Data Processing Agreement

This Data Processing Agreement ("DPA") applies whenever an organization ("Team", "Customer" or "Controller") uses QuikRing's Team Calling product, operated by Syntropy Solutions, LLC ("QuikRing", "Processor"). It supplements our Terms of Service and forms part of the contract between the Team and QuikRing wherever QuikRing processes personal data on the Team's behalf, to satisfy Article 28(3) of the EU and UK GDPR. If your Team needs a signed, standalone copy, email legal@quikring.com.

For a Team's own call data — call metadata (numbers called, duration, cost), call recordings where the Team enables recording, shared contacts, and call notes/tags — the Team is the controller and QuikRing is the processor, acting only on the Team's instructions as set out in this DPA and the Team's configuration of the product (recording on/off, retention period, allowed countries, and similar settings).

QuikRing remains the controller for data that is about using QuikRing itself rather than about the Team's business — a member's own account credentials and login history, and the billing records of the Team's purchases — which our main Privacy Policy covers.

• Subject matter: QuikRing's processing of personal data in connection with the Team Calling product — placing and receiving calls, recording them where enabled, and the related call logs, contacts and notes.
• Duration: for as long as the Team's account is active, plus any period QuikRing retains data afterward under Section 7 (retention) below.
• Nature and purpose: providing voice calling and the related features of Team Calling (call routing, recording, transcription where used, billing and usage reporting) to the Team and its members.

• Data subjects: the Team's members (people the Team has added to its account) and the callees they call or are called by.
• Categories of personal data: members' call metadata (numbers dialed or receiving calls, call duration, cost, timestamps, country); call recordings and any automatic transcript, where the Team has turned recording on; contacts the Team shares internally; and call notes/tags a member adds to a call.

QuikRing will:

• Process personal data only on the Team's documented instructions — given through the product itself (the Team's own configuration) and this DPA — unless required otherwise by law, in which case we will tell the Team first unless the law prohibits that.
• Ensure anyone authorized to process the data (QuikRing staff and contractors) is bound by confidentiality.
• Implement appropriate technical and organizational security measures under Article 32 GDPR — see our Security page for the current detail.
• Use only the sub-processors listed on our Sub-processors page, give notice there before adding a new one that would process the Team's data, and give the Team a reasonable opportunity to object to a new sub-processor before it starts processing the Team's data; if the Team objects and the parties cannot resolve it, the Team may terminate the affected service.
• Assist the Team, taking into account the nature of the processing, in responding to data subject requests (access, correction, deletion, objection) that reach QuikRing concerning the Team's data, and in carrying out data protection impact assessments (DPIAs) and prior consultations where required — see our runbook reference in Section 6 below for how we handle a request about a Team recording specifically.
• Notify the Team without undue delay after becoming aware of a personal data breach affecting the Team's data.
• At the Team's choice, delete or return all personal data at the end of the relationship, except where QuikRing is required to keep it (e.g. billing and tax records, de-identified per Section 7 below).
• Make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the Team or an auditor it mandates, on reasonable notice.

When a callee (someone who was called by, or called, a Team member) asks to access or delete a recording of their call, QuikRing verifies the request, identifies the Team the call belongs to, and works with the Team as controller to redact or fulfill it. This is documented operationally, not here, so that it stays current with how we actually handle it.

• Call recordings: kept for the Team's own configured retention period (Rules > call recording retention), 12 months by default. Shortening it does not retroactively delete recordings already older than the new period until the next cleanup pass; lengthening it only affects recordings made afterward.
• Call logs (numbers, duration, cost — not recordings): kept for the life of the Team's account, since they are also the billing and usage record. After a Team or a member's account is deleted, the remaining call and payment records are de-identified — no longer linked to a name or email — and kept only as required for accounting, tax and dispute purposes, as described in our Privacy Policy.

Our production servers and database are hosted in the European Union. Where personal data processed under this DPA is transferred outside the EEA or UK — including to sub-processors located in the United States (see our Sub-processors page) — QuikRing relies on the European Commission's Standard Contractual Clauses (SCCs) and, for transfers from the UK, the UK Information Commissioner's International Data Transfer Addendum, with those sub-processors.

As controller for its own call data, the Team is responsible for having a lawful basis for the processing it instructs QuikRing to carry out, and in particular for:

• Telling its members, before or when they join, that their calls on the Team — numbers called, call length, cost and, if the Team records calls, the recordings — are visible to the Team's owner and admins. QuikRing's product collects this acknowledgment at the point a member joins (or, for an existing member, on their next visit) so the Team does not have to build its own notice flow, but the underlying legal responsibility for notice is the Team's.
• Obtaining any internal approval required before turning on forced call recording for its members where local law requires it — for example, in Germany, a works council's co-determination right under §87 BetrVG, or in France, consultation with the Comité Social et Économique (CSE). This is a genuine approval requirement in some jurisdictions, not just a notice duty, and QuikRing has no visibility into whether a Team has obtained it.
• Having a lawful basis to call or message the callees it reaches through the product, and complying with do-not-call and consent rules in the countries it calls — see our Acceptable Use Policy.
• Configuring the product (recording, retention, allowed countries, rules) consistently with its own obligations, since QuikRing processes data according to that configuration.

Questions about this DPA, or to request a signed copy: