Back to home

Data Processing Agreement

Between Callsy AI OÜ (Processor) and the Merchant (Controller).

Last updated · April 20, 2026

Overview

This Data Processing Agreement (“DPA”) establishes data handling responsibilities between Callsy AI OÜ(“Processor”) and Merchants who use Callsy via the Shopify app, REST API, or Model Context Protocol (MCP) server. It forms an integral part of the Main Agreement between the parties and is incorporated by reference upon account creation or installation of any Callsy integration. No additional signature is required under GDPR Article 28.

1. Definitions

  • Personal Data: information relating to an identified or identifiable natural person, as defined in the GDPR.
  • Processing: any operation performed on Personal Data, including collection, storage, transmission, and deletion.
  • Data Protection Laws: all applicable laws and regulations relating to Personal Data, including the GDPR.
  • Services: the Callsy AI platform, including the Shopify app, REST API, MCP server, and related integrations.
  • End User: the natural person the Merchant contacts using the Services.

2. Processing scope and instructions

Processor shall process Personal Data solely to provide the Services — including automated outbound calling, cart recovery, call analytics, and execution of MCP tool calls triggered by the Merchant or by the Merchant’s authorised AI agent.

Processor shall not use Merchant or End-User data for training of general foundation models, without the Merchant’s explicit written instructions.

2.5 AI disclosure obligation

The Merchant shall ensure that all AI Agents configured via the Service disclose their non-human nature to the End User at the commencement of the call, in line with the EU AI Act.

3. Categories of data

Data categories covered by this DPA include:

  • Name, phone number, email
  • Order and cart information (value, items, status)
  • Lead and prospect status
  • Call metadata (duration, timestamps, outcome)
  • Call recordings and transcripts
  • Voice inputs (not used for biometric identification)

The Merchant shall not submit special categories of Personal Data unless agreed in writing.

4. Processor obligations

  • Confidentiality: Processor ensures that authorised personnel handling Personal Data are bound by confidentiality obligations.
  • Security: Processor implements the measures described in Annex 2 (TOMs).
  • Breach notification: Processor notifies the Merchant without undue delay and no later than 48 hours after becoming aware of a personal-data breach.
  • Assistance: Processor assists the Merchant with data-subject requests, DPIAs, and regulator consultations.
  • Deletion: Personal Data is deleted or anonymised within 30 days of termination, unless retention is legally required.
  • Sub-processors: Processor uses only the sub-processors listed in Annex 3, and informs the Merchant of material changes.

5. Merchant responsibilities

  • Obtain and maintain a lawful basis for all Processing, including consent where required
  • Comply with telemarketing, unsolicited-communication, and consumer-protection laws in every market contacted
  • Secure the Merchant’s own systems, API keys, and MCP credentials
  • Provide clear, accurate instructions to Processor

6. International transfers

Where Personal Data is transferred outside the EU/EEA, the parties rely on Standard Contractual Clauses and, where applicable, supplementary measures. Sub-processor locations and the specific transfer basis are listed in Annex 3.

7. Audit

Processor makes available to the Merchant, upon reasonable written request, the information necessary to demonstrate compliance with this DPA, including through independent audit reports. The Merchant shall treat any such information as confidential.

8. Term and termination

This DPA remains in force for the duration of the Main Agreement. On termination, Processor shall delete or return all Personal Data in accordance with Section 4.

9. Liability

Processor’s liability under this DPA is subject to the limits set out in the Main Agreement and the Terms of Service. In any event, aggregate liability is capped at the amounts paid by the Merchant to Callsy in the preceding 12 months. Processor shall not be liable for indirect or consequential damages, or for failures caused by the Merchant’s own systems or by third-party providers not under Processor’s control.

10. Governing law

This DPA is governed by the laws of the Republic of Estonia, without regard to conflict-of-law principles.

Annexes

The following annexes form an integral part of this DPA:

Questions? Email support@callsy.ai.