Scope and definitions
This Data Processing Addendum ("DPA") is part of the Terms of Service between Recurra (operated by Lindenview Partners LLC) ("Recurra") and a business that uses Recurra Agents (the "Client"), and of any order form between them. It applies whenever Recurra processes Client Personal Data. A business whose team uses Recurra Practice may ask, at team@recurra.ai, for it to apply to personal data in its Practice workspace too.
- Client Personal Data: personal information Recurra processes on the Client's behalf to provide the Services, mainly about the Client's leads and contacts and the Client's own staff.
- Data Protection Laws: the privacy and data protection laws that apply to that processing, including US state privacy laws such as the California Consumer Privacy Act.
- Subprocessor: a service provider Recurra engages that processes Client Personal Data.
- Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Client Personal Data.
If this DPA and the Terms conflict about Client Personal Data, this DPA wins.
Roles
The Client is the controller (or "business") of Client Personal Data, and Recurra is its processor (or "service provider"). The Client decides who is contacted and why. Recurra processes Client Personal Data only to provide the Services to the Client. Details of the processing are in Annex 1.
The Client is responsible for the lawfulness of the Client Personal Data and its instructions, including having every consent and other legal basis required to contact, record and process its leads, and for the notices its own privacy policy gives them.
Processing on the Client's instructions
Recurra processes Client Personal Data only on the Client's documented instructions: the Terms, the order form, this DPA, and the Client's configuration and requests through the Services. Recurra will tell the Client if it believes an instruction breaks Data Protection Laws, and may decline to carry it out.
Recurra will not:
- Sell or share Client Personal Data, or use it for targeted advertising
- Retain, use or disclose it for any purpose other than providing the Services, or outside the direct business relationship with the Client
- Combine it with personal information from other sources, except as the Services need and the law allows
- Use it, or the conversations our agents have with the Client's leads, to train AI models
- Use the Client's leads to market Recurra's own products
Confidentiality of personnel
Recurra gives access to Client Personal Data only to personnel who need it to provide, support or secure the Services, and who are bound by confidentiality obligations.
Security
Recurra maintains the technical and organizational measures in Annex 2, appropriate to the risk of the processing, and may update them as long as the overall level of protection does not go down.
Subprocessors
The Client authorizes Recurra to use Subprocessors of the kinds listed in Annex 3. The current list of Subprocessors, by name, is available to the Client on request at team@recurra.ai. Recurra has written agreements with its Subprocessors that protect Client Personal Data, and remains responsible for their work under this DPA. Some Subprocessors process data only if the Client connects that service.
Recurra will give the Client at least 30 days' notice before adding or replacing a Subprocessor, by email or in the client portal. The Client may object on reasonable data protection grounds within 30 days of the notice; the parties will then work in good faith to resolve the objection, and if they cannot, the Client may end the affected Service.
Assistance with requests
If a person asks Recurra to access, correct or delete their information, or to stop being contacted, about Client Personal Data, Recurra will pass the request on to the Client and, taking into account the nature of the processing, help the Client respond. Recurra stops contacting a person who asks it to stop right away, and records the request so it can be honored. Recurra will also give the Client reasonable help with assessments and consultations Data Protection Laws require.
Security incidents
Recurra will notify the Client without undue delay after becoming aware of a Security Incident affecting Client Personal Data, and give the information the Client reasonably needs to meet its own obligations, as it becomes available. Recurra will take reasonable steps to contain and remedy the incident. Notice of an incident is not an admission of fault.
Deletion or return
During the Services, the Client may ask Recurra to delete Client Personal Data at any time. When the Services end, Recurra will, at the Client's written request, return or delete Client Personal Data within a reasonable time, except where the law requires Recurra to keep it, and except for a minimal record of opt-out and do-not-contact requests kept so they can be honored.
Audits
On reasonable written request, no more than once a year (or after a Security Incident), Recurra will give the Client the information reasonably needed to show it meets this DPA, such as answers to a security questionnaire. Any further audit is at the Client's cost, on reasonable notice, during business hours, under confidentiality, and in a way that does not disrupt the Services or expose other Clients' data.
Where data is processed
Recurra and its Subprocessors process Client Personal Data in the United States. Subprocessors may also process it in other countries where they operate, under their agreements with Recurra.
Term
This DPA lasts as long as Recurra processes Client Personal Data. The limitation of liability in the Terms applies to this DPA.
Annex 1: Details of processing
- Subject matter and purpose: running AI sales agents for the Client: contacting its leads by phone, text, email and on its website, answering its phone line, booking meetings, keeping its records and tools up to date, and reporting to the Client.
- Duration: while the Services are provided, and afterwards until deleted as in Deletion or return.
- People concerned: the Client's leads, prospects and customers, and the Client's staff who use the Services.
- Kinds of data: names and contact details (phone numbers, email), business details (company, title), call recordings and transcripts, texts and emails, meeting details, notes and outcomes, consent, opt-out and do-not-contact records, and portal account details.
- Sensitive data: none intended. The Client should not give Recurra sensitive personal information unless the parties agree it in writing.
Annex 2: Security measures
- Encryption of data in transit and at rest
- Each Client's data kept separate from other Clients'
- Sensitive information stored encrypted and used only for the purpose it was given for
- Access to personal data limited to personnel who need it
- Hosting with established cloud providers with industry-standard protections
- Opt-out and do-not-contact checks before calls and texts
Annex 3: Subprocessors
| Kind of subprocessor | What it does |
|---|---|
| Cloud hosting and databases | Running the Services and storing their data |
| Telephony and messaging | Phone calls, text messages and phone numbers |
| AI model providers | Conversations, voices, transcription, writing, analysis and quality review |
| Email delivery | Sending service emails and the agents' emails |
| Business contact data | Finding and checking business contact details |
| Scheduling | Booking meetings |
| Workplace messaging | Notices to Recurra's team |
| Payments | Subscription payments (Recurra Practice) |
| Analytics, error monitoring and security | Keeping the Services working and protected |
| Tools the Client connects | The Client's CRM, mailbox, calendar, phone system or workplace messaging, only when the Client connects them |
The list of Subprocessors by name is available to Clients on request at team@recurra.ai.
Contact
Questions about this DPA, requests and notices go to team@recurra.ai.