Data Processing Addendum
How EvaSay processes personal data on behalf of its customers.
Last updated: October 31, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Terms") between Ecolor Web Limited, a company incorporated in Hong Kong ("EvaSay", "we" or "us") and the Customer that has accepted the Terms ("Customer" or "you"). It applies whenever EvaSay processes Customer Personal Data in providing the Service. You accept this DPA by accepting the Terms; no signature is needed. If you need a countersigned copy, contact support@evasay.com; a countersigned copy has the same content as this page, without changes.
Capitalized terms that are not defined in this DPA have the meanings given in the Terms.
2.1 Customer Personal Data. For Customer Personal Data, you are the controller (or a processor acting for your own customers) and EvaSay is your processor and, under the CCPA, your service provider. If you act as a processor, you warrant that your instructions, including the appointment of EvaSay as a further processor, have been authorized by the relevant controller, and you remain EvaSay's only point of contact for that controller.
2.2 Account Data. EvaSay processes Account Data as a controller, as described in the Privacy Policy. This DPA does not apply to Account Data.
2.3 Details of processing. The subject matter, nature, purpose and duration of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.
2.4 Self-hosted deployments and your own systems. Where you run a self-hosted deployment or send Customer Content to Customer-Directed Services, the processing that takes place on your infrastructure or in those services is not performed by EvaSay and is your responsibility. This DPA covers the Customer Personal Data that reaches EvaSay, such as the call records a self-hosted deployment reports to your workspace.
3.1 Instructions. EvaSay processes Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, and your configuration and use of the Service, including through the API. Any additional instruction requires our written agreement and may be subject to fees.
3.2 Unlawful instructions. EvaSay will inform you if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the processing concerned until the instruction is confirmed or changed. EvaSay is not obliged to review your instructions for legal compliance.
3.3 Processing required by law. EvaSay may process Customer Personal Data where required by applicable law, in which case it will inform you before the processing unless the law prohibits it.
3.4 Your obligations. You are solely responsible for:
4.1 Confidentiality. EvaSay ensures that the persons it authorizes to process Customer Personal Data are bound by obligations of confidentiality.
4.2 Service provider terms. EvaSay will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose Customer Personal Data for any purpose other than the business purposes set out in the Terms, including for any commercial purpose other than providing the Service, or outside the direct business relationship between you and EvaSay; or (c) combine Customer Personal Data with personal data it receives from or on behalf of anyone else, or collects from its own interactions with data subjects, except as the CCPA permits. EvaSay will comply with the obligations that apply to it under the CCPA, provide the level of privacy protection the CCPA requires, and notify you if it determines that it can no longer meet those obligations. You may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data. EvaSay certifies that it understands and will comply with this Section 4.2.
4.3 Model training. EvaSay does not use Customer Personal Data to train or fine-tune AI models without your prior written permission.
4.4 De-identified data. Where EvaSay derives de-identified or aggregated data from Customer Content, as Service Data under Section 7.4 of the Terms, it will take reasonable measures to ensure that the data cannot be associated with any individual, will not attempt to re-identify it, and will require any recipient to do the same.
5.1 EvaSay's measures. EvaSay implements and maintains the technical and organizational measures described in Annex 2. EvaSay may change those measures as long as the overall level of protection is not materially reduced.
5.2 Your measures. You are responsible for the security of your accounts, credentials, API keys and deployment keys; for the access you give Authorized Users; for your self-hosted infrastructure and Customer-Directed Services; and for using the security and privacy settings the Service makes available.
6.1 Authorization. You give EvaSay general authorization to engage Subprocessors. The current list is published at evasay.com/subprocessors.
6.2 Subprocessor terms. EvaSay will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective, in substance, than those in this DPA, to the extent applicable to the services the Subprocessor provides. EvaSay remains responsible for its Subprocessors' performance of those obligations to the extent required by Data Protection Laws.
6.3 New Subprocessors. EvaSay will update the list and email the owner of your workspace at least 30 days before a new Subprocessor begins processing Customer Personal Data. Where a new Subprocessor is needed urgently to keep the Service running, for example because a provider has failed, EvaSay will give notice as soon as practicable.
6.4 Objection. You may object to a new Subprocessor on reasonable data protection grounds by writing to support@evasay.com within 15 days after the notice. The parties will discuss the objection in good faith. If it is not resolved within a reasonable time, your sole and exclusive remedy is to stop using the part of the Service that uses that Subprocessor or to terminate the Terms.
6.5 Customer-Directed Services. Customer-Directed Services are not Subprocessors. Data you send to them is sent on your instructions and is governed by your agreements with their providers and by Sections 7.7 and 8.1 of the Terms.
7.1 Locations. Customer Personal Data may be processed in Hong Kong, the United States, the European Union and the other countries where EvaSay or its Subprocessors operate, as shown in the list of Subprocessors.
7.2 European Economic Area. To the extent EvaSay processes Customer Personal Data subject to the GDPR in a country that has not received an adequacy decision, the SCCs are incorporated into this DPA as follows: Module Two applies where you are a controller and Module Three where you are a processor; the docking clause in Clause 7 applies; Option 2 of Clause 9(a) applies, with the notice period in Section 6.3 of this DPA; the optional wording in Clause 11 does not apply; the supervisory authority under Clause 13 is the one determined in accordance with that clause; under Clause 17 the SCCs are governed by the law of Ireland; under Clause 18 disputes are resolved by the courts of Ireland; and Annexes I, II and III of the SCCs are completed by Annex 1, Annex 2 and the list of Subprocessors, respectively.
7.3 United Kingdom. For Customer Personal Data subject to the UK GDPR, the SCCs apply as amended by the UK Addendum. Tables 1 to 3 of the UK Addendum are completed with the information in Section 7.2 and the Annexes, and for Table 4 either party may end the UK Addendum as set out in its Section 19.
7.4 Switzerland. For Customer Personal Data subject to the FADP, the SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; references to the GDPR are read as references to the FADP; and the term "Member State" does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence.
7.5 Onward transfers. EvaSay will ensure that transfers of Customer Personal Data to Subprocessors are covered by a transfer mechanism recognized by Data Protection Laws where one is required.
7.6 Changes in law. If a transfer mechanism relied on under this Section 7 is invalidated or no longer suffices, the parties will cooperate in good faith to put an alternative in place, and EvaSay may suspend the affected transfer until they do.
8.1 Notice. EvaSay will notify you without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident.
8.2 Information. The notice will describe, to the extent then known, the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Where information is not available at once, EvaSay will provide it in phases as it becomes available.
8.3 Response. EvaSay will take reasonable steps to contain, investigate and mitigate the Security Incident.
8.4 Delivery and your duties. EvaSay will send the notice to the email address of your workspace owner. As controller, you are responsible for any notification to supervisory authorities and data subjects. EvaSay will not notify them on your behalf unless the law requires it.
8.5 No admission. EvaSay's notice of, or response to, a Security Incident is not an acknowledgment of fault or liability.
9.1 Requests from data subjects. The Service lets you find and export Customer Personal Data, and delete much of it, through the dashboard and the API. Where you cannot respond to a data subject's request with those features, EvaSay will, on your written request and taking into account the nature of the processing, provide reasonable assistance, including deleting the data you identify, at your expense where the law permits. If EvaSay receives a request directly from a data subject about Customer Personal Data, it will refer the person to you and will not respond itself, unless the law requires it.
9.2 Impact assessments and consultations. Taking into account the nature of the processing and the information available to it, EvaSay will provide information reasonably needed for your data protection impact assessments and prior consultations with supervisory authorities, to the extent you cannot obtain it yourself. EvaSay may charge reasonable fees for assistance beyond its standard documentation.
9.3 Requests from public authorities. If a public authority requires EvaSay to disclose Customer Personal Data, EvaSay will, unless the law prohibits it, notify you and give you a reasonable opportunity to seek a protective order, and it will disclose only what it is legally required to disclose.
10.1 Information. On your written request, no more than once in any twelve months, EvaSay will provide the information reasonably necessary to demonstrate its compliance with this DPA, such as answers to a reasonable security questionnaire and its then-current security documentation.
10.2 Audits. If that information is not sufficient to meet an obligation under Data Protection Laws, or a supervisory authority requires it, you may audit EvaSay's compliance with this DPA, on these conditions: you give at least 30 days' written notice; the audit is conducted during normal business hours by you or an independent auditor bound by confidentiality who is not a competitor of EvaSay; the scope, timing and duration are agreed in advance; the audit does not give access to other customers' data or to anything that would compromise the security of the Service; and you bear its costs and reimburse EvaSay's reasonable costs of supporting it.
10.3 Confidentiality. Information disclosed and the results of any audit are EvaSay's Confidential Information.
11.1 During the term. You can export and delete Customer Personal Data with the features of the Service. Where a feature for doing so is not available, EvaSay will delete the data you identify on your written request to support@evasay.com.
11.2 After termination. You are responsible for exporting Customer Personal Data before the Terms end. EvaSay will delete Customer Personal Data within 30 days after your account or workspace is closed or the Terms end. Copies in backups are deleted when those backups expire, within 35 days, and remain protected by this DPA until then.
11.3 Legal retention. Where the law requires EvaSay to keep Customer Personal Data, this DPA continues to apply to it, and EvaSay will process it only for the purpose for which it must be kept.
Each party's liability arising out of or related to this DPA, including the SCCs to the extent the law permits, is subject to the exclusions and limitations of liability in the Terms. Nothing in this DPA limits the rights of data subjects under the SCCs.
13.1 Term. This DPA remains in effect for as long as EvaSay processes Customer Personal Data.
13.2 Order of precedence. For the processing of Customer Personal Data, the SCCs prevail over this DPA, and this DPA prevails over the Terms. An Order may change this DPA only if it expressly says so.
13.3 Governing law. This DPA is governed by the law and dispute resolution provisions of the Terms, except that the SCCs are governed as set out in Section 7.
13.4 Changes. EvaSay may update this DPA to reflect changes in law, in the Service or in its Subprocessors, provided the update does not materially reduce the protection of Customer Personal Data, or as required by law. Updates take effect as described in Section 19 of the Terms.
13.5 Language. If a translation of this DPA conflicts with the English version, the English version controls.
Parties. Data exporter: the Customer; contact: the email address of its workspace owner; role: controller, or processor for its own customers; activities: use of the Service. Data importer: EvaSay; contact: support@evasay.com; role: processor; activities: providing the Service.
Categories of data subjects.
Categories of personal data.
Sensitive data. You must not submit data restricted by Section 5.6 of the Terms or special categories of personal data unless agreed in a signed Order. Voice recordings and voice samples may be treated as biometric data under some laws; EvaSay processes voice samples only to create and use the voice you request, and not to identify individuals. The measures in Annex 2 apply.
Frequency. Continuous, for as long as you use the Service.
Nature of the processing. Hosting, storage and transmission; real-time speech recognition, language model processing and speech synthesis during calls; call recording; transcript analysis and summaries; knowledge-base search; placing outbound calls in campaigns; webhooks and notifications; and creating and using cloned voices.
Purpose. Providing the Service in accordance with the Terms and your configuration.
Retention. Call audio is processed during the call and is not kept unless recording is turned on. Recordings, transcripts and call records are kept until they are deleted at your request or under Section 11. Voice API request logs, which do not contain request bodies, are kept for 30 days. Webhook delivery records, which contain the payloads sent, are kept for 30 days. You can set a retention period for your workspace, after which transcripts, recordings kept in EvaSay's storage, summaries and extracted fields are deleted automatically, and you can set an Agent not to keep the content of its calls at all.
Subprocessors. As listed at evasay.com/subprocessors, for the subject matter, nature and duration described in this Annex.
Competent supervisory authority. As determined in accordance with Clause 13 of the SCCs.
Encryption. Data in transit over the internet between browsers, Carriers' media streams, EvaSay's systems and Subprocessors is encrypted with TLS. Calls exchanged with your own SIP trunk or PBX use the protection that trunk supports. Stored data is encrypted at rest by EvaSay's hosting and storage providers. Carrier account credentials, storage credentials, connected-app tokens and notification webhook addresses that you give us are additionally encrypted by EvaSay with AES-256-GCM.
Keys and secrets. API keys and deployment keys are stored only as hashes and are shown once, when created. EvaSay's own credentials for third-party services are kept in server environment configuration and not in the database.
Access control. Access to a workspace is limited to its members, according to their roles. EvaSay personnel access Customer Personal Data only where needed to provide, secure or support the Service. Administrative actions are authorized on the server for each request and recorded in an audit log. Users can protect dashboard sign-in with two-step verification (time-based one-time codes), and changes to Agents, deletions and recording downloads in a workspace are recorded in an activity log that its owners and admins can review.
Separation. Customer Content is stored and queried per workspace.
Call security. Each call is authorized with a token that expires after 15 minutes. Workers authenticate to EvaSay with deployment keys. Callbacks from Carriers are verified by signature or by a secret specific to the connected account. Webhook payloads are signed so that you can verify them.
Network protection. Requests that Agents' functions and webhooks make are limited to public addresses and do not follow redirects, to prevent access to internal systems. Sign-up and visitors' web calls are protected against automated abuse, and interfaces are rate-limited.
Data minimization. Recording is off by default and offers consent options. Payment card numbers, IBANs and U.S. Social Security numbers are masked in the transcripts EvaSay keeps. Agents can be set to keep no transcript, recording or analysis of their calls, and workspaces can set a retention period after which call content is deleted. Service logs are designed to exclude call content. API request logs exclude request bodies and are kept for 30 days. A self-hosted deployment keeps call audio on the customer's own servers.
Availability. Speech recognition and language model providers fail over to alternatives, and a standby answers Carriers' calls when the main service does not.
Incident response. Service errors are monitored and reported to EvaSay personnel by email, and Security Incidents are handled as described in Section 8.
Subprocessors. Subprocessors are bound by written data protection terms as described in Section 6.