Parties
Processor:
EchoCall LLC
5830 E 2nd St Ste 7000
Casper, WY 82609, USA
Registered with the Wyoming Secretary of State, ID 2025-001817189
Represented by: Nico Dennis Günther
Privacy contact: team@echocall.de
(hereinafter "EchoCall" or "Processor")
Controller:
The customer as identified in the registration on hub.echocall.de or in the main agreement (hereinafter "Customer" or "Controller").
1. Subject matter, incorporation and order of precedence
This Data Processing Agreement ("DPA") specifies the data protection obligations of the parties arising from the agreement on the use of the EchoCall platform (SaaS platform for AI-powered voice and chat agents, the "Main Agreement"). It is concluded pursuant to Art. 28(3) GDPR.
The DPA becomes part of the contract upon completion of the registration on hub.echocall.de. Consent is declared electronically during registration and recorded by EchoCall with a timestamp and the version of the document set (Art. 28(9) GDPR, electronic form). Upon request, EchoCall provides a counter-signed copy; requests to team@echocall.de.
In case of conflict between this DPA and the Main Agreement, this DPA prevails in data protection matters. Annexes 1 to 4 form an integral part of this DPA.
- Annex 1: Subject matter and details of the processing
- Annex 2: Technical and organizational measures (TOM) under Art. 32 GDPR
- Annex 3: List of sub-processors (confidential, available to customers at hub.echocall.de, Settings, Compliance section)
- Annex 4: EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914)
2. Roles of the parties
The Customer is the controller within the meaning of Art. 4(7) GDPR for the personal data processed through the agents, phone numbers, chat widgets and integrations it configures. EchoCall processes this data exclusively as a processor within the meaning of Art. 4(8), Art. 28 GDPR.
Where the Customer itself acts as a processor for its own end customers (for example as an agency or systems integrator), EchoCall acts as a further processor (sub-processor) within the meaning of Art. 28(4) GDPR. The provisions of this DPA apply accordingly; Module 3 of the Standard Contractual Clauses (Annex 4) applies to third-country transfers. The Customer warrants that it holds the required authorizations of its controller for the use of EchoCall.
For data EchoCall processes for its own purposes (in particular account, contract and billing data of the Customer itself and data of the echocall.de website), EchoCall is an independent controller; the privacy policy at https://echocall.de/privacy-policy applies in that respect.
3. Subject matter, duration and details of the processing
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1. The duration corresponds to the term of the Main Agreement.
4. Right of instruction
EchoCall processes personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law to which EchoCall is subject; in such a case, EchoCall informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest (Art. 28(3)(a) GDPR).
Documented instructions include in particular: the Main Agreement, this DPA and the configurations the Customer makes in the platform (e.g. enabling or disabling call recording, retention periods, zero-PII mode, selection of integrations and model profiles, deletion actions). Further individual instructions must be given in text form to team@echocall.de.
If EchoCall is of the opinion that an instruction infringes the GDPR or other Union or Member State data protection provisions, EchoCall shall immediately inform the Customer (Art. 28(3) sentence 3 GDPR) and is entitled to suspend execution until clarified.
5. Confidentiality
EchoCall ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). Access to customer data is restricted to persons who need it to perform the contract.
6. Security of processing
EchoCall implements all measures required pursuant to Art. 32 GDPR (Art. 28(3)(c) GDPR). The measures implemented at the time of conclusion are described in Annex 2 (TOM). EchoCall may adapt the measures to the state of the art provided the level of protection is not reduced; the current version is available at https://echocall.de/security.
7. Sub-processors
The Customer grants EchoCall general authorization pursuant to Art. 28(2) GDPR to engage sub-processors. The sub-processors engaged at the time of conclusion are listed with full legal name, registered office, function and processing region in Annex 3. A public overview by category and region is available at https://echocall.de/security.
EchoCall informs the Customer at least 30 days before adding or replacing a sub-processor by email to the account address and by updating Annex 3 in the customer area. The Customer may object to the change within 30 days on substantiated data protection grounds. If the parties cannot agree on a reasonable alternative, the Customer may terminate the Main Agreement with respect to the affected service with effect from the planned engagement.
EchoCall imposes on each sub-processor, by way of contract, the same data protection obligations as set out in this DPA, in particular providing sufficient guarantees for technical and organizational measures (Art. 28(4) GDPR). Where a sub-processor fails to fulfil its obligations, EchoCall remains fully liable to the Customer for the performance of that sub-processor’s obligations.
Transfers initiated and controlled by the Customer itself do not constitute sub-processing, in particular third-party integrations activated by the Customer (e.g. the Customer’s calendar, CRM, ticketing or communication systems) and the selection of optional external model profiles instead of the default profiles EchoCall-Voice/EchoCall-Smart: the recipients are the Customer’s own processors or controllers or the external model providers; the Customer is responsible for the legal basis, the permissibility assessment and for contracts with those recipients. EchoCall gives no assurance under this DPA for external model profiles.
8. Processing location and third-country transfers
On standard plans, the platform’s production data (database, file storage, application operation) is processed exclusively on infrastructure in the European Union (IONOS data centres, Germany and France, in particular Frankfurt and Karlsruhe). The entire voice and chat processing (speech recognition, speech synthesis, dialog management and the LLM inference of the model profiles) likewise runs as EchoCall’s own software on this infrastructure; no external speech or model provider is involved.
As EchoCall LLC is a company established in the USA, the parties agree, as a precaution, on the EU Standard Contractual Clauses under Implementing Decision (EU) 2021/914 (Annex 4): Module 2 (controller to processor) or Module 3 (processor to sub-processor), depending on the Customer’s role under section 2. Individual sub-processors established, or with parent companies, in third countries are likewise safeguarded through Standard Contractual Clauses and, where applicable, certification under the EU-US Data Privacy Framework; details are set out in Annex 3.
A Transfer Impact Assessment (TIA) evaluating the legal situation in the third countries concerned and the supplementary measures taken is available for download at https://echocall.de/security.
For customers of the PartnerNet SaaS Titan plan the following applies instead: the server location of the dedicated whitelabel instance is agreed individually by contract and may be outside the EU; the data protection assessment of such a location is the Customer’s responsibility, and EchoCall supports with the necessary information.
9. Assistance; data subject rights
Taking into account the nature of the processing, EchoCall assists the Customer by appropriate technical and organizational measures in fulfilling the Customer’s obligation to respond to requests of data subjects (Art. 12 to 23 GDPR) (Art. 28(3)(e) GDPR). The platform provides search, export, anonymization and deletion functions for conversation data; additional assistance is provided on request to team@echocall.de within a reasonable period.
If a data subject request is received directly by EchoCall, EchoCall forwards it to the Customer without undue delay and does not answer it itself unless legally obliged to do so.
10. Breach notification; further assistance
EchoCall notifies the Customer of any personal data breach affecting customer data without undue delay after becoming aware of it, at the latest within 48 hours, to the email address on file. The notification contains, to the extent already available, the information listed in Art. 33(3) GDPR and is supplemented as new findings emerge.
Taking into account the nature of processing and the information available to it, EchoCall assists the Customer in ensuring compliance with the obligations under Art. 32 to 36 GDPR, in particular notifications to supervisory authorities, communication to data subjects, data protection impact assessments and prior consultations (Art. 28(3)(f) GDPR).
11. Deletion and return after the end of the contract
After the end of the Main Agreement, EchoCall deletes all personal data processed on behalf of the Customer within 30 days or returns it, at the choice of the Customer (Art. 28(3)(g) GDPR). Deletion of the customer account covers all agents, knowledge bases and conversation data stored in the platform.
Data subject to statutory retention obligations is exempt (in particular invoice and accounting data, 10 years under commercial and tax law); such data is blocked and deleted after expiry of the period. During the contract term, configurable retention periods, deletion functions and the zero-PII mode are available to the Customer (Annex 1).
Before deletion, the Customer may request an export of its configuration and conversation data (team@echocall.de); EchoCall provides the export in a common machine-readable format.
12. Confidentiality of Annex 3
The full Annex 3 contains trade secrets of EchoCall (the specific suppliers of the technology chain). The Customer undertakes to treat Annex 3 confidentially and to disclose it only: (a) internally to persons who need it for data protection compliance, (b) to its advisers bound to confidentiality, (c) to supervisory authorities and (d) to the extent required by law or to fulfil its own obligations under Art. 28, 30 GDPR towards its controllers, in which case the confidentiality obligation is passed on.
Public reproduction of Annex 3 is prohibited and constitutes a material breach of contract. The public sub-processor overview (categories, functions, regions) at https://echocall.de/security may be used freely. This confidentiality obligation does not restrict the rights of data subjects or the powers of supervisory authorities.
13. Evidence and audit rights
EchoCall makes available to the Customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR (Art. 28(3)(h) GDPR), in particular this document, the TOM, the sub-processor list, the TIA and existing certifications and attestations of the infrastructure used (including the ISO 27001 certification of the data centres).
The Customer may audit compliance with this DPA at most once per year, and additionally where there are concrete indications of infringements, itself or through an auditor bound to confidentiality and not competing with EchoCall. Audits must be announced at least 30 days in advance and take place during normal business hours without disrupting operations, primarily through information, inspection of documentation and configuration evidence. Physical access to the infrastructure providers’ data centres is excluded; their certifications and audit reports serve as evidence in that respect. Each party bears its own costs.
14. Liability
Art. 82 GDPR and the liability provisions of the Main Agreement apply to the liability of the parties. The parties indemnify each other to the extent a party has culpably breached the obligations assigned to it under this DPA or the GDPR.
15. Term and final provisions
This DPA applies for the term of the Main Agreement; sections 11 and 12 survive its termination. Amendments and supplements must be made in text form. Should any provision be invalid, the validity of the remaining provisions remains unaffected; the invalid provision is replaced by a valid provision that comes as close as possible to the economic intent.
The law of the Main Agreement applies, with the GDPR applying without restriction. The Standard Contractual Clauses (Annex 4) are governed by the law of the Federal Republic of Germany (Clause 17); the courts of Berlin, Germany are competent within the meaning of Clause 18. The German version of this DPA is authoritative; the English version is provided for information.
Annex 1: Subject matter and details of the processing
Subject matter and purpose
Provision and operation of the EchoCall platform (hub.echocall.de) for setting up and operating AI-powered voice and chat agents. This includes in particular: receiving and conducting phone calls and chat conversations, speech transcription (speech-to-text) and speech synthesis (text-to-speech), processing of conversation content through the platform’s model profiles, queries against the knowledge bases provided by the Customer, execution of actions and integrations configured by the Customer (e.g. appointment booking, ticket creation, transfer), live chat with the Customer’s human agents (Live Inbox), logging, statistics and billing.
Nature of the processing
Collection, storage, transcription, analysis, transmission to recipients configured by the Customer, anonymization, deletion. The default profiles EchoCall-Voice and EchoCall-Smart are EchoCall’s own models, operated exclusively on EchoCall’s own infrastructure in the EU; only they are covered by the DPA, TOM and TIA. Optional additional model profiles (e.g. of the GPT, Gemini, GLM and Qwen families) are operated by external model providers. Selecting them in the dashboard is the Customer’s own responsible decision: EchoCall gives no assurance of GDPR compliance for these profiles, does not guarantee processing in the EU and concludes no Standard Contractual Clauses with those providers; the Customer assesses the legal permissibility itself. Only the default profiles are to be used for privacy-sensitive applications.
Types of personal data
- Call audio data (where recording is enabled; can be disabled by the Customer)
- Transcripts of phone calls and chat histories
- Phone numbers, names and contact details of callers and chat users
- Content data disclosed by data subjects in the conversation (controlled by the Customer via conversation design, zero-PII mode and retention periods)
- Appointment, case and contact data from integrations activated by the Customer
- Knowledge content uploaded by the Customer, to the extent it contains personal data
- Connection and usage data (timestamps, duration, status, costs)
Special categories of personal data (Art. 9 GDPR)
The platform is not designed for the processing of special categories. Whether callers disclose such data in free conversation is beyond EchoCall’s control; the Customer manages this through conversation design, zero-PII mode and retention periods. For voice cloning (voice profiles as potentially biometric data): setup only at the Customer’s express request, with the Customer obtaining and documenting the data subject’s consent under Art. 9(2)(a) GDPR.
Categories of data subjects
- Callers and chat users of the agents operated by the Customer (end customers, prospects, possibly the Customer’s staff)
- Employees and agents of the Customer using the platform
- Contact persons from systems connected by the Customer
Retention and deletion during the term
- Retention period for conversation content configurable per agent: 1, 7, 30, 90 or 365 days, custom (1 to 3650 days) or unlimited; default for new agents: 30 days
- Deletion after expiry is automated across all stores of the platform (daily cleanup of transcripts, recording references and extracted content); billing and statistics data without conversation content is retained
- A subsequent reduction of the period applies to new conversations in the agent runtime store; conversations already stored can be deleted manually at any time, while in the analytics database the reduced period also applies to existing data
- Call recording (audio) can be disabled per agent; zero-PII mode available (no permanent storage of identifying conversation content)
- Manual deletion of individual conversations possible at any time; GDPR deletion function in the Live Inbox (final deletion after a 30-day grace period)
Annex 2: Technical and organizational measures
The technical and organizational measures under Art. 32 GDPR are described in the TOM document (same document set, download at https://echocall.de/security) and form part of this DPA.
Annex 3: List of sub-processors
The complete, confidential list of sub-processors (legal name, registered office, function, processing region, transfer mechanism) is available to customers after login at hub.echocall.de (Settings, Compliance section) as a download and is maintained there in versioned form. A public overview by category is available at https://echocall.de/security. The confidentiality provision in section 12 applies.
Annex 4: EU Standard Contractual Clauses
The Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 are incorporated by reference in their current version (official text: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj). The following applies:
- Module 2 (controller to processor) where the Customer is a controller; Module 3 (processor to sub-processor) where the Customer itself is a processor
- Clause 7 (docking clause): applies
- Clause 9(a): Option 2 (general written authorization), notice period for changes: 30 days
- Clause 11(a): the optional provision (independent dispute resolution body) does not apply
- Clause 17: Option 1, the law of the Federal Republic of Germany applies
- Clause 18(b): courts of Berlin, Germany
- Annex I of the Clauses (parties, description of the transfer): follows from the parties to this DPA and Annex 1
- Annex II of the Clauses (TOM): corresponds to Annex 2
- Annex III of the Clauses (sub-processors): corresponds to Annex 3
In case of conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.
Downloads
- DPA as PDF (English): https://echocall.de/documents/echocall-dpa-en.pdf
- AVV als PDF (German, governing version): https://echocall.de/documents/echocall-avv-de.pdf
- TOM (Annex 2): https://echocall.de/documents/echocall-tom-en.pdf
- Public sub-processor overview: https://echocall.de/documents/echocall-subprocessors-en.pdf
- Transfer Impact Assessment (TIA): https://echocall.de/documents/echocall-tia-en.pdf
- Annex 3 (confidential, customers only): hub.echocall.de, Settings, Compliance section
