Data processing agreement

1. Scope and parties

This data processing agreement (the “DPA”) forms part of the terms of service between TuniCall (“we”, “us”) (“TuniCall”, the processor) and the customer that uses the TuniCall service (the “Customer”, the controller). It applies to the personal data that TuniCall processes on behalf of the Customer when providing the service (the “Customer Personal Data”).

The DPA applies automatically when the Customer accepts the terms of service, without the need for a signature. A signed copy is available on request. Words with capital letters that are not defined here have the meanings given in the terms of service.

“Data Protection Law” means all laws on the protection of personal data that apply to the processing, including, where applicable, the EU General Data Protection Regulation (the “GDPR”), the UK GDPR and Tunisian Organic Law No. 2004-63 on the protection of personal data.

This DPA does not cover personal data that TuniCall processes for its own purposes as a controller, such as website enquiries, the management of the customer relationship and invoicing. That processing is described in our privacy policy.

2. Definitions

• Controller, processor, personal data, processing, data subject, personal data breach and supervisory authority have the meanings given in the GDPR, or the equivalent terms of other applicable Data Protection Law.
• Sub-processor: a third party engaged by TuniCall to process Customer Personal Data on TuniCall’s behalf.
• Customer Providers: the telephony carriers and phone systems, AI model providers and speech recognition and voice providers that the Customer connects to the service with its own accounts.

3. Roles of the parties

The Customer is the controller of the Customer Personal Data and TuniCall is its processor. If the Customer acts as a processor for its own clients, the Customer confirms that its instructions, including the appointment of TuniCall, are authorised by the relevant controller, and TuniCall acts as a sub-processor.

Customer Providers are not TuniCall’s sub-processors. The Customer selects them, opens accounts with them in its own name, accepts their terms and gives TuniCall the credentials needed to use them. When TuniCall sends data to a Customer Provider, for example call audio to a speech or AI provider or a phone number to a telephony carrier, it does so on the Customer’s instruction. Customer Providers process that data under their own agreements with the Customer, as the Customer’s processors or as independent controllers, depending on their terms. The Customer is responsible for those agreements, including any data processing and transfer terms, and TuniCall is not responsible for the processing carried out by Customer Providers.

4. Subject matter, duration, nature and purpose

5. Data subjects and categories of personal data

Special categories of data. The service is not designed for special categories of personal data or data about criminal convictions. The Customer must not submit such data unless it is necessary, lawful and protected by the safeguards the law requires. People may reveal such data during a conversation; the Customer decides how its AI agents are instructed to handle it.

6. Customer instructions

TuniCall processes Customer Personal Data only on the documented instructions of the Customer, including with regard to international transfers, unless required to do otherwise by a law to which TuniCall is subject. In that case, TuniCall will inform the Customer of that legal requirement before processing, unless the law prohibits it.

The Customer’s documented instructions are this DPA, the terms of service and the Order, together with the Customer’s configuration and use of the service, such as importing contacts, recording consent, configuring AI agents and routing, starting Campaigns, connecting Customer Providers and placing calls, and any other written instructions agreed between the parties. Instructions outside this scope require the agreement of both parties and may be charged.

TuniCall will inform the Customer immediately if, in its opinion, an instruction infringes Data Protection Law. TuniCall is not required to carry out a legal review of the Customer’s instructions, and the Customer remains responsible for their lawfulness. In particular, TuniCall does not verify whether the people the Customer instructs it to call have given their consent.

7. Customer obligations

The Customer is responsible for complying with Data Protection Law as controller. In particular, the Customer:

• has a legal basis for every processing it instructs, and holds and can prove every consent required, as set out in the calling consent policy;
• gives the people concerned all the information the law requires, including on the use of AI agents, transcription, Customer Providers and international transfers;
• answers the requests of the people concerned and honours opt-outs and objections;
• carries out any data protection impact assessment and completes any formality with a supervisory authority that its processing requires;
• has the agreements required with its Customer Providers, including data processing and transfer terms;
• submits only accurate data that is necessary for its purposes, and does not put special categories of data, payment card data or secrets in agent instructions or knowledge documents;
• manages its users, roles and credentials securely.

The Customer warrants that its instructions comply with Data Protection Law and that it is entitled to provide the Customer Personal Data to TuniCall for processing.

8. Confidentiality of personnel

TuniCall ensures that the persons it authorises to process Customer Personal Data are bound by an appropriate obligation of confidentiality, whether contractual or statutory, and access the data only to the extent needed to provide, support or secure the service.

9. Security measures

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks for the people concerned, TuniCall implements appropriate technical and organisational measures. The current measures include the following.

Access control

• Personal user accounts with administrator and agent roles. Only administrators can manage users, configure AI agents, Campaigns, Provider connections and routing, or remove a do-not-contact flag.
• Passwords of at least 14 characters, stored only as scrypt hashes with a unique salt.
• Rate limiting and Cloudflare Turnstile bot protection on sign-in.
• Random session tokens, stored only as hashes, in cookies that are HTTP-only, secure and same-site strict, expiring after 12 hours. Deactivating a user ends their sessions immediately, and changing a password signs out other sessions.

Encryption

• HTTPS in production, with HTTP Strict Transport Security.
• Provider credentials encrypted at rest with AES-256-GCM. Secrets are write-only and never sent back to the browser.

Integrity of integrations

• Authentication of incoming webhooks from phone line providers, by verifying their request signatures or shared credentials.
• Live audio sessions that require the Provider signature and a one-time token valid for 60 seconds.
• Maximum call durations, and deduplication of AI agent actions by Provider identifier.
• Requests that change data are accepted only from the application’s own origin.

Accountability and resilience

• An audit log of sign-ins, user and password changes, AI agent, Campaign, knowledge, routing and consent changes, calls placed, transfers and contact edits.
• Routing changes that are previewed and confirmed, with a snapshot of the previous configuration.
• Campaign dispatches whose outcome is uncertain are marked as unknown instead of being retried automatically.
• Application error logs that record only the type of error, without credentials or conversation contents.

Organisational measures

• Access to production systems and Customer Personal Data limited to authorised people who need it to provide, support or secure the service, under confidentiality obligations.
• Backups, where made, are subject to the same confidentiality and access restrictions.
• Regular review of the measures in the light of new risks and changes to the service.

TuniCall may update these measures, provided the overall level of protection is not reduced. The Customer is responsible for the security of everything under its control, including its users, devices, credentials, Customer Provider accounts and configuration, and, for self-hosted deployments, its infrastructure.

10. Sub-processors

The Customer gives TuniCall a general authorisation to engage sub-processors. The current sub-processors are:

TuniCall will inform the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance, by email, in the service or by updating this page after notifying the Customer, so that the Customer can object on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected part of the service before the change takes effect, and TuniCall will refund the fees prepaid for the remaining period. Where a change is urgently needed for security reasons or because a sub-processor fails, the notice period may be shorter.

TuniCall imposes on each sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and remains liable to the Customer for the performance of the sub-processor’s obligations as required by Data Protection Law.

As explained under “Roles of the parties”, Customer Providers are not sub-processors. This includes telephony carriers and phone systems such as Twilio, AI model providers such as OpenAI, Anthropic, Google or OpenAI-compatible endpoints including self-hosted Qwen models, and speech and voice providers such as Deepgram and ElevenLabs, when the Customer connects them with its own accounts.

11. Assistance with data subject requests

Taking into account the nature of the processing, TuniCall assists the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from people exercising their rights under Data Protection Law.

The service lets the Customer view and correct contact details and consent records and record opt-outs directly. Where the Customer cannot act directly in the service, for example to delete or export specific records, TuniCall will do so on the Customer’s written instruction within a reasonable time.

If TuniCall receives a request directly from a person concerning Customer Personal Data, it will forward it to the Customer without undue delay where the Customer can be identified, and will not respond to it itself, except to confirm that it has been forwarded, unless the Customer authorises it.

12. Other assistance

Taking into account the nature of the processing and the information available to it, TuniCall assists the Customer in meeting its obligations relating to the security of processing, the notification of personal data breaches, data protection impact assessments and prior consultations with supervisory authorities, including by providing information about the service, its data flows and its security measures.

TuniCall may charge reasonable costs for assistance that goes beyond the provision of standard documentation, unless the assistance is needed because of a breach of this DPA by TuniCall.

13. Personal data breach notification

TuniCall will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, as far as the information is available:

• the nature of the breach, including the categories and approximate number of people and records concerned;
• its likely consequences;
• the measures taken or proposed to address the breach and limit its effects;
• a contact point for more information.

Where the information is not all available at once, TuniCall will provide it in stages, without undue further delay. TuniCall will take reasonable steps to contain and investigate the breach, limit its effects and cooperate with the Customer.

As controller, the Customer is responsible for any notification to supervisory authorities and to the people concerned. TuniCall will not make such notifications on the Customer’s behalf unless the law requires it or the parties agree. A notification by TuniCall is not an admission of fault or liability.

Incidents that occur in the systems of Customer Providers or in the Customer’s own environment are not breaches by TuniCall. If TuniCall becomes aware of such an incident, it will inform the Customer and provide reasonable help.

14. Deletion and return of data

During the term, TuniCall deletes specific Customer Personal Data on the Customer’s written instruction.

When the provision of the service ends, the Customer may request an export of the Customer Personal Data, in a structured, commonly used and machine-readable format, within 30 days. After that period, TuniCall deletes the Customer Personal Data from its active systems within a further 30 days, unless a law to which TuniCall is subject requires it to keep the data. In that case, TuniCall protects the data and processes it only for the purpose required by that law. Copies in backups, where they exist, are deleted as those backups are replaced, and remain protected until then.

On written request, TuniCall will confirm the deletion in writing. Data held by Customer Providers in their own systems is not covered by this section; the Customer manages it directly with them.

15. Audits and information

TuniCall makes available to the Customer all the information necessary to demonstrate compliance with the obligations of Article 28 of the GDPR and equivalent provisions of Data Protection Law, and allows for and contributes to audits, including inspections, conducted by the Customer or by an independent auditor mandated by the Customer, under the following conditions:

• the Customer first relies on the documentation and written answers that TuniCall provides, and requests an audit only if they are not sufficient;
• the Customer gives at least 30 days’ written notice, unless a supervisory authority requires a shorter period or a personal data breach justifies it;
• audits take place no more than once in any 12-month period, except after a personal data breach or at the request of a supervisory authority;
• the scope, timing and duration are agreed in advance, and the audit takes place during normal business hours without unreasonably disrupting TuniCall’s operations;
• the auditor is bound by confidentiality and is not a competitor of TuniCall;
• the audit does not give access to the data of other customers, or to information whose disclosure would compromise the security of the service.

Each party bears its own costs of an audit, unless the audit reveals a material breach of this DPA by TuniCall.

16. International transfers

TuniCall and its sub-processors process Customer Personal Data in the locations where the service is hosted and from the countries where they operate. Information about these locations is available on request.

Where Data Protection Law restricts the transfer of personal data to another country, transfers by TuniCall or its sub-processors are made only with an appropriate safeguard, such as an adequacy decision, the standard contractual clauses adopted by the European Commission, the UK International Data Transfer Addendum, or the authorisation or other mechanism required by the applicable law. On request, TuniCall will sign the standard contractual clauses or other transfer instrument required for the processing under this DPA.

The Customer is responsible for transfers to the Customer Providers it connects, and for any formality that its own processing requires, such as an authorisation from the Tunisian supervisory authority (INPDP) for a transfer of personal data abroad. TuniCall will provide reasonable assistance.

17. Self-hosted deployments

If the Customer runs TuniCall on its own servers, TuniCall does not process the Customer Personal Data stored in that installation. If the Customer gives TuniCall access to the installation for support or maintenance, this DPA applies to that access: TuniCall accesses only the data needed for the task, only on the Customer’s instructions, and the Customer remains responsible for the security of its environment.

18. Liability

Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the terms of service, except where Data Protection Law does not allow them.

Nothing in this DPA limits the rights that people have under Data Protection Law. Where both parties are involved in the same processing, each party is responsible, between the parties, for the part of the damage that corresponds to its share of responsibility.

19. Term, precedence and changes

This DPA applies for as long as TuniCall processes Customer Personal Data and continues to apply until that data has been deleted or returned.

In case of conflict between this DPA and the terms of service on the processing of personal data, this DPA prevails. A data processing agreement signed by both parties prevails over this DPA. If any provision of this DPA is invalid, the rest remains in force.

TuniCall may update this DPA to reflect changes in Data Protection Law, in its sub-processors or in the service, following the procedure for sub-processors described above or, for other material changes, the change process in the terms of service. The “last updated” date at the top of this page shows the current version.