Data Processing Addendum

Callspace Technologies Inc. · Effective October 22, 2026

This Data Processing Addendum (“DPA”) is part of the Callspace Terms of Service (the “Terms”) between Callspace Technologies Inc. (“Callspace”) and the Customer. Words defined in the Terms have the same meaning here.

1. Scope

1.1 This DPA applies to Customer Personal Information. “Customer Personal Information” means personal information about End Users and Users that Callspace collects, uses, discloses or stores for the Customer through the Service. It includes Communication Content, AI-derived insights, and information that Callspace receives from integrations the Customer connects.

1.2 This DPA does not apply to personal information that Callspace collects for its own purposes, such as account contact details, billing information and website analytics. The Callspace Privacy Policy covers that information.

1.3 Schedule A applies when the Customer is a health information custodian under Ontario’s Personal Health Information Protection Act, 2004 (“PHIPA”). Schedule B lists Callspace’s security measures. Both schedules are part of this DPA.

2. Roles

2.1 The Customer controls Customer Personal Information and is accountable for it under the privacy laws that apply to the Customer, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Alberta’s Personal Information Protection Act (“PIPA”).

2.2 Callspace is the Customer’s service provider. Callspace handles Customer Personal Information only on the Customer’s behalf and only as this DPA permits.

2.3 The Customer is responsible for:

1. giving End Users the notices that the law requires, including notice that a call is recorded and that an AI agent answers it;
2. getting any consent that the law requires for the collection, use and disclosure of Customer Personal Information through the Service;
3. choosing the retention settings and integrations that fit its legal obligations.

3. Instructions

3.1 Callspace uses Customer Personal Information only to provide, secure and support the Service for the Customer, and to comply with the law.

3.2 The Customer’s instructions are these Terms, this DPA, and the settings the Customer chooses in the Service. The Customer can give further written instructions that are consistent with the Terms.

3.3 Callspace does not sell Customer Personal Information. Callspace does not use Customer Personal Information for its own marketing. Callspace does not use Customer Personal Information to train general-purpose AI models.

3.4 If Callspace thinks an instruction breaks the law, Callspace tells the Customer and does not have to follow that instruction.

4. Confidentiality and personnel

4.1 Only the Callspace co-founders and contractors who need access to provide the Service can access Customer Personal Information.

4.2 Every person with access has signed a written confidentiality agreement, and completes security and privacy training at the start and every year.

5. Security

5.1 Callspace protects Customer Personal Information with physical, administrative and technical safeguards that are appropriate to the sensitivity of the information. Schedule B lists these safeguards.

5.2 Callspace can change its safeguards. A change must not lower the overall protection of Customer Personal Information.

6. Sub-processors

6.1 The Customer authorizes Callspace to use the sub-processors listed in section 6.1 of the Callspace Privacy Policy at usecallspace.com/privacy.

6.2 Callspace has a written agreement with each sub-processor. Each agreement requires the sub-processor to protect Customer Personal Information to a standard that is at least as high as this DPA requires, and to use it only to provide its service to Callspace.

6.3 Callspace tells the Customer by email at least 30 days before a new sub-processor receives Customer Personal Information, and updates the Privacy Policy list. If Callspace must replace a sub-processor urgently to keep the Service secure or available, Callspace tells the Customer as soon as possible after the change.

6.4 The Customer can object to a new sub-processor by email to legal@usecallspace.com within 30 days of the notice. If Callspace and the Customer cannot resolve the objection, the Customer can terminate the affected Service. Callspace then refunds the prepaid fees for the rest of the term, despite section 5.7 of the Terms.

6.5 Integrations that the Customer connects, such as Google Calendar, Calendly, Jobber, Shopify, Juvonno and Cliniko, are the Customer’s providers. They are not Callspace sub-processors. Callspace sends them only the data that the Customer’s settings require. Callspace stops the data flow and deletes or revokes the access token when the Customer disconnects an integration.

6.6 Callspace is responsible to the Customer for the acts of its sub-processors under this DPA.

7. Data location

7.1 Callspace and its sub-processors store and process Customer Personal Information in the United States. The production database and its backups are in the AWS us-east-2 region (Ohio). Some sub-processors also process information in other countries, as section 6.1 of the Privacy Policy shows.

7.2 Information stored outside Canada is subject to the laws of that country, and its courts, law enforcement and national security authorities can get access to it under those laws.

7.3 Callspace tells the Customer at least 30 days before it moves the production database to a different country.

8. Security incidents

8.1 A “Security Incident” is the loss or theft of Customer Personal Information, or access to, use or disclosure of Customer Personal Information without authorization.

8.2 Callspace tells the Customer within 24 hours after Callspace confirms a Security Incident. Callspace sends the notice to the account owner’s email address.

8.3 The notice says what happened, what information and how many people are affected, what Callspace has done to contain it, and who the Customer can contact at Callspace. Callspace sends more facts as it finds them.

8.4 Callspace helps the Customer to give the notices and reports that the law requires. The Customer decides whether to notify End Users and regulators about Customer Personal Information, unless the law requires Callspace to do it.

8.5 Callspace keeps a record of every Security Incident for at least 24 months.

9. Requests from individuals

9.1 If Callspace receives a request from an individual to access, correct or delete Customer Personal Information, Callspace sends it to the Customer within 5 business days. Callspace does not answer the request itself unless the Customer tells it to.

9.2 Callspace helps the Customer to answer requests. The Customer can export, correct and delete Communication Content in the Service.

10. Requests from authorities

10.1 If a court, law enforcement agency or other authority asks Callspace to disclose Customer Personal Information, Callspace tells the Customer before it discloses, unless the law forbids the notice.

10.2 Callspace discloses only the information that the law requires it to disclose.

11. Retention and deletion

11.1 During the subscription, Callspace keeps Communication Content for the retention period that the Customer sets. When the Customer deletes Communication Content, Callspace deletes it from its database and storage, and from the copy held by the AI voice provider. Backups that contain it are overwritten within 14 days.

11.2 After the subscription ends, the Customer can export Customer Data for 30 days. Callspace then deletes Customer Personal Information. Backups that contain it are overwritten within a further 14 days.

11.3 Section 8 of the Privacy Policy lists the cases where a sub-processor keeps a copy for a longer period under its own retention rules. Callspace keeps that list current.

11.4 Callspace can keep information longer only where the law requires it. This DPA continues to protect that information while Callspace keeps it.

12. Information and audits

12.1 Once in each 12 months, and when the Customer has a Security Incident or a regulator’s request, Callspace answers the Customer’s reasonable written questions about how it protects Customer Personal Information.

12.2 When Callspace has a SOC 2 Type II report, it gives a copy to the Customer on request under a confidentiality agreement. Callspace’s SOC 2 Type II audit is in progress.

12.3 If a regulator with authority over the Customer requires an audit of Callspace, Callspace co-operates with that audit.

13. Term and precedence

13.1 This DPA applies for as long as Callspace has Customer Personal Information.

13.2 If this DPA and the Terms conflict on Customer Personal Information, this DPA prevails. If Schedule A and the rest of this DPA conflict on personal health information, Schedule A prevails.

13.3 Sections 10 (Limitation of Liability) and 13 (Dispute Resolution) of the Terms apply to this DPA.

13.4 Callspace can update this DPA. Callspace gives at least 30 days’ notice by email of a change that lowers the protection of Customer Personal Information.

Schedule A: Personal health information (Ontario)

A.1 This Schedule applies when the Customer is a health information custodian under PHIPA (the “Clinic”). “PHI” means personal health information, as PHIPA defines it, that Callspace handles for the Clinic. It includes call recordings, transcripts and summaries of calls with patients, and patient details that Callspace sends to or receives from the Clinic’s practice management system.

A.2 Callspace is the Clinic’s agent under PHIPA. Callspace collects, uses, discloses, keeps and disposes of PHI only on the Clinic’s behalf, only as the Clinic permits, and only as PHIPA permits. The Clinic stays responsible for the PHI.

A.3 Callspace uses PHI only to provide the Service to the Clinic. Callspace does not:

1. use PHI for its own purposes, including to improve the Service;
2. make aggregated, anonymized or de-identified data from PHI, despite section 6.3 of the Terms;
3. use PHI to train any AI model;
4. disclose PHI to anyone except the Clinic, the sub-processors in DPA section 6, and the integrations the Clinic connects, unless the law requires it.

A.4 Callspace turns on compliance mode for every Clinic. Compliance mode writes an access log entry each time someone opens a record that contains PHI. Callspace gives the Clinic a copy of the access log on request.

A.5 Callspace tells the Clinic at the first reasonable opportunity, and within 24 hours after Callspace confirms it, if PHI is stolen or lost, or is used or disclosed without authority. The notice contains the facts in DPA section 8.3. The Clinic decides how to notify patients and the Information and Privacy Commissioner of Ontario, and Callspace helps it.

A.6 Callspace sends a patient’s request for access to or correction of PHI to the Clinic within 5 business days. Callspace helps the Clinic to find, export or correct the PHI.

A.7 PHI is stored in the United States, as DPA section 7 states. The Clinic is responsible for telling its patients about this where PHIPA or its professional rules require it.

A.8 Before Callspace makes an outbound call to a patient for the Clinic, such as a reminder or a call to book a referred patient, the Clinic must have the authority under PHIPA to use the patient’s information for that call. The call identifies the Clinic at the start and gives a callback number.

A.9 Each person at Callspace with access to PHI completes privacy training that covers PHIPA every year.

A.10 When the subscription ends, Callspace returns PHI by export and then deletes it, as DPA section 11 states.

A.11 This Schedule covers Clinics in Ontario only. Before Callspace serves a health clinic in another province, Callspace adds the terms that the health privacy law of that province requires.

Schedule B: Security measures

Area	Measure
Encryption	Data is encrypted in transit with TLS 1.2 or higher. The database and object storage encrypt data at rest. Access tokens for integrations are encrypted at rest.
Access control	Each person gets only the access that their role needs. The other co-founder approves each grant of access. Access is reviewed every quarter.
Authentication	Callspace staff use a password manager and multi-factor authentication on every system that holds Customer Personal Information. Customers sign in with Google or with a single-use email link that expires after 15 minutes. Callspace stores no customer passwords.
Recordings	Call recordings are in private storage. A link to a recording expires after 5 minutes.
Logging and monitoring	System logs are kept in Cloudflare and archived. Alerts go to the security owner by email. Logs are reviewed every month.
Vulnerability management	Automated dependency, code and secret scans run before each release. A penetration test runs every year. Critical issues are fixed within 7 days, high within 30 days, medium within 90 days.
Change management	Each production change goes through a reviewed pull request with required automated tests.
Backups and recovery	Database backups run every 12 hours and are kept for up to 14 days. The recovery point objective is 12 hours and the recovery time objective is 24 hours. A restore test runs every year.
Devices	Staff laptops and phones are encrypted, lock after 5 minutes, install updates automatically, and are checked by a device agent. A lost device is reported within 24 hours and wiped.
Personnel	Each person with access signs a confidentiality agreement and completes security and privacy training at the start and every year.
Sub-processors	Callspace reviews the security report of each sub-processor that holds Customer Personal Information before use and every year.
Incident response	Callspace has a written incident response plan and tests it with an exercise every year.