Data Processing Addendum

This Data Processing Addendum forms part of the agreement between a customer and AutoThink Group Ltd trading as Call Bullet. It applies where Call Bullet processes personal data on the customer’s behalf in providing inbound call tracking, outbound calling, SMS, AI voice agents, attribution, recordings, transcripts, reporting or API services.

The customer is controller and Call Bullet is processor for Customer Data, unless data-protection law gives the parties different roles for a particular activity. Each party will comply with UK GDPR, the Data Protection Act 2018 and other data-protection law applicable to it.

Call Bullet will process Customer Data only to provide, secure and support the service, comply with the agreement and the customer’s documented configuration and instructions, or meet a legal obligation. If we believe an instruction infringes applicable data-protection law, we will inform the customer unless prohibited by law.

People authorised to process Customer Data are bound by confidentiality. We maintain proportionate technical and organisational measures including authenticated access, workspace separation, least-privilege controls, encryption in transit and at rest, credential protection, backups, logging and restricted administrative access. Measures may evolve while maintaining an appropriate level of protection for the risk.

The customer gives general authorisation for the subprocessors needed to deliver the service. Our Subprocessor List describes their service categories. We impose data-protection obligations appropriate to the processing and remain responsible for our subprocessor obligations under this Addendum.

We will provide reasonable notice of a material new subprocessor through the service, legal centre or account contact. A customer with a reasonable data-protection objection should contact us promptly; the parties will work in good faith on a practical solution.

Where Customer Data is transferred from the UK to a country without an applicable adequacy regulation, the parties will use an appropriate safeguard such as the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses, together with supplementary measures where required.

Taking account of the processing, we will reasonably assist the customer with data-subject requests, security obligations, impact assessments and regulator consultations. If we become aware of a personal-data breach affecting Customer Data, we will notify the customer without undue delay and provide available information needed for its assessment. The customer remains responsible for its own notifications and lawful response.

On termination or a valid instruction, we will delete or return Customer Data within the service’s normal deletion cycle unless law requires retention. Backups and records subject to legal holds may remain protected until expiry. See the Retention and Deletion Policy.

We will provide information reasonably necessary to demonstrate compliance with this Addendum. Audits must be proportionate, protect other customers and confidential systems, avoid unnecessary disruption, and use existing independent or written evidence first where available.