Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) is entered into between:

Clusterlabs Ltd., incorporated in the Abu Dhabi Global Market (ADGM), United Arab Emirates. (“Processor”),
and
Customer, the entity using the Callab.ai services (“Controller”).

This DPA supplements the Terms of Service or other written or electronic agreement under which Processor provides Callab.ai services (“Agreement”).

1. Definitions

Unless otherwise defined herein, terms shall have the meanings given in the ADGM Data Protection Regulations 2021.

“Data Protection Law” means all applicable data protection and privacy legislation, including ADGM Data Protection Regulations 2021, and where applicable the GDPR, UK Data Protection Act 2018, and other international laws.
“Personal Data” means any information relating to an identified or identifiable natural person.
“Processing” means any operation performed on Personal Data, whether automated or not.
“Sub-Processor” means any third party engaged by the Processor to process Personal Data.

The Controller determines the purposes and means of processing.
The Processor processes Personal Data only on behalf of the Controller in accordance with this DPA.

Subject matter: Provision of AI-powered voice assistant services (Callab.ai).
Purpose: Handling, recording, and analyzing calls and related metadata to deliver, maintain, and improve the services.
Duration: For the term of the Agreement, and until all Personal Data is deleted or returned to Controller.

Data Subjects: Controller’s customers, prospects, employees, contractors, and authorized users.
Personal Data categories:
- Contact data (phone numbers, names where provided).
- Call metadata (timestamps, duration, call status).
- Audio recordings and transcriptions.
- Interaction analytics and usage logs.
Special categories: Not intentionally processed. Controller must not submit such data unless lawful and agreed in writing.

Processor shall:

Process data only on documented instructions of the Controller.
Ensure persons authorized to process data are bound by confidentiality.
Implement and maintain appropriate technical and organizational measures (TOMs) (Annex II).
Notify Controller without undue delay of any personal data breach.
Assist Controller with data subject rights requests.
Make available all information required to demonstrate compliance and allow audits.

Controller authorizes Processor to engage Sub-Processors (Annex III).
Processor shall impose on Sub-Processors data protection obligations no less protective than this DPA.
Processor shall provide notice of any intended changes to Sub-Processors, giving Controller the opportunity to object.

Personal Data may be transferred outside ADGM for service provision.
Such transfers will comply with ADGM Data Protection Regulations, using adequacy findings, Standard Contractual Clauses, or other appropriate safeguards.
For EU/UK data, SCCs and UK Addenda may apply.

The Controller is responsible for:

Each party shall be liable for breaches of this DPA in accordance with applicable law and the Agreement.
Nothing in this DPA limits either party’s liability for willful misconduct or fraud.

Information Requests
The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and applicable Data Protection Law.
Third-Party Audits by Processor
The Processor may appoint an independent third-party auditor to perform audits of its data protection and security practices. Summary reports of such audits may be shared with the Controller upon request.
Controller Audit Rights
If the Controller requires an audit, such audit shall:
- Be conducted by an independent third-party auditor appointed by the Controller and approved by the Processor (such approval not to be unreasonably withheld).
- Be limited in scope to systems and processes relevant to Personal Data processed under this DPA.
- Occur no more than once per year, unless required by a competent authority or following a confirmed data breach.
- Be carried out during normal business hours with at least 30 days’ prior written notice.
Costs
All costs and expenses related to any Controller-requested audit (including third-party auditor fees, Processor’s reasonable cooperation costs, and any associated expenses) shall be borne exclusively by the Controller.

Upon termination of services, Processor shall delete or return all Personal Data, unless retention is required by law.

This DPA is governed by the laws of ADGM. Disputes shall be subject to the exclusive jurisdiction of the ADGM Courts.

Categories of Data Subjects:

Types of Personal Data:

Processing Operations:

Retention Period:

For the duration of the Agreement. Data is deleted or returned upon termination, unless longer retention is required by law.

Access Control
- Role-based access management.
Data Security
- Encryption in transit (TLS v1.2, TLS v1.3) and at rest (AES-256).
- Regular penetration testing and vulnerability scanning.
Operational Security
- Logging and monitoring of system activities.
- Incident response and breach notification procedures.
Data Minimization
- Limiting collection to necessary fields.
- Configurable data retention periods.
Business Continuity
- Regular backups and disaster recovery planning.
- High-availability hosting infrastructure.
Staff Training
- Mandatory data protection and security training.