Data processing addendum

01Parties and roles

Propgent is offered by two affiliated companies. Which one you deal with depends on where you are:

Both companies are referred to as “Propgent”, “we” or “us”. Where a right or obligation belongs to your contracting entity, it also protects the other entity to the extent it helps provide the Service to you. Contact for both: hello@propgent.io.

In this addendum the customer is the Controller (in India, the Data Fiduciary) and the customer’s contracting entity is the Processor (the Data Processor). Where 711webservices LLC and Medigent Technologies LLP both take part in providing the Service, the second entity acts as a subprocessor of the first under the same terms.

02Details of the processing

03Processor obligations

• Process personal data only on the Controller’s documented instructions, which are the Terms, this addendum and the settings the Controller chooses in the app, unless law requires otherwise, in which case we tell the Controller first where allowed.
• Ensure staff with access are bound by confidentiality and trained.
• Implement the security measures in section 05.
• Not use Controller personal data to train models for other customers.
• Assist the Controller, taking account of the nature of the processing, with data-subject requests, security, breach notification and impact assessments.
• Tell the Controller if an instruction appears to break data-protection law.

04Controller obligations

The Controller confirms it has a lawful basis for every contact it loads or calls, has given data subjects the required privacy information, keeps its do-not-call list current, and will not upload data it is not entitled to process. The Controller is responsible for the accuracy of its instructions and for the settings it selects in the app.

05Security measures

• Encryption in transit (TLS) and at rest; integration tokens encrypted with keys held outside the database and displayed once.
• Per-organization isolation enforced at the database layer, with every query scoped to the organization.
• Recordings and identity documents held in private storage accessible only through short-lived signed links.
• Role-based access for staff, logged administrative actions, and least-privilege service credentials.
• Request-size limits, rate limits and outbound-request safeguards on every integration path.
• Daily encrypted backups and a tested restore procedure.

06Subprocessors

The Controller authorises the subprocessors below. We will publish changes on this page and notify account holders by email at least 14 days before a new subprocessor handles Controller data; the Controller may object in writing within that period and, if we cannot resolve the objection, may terminate the affected part of the Service with a pro-rata refund of unused minutes.

07International transfers

For personal data subject to the GDPR, UK GDPR or Swiss law, the parties enter into the EU Standard Contractual Clauses (Module Two, controller to processor, and Module Three where applicable) and the UK International Data Transfer Addendum, which are incorporated by reference, with the Controller as data exporter and the Processor as data importer. For personal data subject to India’s Digital Personal Data Protection Act, 2023, transfers are made only to countries not restricted by the Central Government, and the Processor will inform the Controller of any change.

08Deletion and return

During the term the Controller can export contacts, recordings and transcripts from the app or the API at any time. On termination the Controller has 30 days to export. We then delete Controller personal data from active systems within 30 days and from backups within a further 30 days, and confirm deletion on request, except for data we must keep by law, which stays protected under this addendum.

09Breach notification

We notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting Controller data, with the information the Controller needs for its own notifications, and we keep the Controller updated as the investigation continues.

10Audits

Once a year, on 30 days’ notice, the Controller may ask for evidence of compliance with this addendum. We respond with documentation, security summaries and completed questionnaires. Where a regulator or the Controller’s own obligations require an on-site audit, the parties agree its scope, timing and confidentiality in advance, and the Controller bears its cost.

11Liability and precedence

Liability under this addendum is subject to the limits in the Terms of service. If this addendum conflicts with the Terms, this addendum prevails for personal-data matters; the Standard Contractual Clauses prevail over both where they apply.