Data Processing Addendum

1. Parties and scope

This Data Processing Addendum ("DPA") is between TalkRight FZ-LLC ("TalkRight", the processor) and the business that uses TalkRight Inbox under the Terms of Service ("Customer", the controller). It applies to personal data TalkRight processes for the Customer in the Service ("Customer Personal Data") and forms part of the Terms. For TalkRight Enterprise, the written agreement prevails where it differs.

It is written to meet the data protection laws that apply to this processing, including the UAE Personal Data Protection Law and, where it applies, the EU General Data Protection Regulation.

2. Instructions

TalkRight processes Customer Personal Data only to provide the Service and on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use and settings of the Service, unless the law requires otherwise; in that case TalkRight will tell the Customer first unless the law forbids it. TalkRight will promptly tell the Customer if, in its opinion, an instruction infringes data protection law, and may suspend the affected processing while the parties resolve it. The Customer is responsible for the lawfulness of its instructions and of the data it puts into the Service, including the notices and consents its customers need.

3. Details of the processing

• Subject matter and duration: providing TalkRight Inbox, for as long as the Customer’s workspace is open and until the data is deleted as section 10 describes.
• Nature and purpose: receiving, storing, organising, displaying and sending messages; contact management; bookings; workflows; AI features the Customer switches on; reports; support and security.
• Data subjects: the Customer’s customers, prospects and contacts, and the Customer’s team members.
• Personal data: names, phone numbers, email addresses, social media identifiers, message content, attachments, voice notes and call transcripts, booking details, notes, and any other data the Customer or its contacts include in messages.
• Special categories: the standard Service is not designed for special category data, such as health information, and involves international transfers (section 7). Such data may be processed only under TalkRight Enterprise, on terms agreed in writing.

4. Confidentiality

TalkRight ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality and accesses it only as needed for their role.

5. Security

TalkRight keeps appropriate technical and organisational measures to protect Customer Personal Data, including hosting in the UAE, encryption in transit and at rest, role-based access within workspaces, checks before sensitive actions, checks on incoming files, protections against abuse, audit records and backups. TalkRight may update these measures, provided the overall level of protection is not reduced. This is not a certification.

6. Subprocessors

The Customer authorises TalkRight to use the subprocessors listed below. TalkRight imposes data protection terms on each that protect Customer Personal Data at least as well as this DPA, and remains responsible for their performance. TalkRight will give at least 30 days’ notice of a new or replacement subprocessor by updating this list and emailing workspace Owners. Where a change is urgently needed to keep the Service secure or running, TalkRight will tell the Customer as soon as possible; an urgent change does not remove any requirement of the applicable law or the Customer’s right to object. The Customer may object on reasonable data protection grounds; if the objection cannot reasonably be resolved, the Customer may end the affected service without further charges for it, with any refund dealt with under the Terms.

The services the Customer chooses to connect (such as Meta, Google and Microsoft) process data under their own terms with the Customer and are listed in the Privacy Policy.

7. International transfers

Customer Personal Data is stored in the UAE. The subprocessors and the services the Customer connects process it in other countries, so the standard Service involves international transfers. TalkRight makes such transfers with the safeguards the applicable law requires and provides information about them on request.

Because of these transfers, the standard Service may not meet the requirements that apply to regulated or sensitive data; such data is processed only under TalkRight Enterprise, as agreed in writing.

8. Assistance

Taking into account the nature of the processing, TalkRight helps the Customer answer data subject requests (the Service lets the workspace Owner find, export and delete a contact’s data), and gives reasonable help with security, breach notification, data protection impact assessments and consultation with authorities. TalkRight will tell the Customer without undue delay if it receives a request directly from one of the Customer’s data subjects, and will not answer it itself unless the Customer instructs it to or the law requires it.

9. Personal data breaches

TalkRight will notify the Customer without undue delay after becoming aware of a breach affecting Customer Personal Data, with the information the Customer reasonably needs to meet its own obligations, updated as more becomes known, and will take reasonable steps to contain it.

10. Deletion and return

The workspace Owner can export the workspace’s data at any time; the export contains its contacts, conversations, bookings and survey answers, and lists its files. When the processing ends, TalkRight will, at the Customer’s choice, return Customer Personal Data or delete it. Return is through the export and, on a request made before the closing period ends, TalkRight will help return other Customer Personal Data the Service holds in a commonly used format. TalkRight will delete remaining copies after the closing period, except data the law requires it to keep. Backup copies are kept out of ordinary use and removed in the normal backup cycle. The Customer’s retention settings also delete older content while the workspace is open.

11. Information and audits

TalkRight will make available the information reasonably needed to show compliance with this DPA, and may first answer an audit request with documents, written answers or independent reports. Where that is not enough, TalkRight will allow an audit by the Customer or an independent auditor bound by confidentiality, no more than once a year, with 30 days’ notice, during business hours and at the Customer’s cost. These arrangements protect security and other customers’ confidentiality, but do not restrict information, inspections or audits that data protection law or a competent authority requires.

12. Liability and order of precedence

The limits of liability in the Terms apply to this DPA, but do not limit rights that data protection law gives to individuals or regulators. If this DPA and the Terms conflict about personal data, this DPA applies.