Data processing agreement

Last updated: 2 November 2026

This data processing agreement (DPA) is part of the agreement between the customer (you) and Callshield Limited, trading as Ekko Labs (we), under our terms of service. It applies whenever we process personal data for you in providing the Ekko Labs call compliance platform (the platform) or our phone service. It meets the requirements of Article 28 of the UK GDPR.

Terms such as controller, processor, personal data, personal data breach and data subject have the meanings in the UK GDPR and the Data Protection Act 2018.

1. Roles

You are the controller, and we are the processor, of the personal data we process for you under the agreement (customer personal data). The details of the processing are in Schedule 1.

2. Our obligations

We will:

• follow your instructions. We process customer personal data only on your documented instructions, unless the law requires otherwise; in that case we’ll tell you first, unless the law forbids it. The agreement, including your use and settings of the services, is your instruction. We’ll tell you if we think an instruction breaks data protection law.
• keep it confidential. Everyone we authorise to process customer personal data is bound to keep it confidential.
• keep it secure. We apply appropriate technical and organisational measures. Schedule 2 describes them.
• help you meet your obligations. Taking into account the nature of the processing, we help you respond to requests from data subjects, and with security, breach notification, data protection impact assessments and consultation with the ICO. Most requests can be met with the services’ own features, such as search, export and deletion. We may charge reasonable costs for help beyond that.
• notify breaches. We tell you without undue delay after becoming aware of a personal data breach affecting customer personal data. We give you the information you need to assess it and to notify the ICO and data subjects, and we update you as we learn more.
• delete or return data. When the agreement ends, you can export your data for 30 days. After that we delete customer personal data, including copies, without undue delay, unless the law requires us to keep it. Copies in backups are deleted as those backups are replaced in their normal cycle.
• show compliance. We make available the information you need to show that we meet this DPA. We allow audits by you, or by an auditor you appoint and who is bound by confidentiality, once a year, with 30 days’ notice, at your cost, and in a way that doesn’t disrupt the services or other customers’ data. We may meet this first with documents, questionnaires and certifications.

3. Sub-processors

3.1 You authorise us to use the sub-processors listed in Schedule 3.

3.2 We’ll tell you at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds, we’ll discuss it with you in good faith. If we can’t resolve your objection, you may end the affected services with no penalty and get a refund of fees prepaid for the period after that.

3.3 Each sub-processor is bound by a written contract with data protection obligations at least as protective as this DPA. We remain responsible to you for our sub-processors.

4. International transfers

We store customer personal data in the UK. We transfer it outside the UK only as Schedule 3 shows, and only:

• to countries the UK has found adequate, such as the EU and EEA; or
• with appropriate safeguards under the UK GDPR, such as the ICO’s International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework.

5. Your obligations

You confirm that you have a lawful basis for the processing you instruct, including recording and analysing calls. You also confirm that you have given the people on your calls the information the law requires, such as telling them that calls are recorded and analysed.

6. Liability and precedence

Liability under this DPA is subject to the limits in the terms of service. If this DPA conflicts with the terms, this DPA wins on data protection.

Schedule 1: Details of the processing

Subject matter and duration. Providing the platform and the phone service under the agreement, for its term and until the data is deleted under section 2.

Nature and purpose. Receiving, recording, storing and transcribing calls. Analysing them with AI models and compliance checks. Showing the results to your users for review. Reporting, exporting and CRM. Providing phone numbers and carrying calls. Supporting and securing the services.

Categories of data subjects.

• Your staff and users, such as advisers and managers.
• The people your staff speak to: customers, prospective customers and third parties.
• Contacts and companies in your CRM.

Types of personal data.

• Call recordings (voice), transcripts, and call details: phone numbers, times, durations, the parties on the call.
• Names, contact details and anything else said on calls or held in the CRM.
• The results of analysis: summaries, sentiment, tags, check results and quoted evidence.
• Users’ account details and activity.

Special category data. Calls can include information about health, finances, life events and other personal circumstances, especially where the platform helps you identify customers who may be vulnerable. The services process this as part of the call content. You decide how it is used, under your own Article 9 condition.

Schedule 2: Security measures

• Encryption in transit: all connections to the services use TLS.
• Encryption at rest: call recordings and transcripts in Amazon S3, and the database, are encrypted at rest.
• Separation of customers: each firm’s data is held separately in the application, and every request is restricted to the firm it belongs to.
• Access control: users get roles, and each role sees only the data its capabilities allow, for example an adviser only their own calls. Our staff’s access to production systems is limited to the people who need it, over a private network.
• Logging: logs record service activity and errors, not call content. Customer content is not written to logs.
• Resilience: we back up the database and keep the backups separately from the live systems.
• People: staff with access to customer personal data are bound by confidentiality.
• Incident response: we monitor the services and have alerts for failures, and we follow a documented process for personal data breaches.

Schedule 3: Sub-processors

Transcription and compliance checks run on servers we control in the UK. They are not sub-processors.