Calloptima Logo Calloptima

Processing & Security

Last updated: October 12, 2026

1. Data Processing Agreement (DPA)

Calloptima operates as a Data Processor or Sub-processor for our clients under the General Data Protection Regulation (GDPR) and other applicable privacy laws. We only process personal data on documented instructions from our clients, who act as the Data Controllers.

A formal Data Processing Agreement (DPA) is executed alongside our services agreements or Statements of Work (SOWs) before any access to Personal Identifiable Information (PII) or Protected Health Information (PHI) is granted. Where PHI is involved, a Business Associate Agreement (BAA) is also signed before access is granted.

2. Scope of Processing

During our engagements, we may process:

  • Client Contact Data: Names, emails, and business details of your team members for communication and billing purposes.
  • Call Data: Where we build, test or monitor voice agents for you, call audio, transcripts, recordings, and metadata, which may contain PII or PHI. This data is processed only as set out in the DPA and SOW.
  • System Data: Call logs, system architecture diagrams, and performance metrics required to build, monitor, and optimize your systems.

For work that does not need personal data, such as analysis or optimization, we ask clients to redact or anonymize PII and PHI before sharing datasets, logs, or recordings with Calloptima.

3. Security Measures

We implement technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption: All data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using industry-standard algorithms (e.g., AES-256).
  • Access Control: Access to client data is strictly limited to authorized personnel on a "least privilege" basis.
  • Data Minimization: We only collect, process, and retain data that is strictly necessary for the performance of our services.
  • Secure Deletion: Upon completion or termination of an engagement, all client data is securely deleted or returned in accordance with the DPA.

4. Sub-processors

Calloptima may engage third-party sub-processors to assist in delivering our services (e.g., secure cloud hosting, email delivery). Voice agents we build run on your infrastructure or your own platform accounts, under your own contracts with LLM, speech, and telephony providers. We ensure that all sub-processors are subject to strict confidentiality and data protection obligations that mirror our own commitments under GDPR.

5. Data Breach Notification

In the unlikely event of a personal data breach affecting client data, we will notify the affected Data Controller without undue delay (and in any event within 48 hours of becoming aware of the breach) and provide all necessary cooperation to assist with regulatory reporting obligations.

6. Contact the Data Protection Officer

For any questions regarding our data processing practices, security measures, or to request a copy of our standard DPA, please contact us at piotr@calloptima.com.