS’s data processing agreement, and the EU–US Data Privacy Framework to the extent the receiving company is certified.
LEKAB Communication Systems AB
Reg. No.: 556340-7468
Address: Sankt Eriksgatan 113, 113 43 Stockholm, Sweden
Service: Relaying of SMS sent and received through the Service, including delivery reports.
Location of the Processing: Sweden.
Transfer mechanism to Third Countries: Not applicable to the processing by the Sub-processor. When the Controller sends an SMS to a telephone number in a Third Country, the message and the recipient’s telephone number are transferred, to the extent required for delivery, to the recipient’s telecom operator, where applicable via the Sub-processor’s operator partner. Such transfer takes place on the Controller’s instruction and is hereby approved under section 10.1 (ii).
OpenAI Ireland Ltd.
Reg. No.: 737350 (CRO, Ireland)
Address: 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
Service: Language models via API for the Assistant Features under Appendix 4 – AI Features. The data is not stored by the Sub-processor and is not used to train its models.
Location of the Processing: OpenAI’s European region, which comprises the EU/EEA and Switzerland, with processing within the region.
Transfer mechanism to Third Countries: For processing in Switzerland: the European Commission’s adequacy decision under Article 45 of the GDPR. For any access from group companies in the USA: the European Commission’s standard contractual clauses (Decision (EU) 2021/914) under OpenAI’s data processing agreement.
Telecom operators that connect and carry calls to and from the Service are not Sub-processors. This applies both to the operators with which the Processor has agreements and to the other party’s operator. The telecom operators carry the calls in real time, do not store the content of the calls on the Processor’s behalf, and process traffic data, such as telephone numbers, time and duration, as independent controllers with the obligations that follow from the Swedish Electronic Communications Act (2022:482). Recording, transcription and other processing of calls take place in the Service at the Processor and the Sub-processors listed above. When a call is connected to or from a telephone number in a Third Country, the telephone numbers and the call are transferred, to the extent required for the connection, to the other party’s telecom operator, where applicable via intermediate operators. Such transfer takes place on the Controller’s instruction and is hereby approved under section 10.1 (ii).
