This Data Processing Agreement (“DPA”) is part of the Terms of Service and applies to every Aftertalk customer, on every plan, from the moment the Terms are accepted. It does not need to be signed separately. If you need a copy signed by both parties, write to privacy@aftertalk.co. It meets the requirements of Article 28(3) of Regulation (EU) 2016/679 (“GDPR”). This is a translation; the Polish version prevails.
1. Parties
- Controller: the Aftertalk customer that accepted the Terms and uploads call recordings to the Service (the “Customer”).
- Processor: Kacper Kądziołka, trading as Aftertalk, ul. Czerwone Maki 31B/21, 30-392 Kraków, Poland, NIP 6762706032, REGON 543141869 (“Aftertalk”).
Capitalized terms not defined here (e.g. Service, Customer Content) have the meaning given in the Terms. GDPR terms (e.g. processing, personal data breach) have the meaning given in the GDPR.
2. Subject matter, nature and purpose
The Customer entrusts Aftertalk with processing the personal data contained in Customer Content solely to provide the Service described in the Terms: storing recordings, transcribing speech, recognizing speakers, masking personal data in the text sent for AI analysis, analyzing calls against the Customer's criteria, and making the results available in the app and through the API.
- Types of data: voice recordings, transcripts and their translations, names, contact details and any other personal data spoken in a call, speaker labels set by the Customer, and analysis results (summaries, scores, tasks).
- Categories of data subjects: the Customer's employees and contractors who take calls, and the people they speak with (the Customer's customers, partners and other callers).
- Special categories of data: the Service is not designed to process them (e.g. health data). If the Customer's calls may contain them, the Customer is responsible for having a legal basis and should agree this with Aftertalk at privacy@aftertalk.co before processing starts. Masking covers the text sent for AI analysis, not recordings, which reach the transcription provider unchanged. Aftertalk does not process voice as biometric data and does not create voiceprints.
3. Duration
This DPA applies for as long as the Customer uses the Service, and afterwards for as long as Aftertalk keeps Customer Content under section 10.
4. Processing on documented instructions
Aftertalk processes the data only on the Customer's documented instructions. The instructions are the Terms, this DPA, and the Customer's configuration and actions in the Service (e.g. uploading a recording, project settings, analysis templates, deleting data). This includes transfers to a third country (section 8). If Union or Member State law requires Aftertalk to process the data otherwise, Aftertalk will tell the Customer before processing, unless that law prohibits it.
Aftertalk will tell the Customer promptly if, in its opinion, an instruction infringes the GDPR or other data protection law. Aftertalk does not use Customer Content for its own purposes, does not sell it, and does not use it to train or improve any AI models.
5. Confidentiality
Aftertalk ensures that everyone authorized to process the data has committed to confidentiality or is under a statutory obligation of confidentiality. Only people who need access to provide the Service or handle the Customer's request can access Customer Content.
6. Security of processing
Aftertalk applies the measures referred to in Article 32 GDPR, including:
- encryption in transit (HTTPS/TLS) and encryption of recordings and transcripts at rest;
- storing Customer Content in the Amazon Web Services Frankfurt region (EU), with database backups kept for 7 days;
- role-based access control at organization and project level, two-factor authentication, and separation of each customer's data;
- automatic masking (pseudonymization) of personal data in the text sent for AI analysis;
- limiting what reaches diagnostic and analytics tools (content masking, tokens removed from URLs);
- regular security reviews and software updates.
Aftertalk may change these measures as long as the overall level of protection does not decrease.
7. Sub-processors
The Customer gives Aftertalk general authorization to engage sub-processors. The current list, with what each one processes and where, is on the Sub-processors page.
- Aftertalk binds every sub-processor by contract to data protection obligations at least as protective as this DPA, and remains liable to the Customer for their performance.
- Aftertalk gives at least 30 days' notice of an intended addition or replacement, by updating the Sub-processors page and emailing the organization owner.
- During that time the Customer may raise a reasoned objection to privacy@aftertalk.co. If the parties can't resolve it, the Customer may terminate the Service with effect before the change, and Aftertalk will refund any prepaid, unused period.
8. Transfers outside the EEA
Some sub-processors (e.g. the transcription and AI analysis providers) process data in the United States. Aftertalk transfers data outside the European Economic Area only under a Chapter V GDPR mechanism: a European Commission adequacy decision (including the EU–US Data Privacy Framework, for certified recipients) or the standard contractual clauses. The mechanism for each sub-processor is listed on the Sub-processors page. The AI analysis provider receives text with personal data masked; recordings reach the transcription provider unmasked.
9. Assistance
- Data subject rights: the Service lets the Customer view, correct and delete Customer Content itself, and fetch transcripts and analysis results through the API. On request, Aftertalk will also provide a copy of the data in a machine-readable format. If a data subject contacts Aftertalk directly, Aftertalk will forward the request to the Customer and won't answer it itself unless the Customer asks it to.
- Articles 32–36 GDPR: Aftertalk will provide the information the Customer needs for security assessments, data protection impact assessments and any prior consultation with a supervisory authority.
- Personal data breaches: Aftertalk will notify the Customer of a personal data breach affecting Customer Content without undue delay, and no later than 48 hours after becoming aware of it. The notice will include the information listed in Article 33(3) GDPR as far as it is available, and Aftertalk will add to it as facts are established.
10. Deletion of data
- The Customer can delete individual calls at any time in the Service or through the API. Deleting a call permanently removes its recording, transcript and analysis results from Aftertalk's systems.
- Before it stops using the Service, the Customer can fetch its data through the API or ask Aftertalk for a copy.
- When the Service ends, Aftertalk will, at the Customer's choice, return or delete all remaining Customer Content within 30 days of a request sent to privacy@aftertalk.co, and will confirm this to the Customer, unless Union or Member State law requires further storage.
- Deleting an organization in the Service immediately blocks access to its data. The data stays blocked until it is permanently deleted at the Customer's request under the previous point.
- Database backups are kept for 7 days and deleted automatically, so data deleted from Aftertalk's systems is gone from backups within 7 days at most.
11. Information and audits
Aftertalk will make available the information needed to demonstrate compliance with Article 28 GDPR, in particular answers to security questionnaires. The Customer may carry out an audit, including an inspection, itself or through an independent auditor bound by confidentiality, no more than once a year (unless the audit follows a personal data breach or a supervisory authority's request), with at least 30 days' notice, during business hours, and in a way that does not disrupt the Service or breach the confidentiality of other customers' data. The Customer bears the cost of the audit.
12. Final provisions
- On data protection matters this DPA takes precedence over the Terms. Liability is governed by the Terms, subject to mandatory law.
- Aftertalk may amend this DPA in the same way as the Terms, with at least 30 days' notice. An amendment may not lower the protection of the Customer's data. If the Customer does not accept an amendment, it may terminate the Service before the amendment takes effect.
- This DPA is governed by Polish law. If the Polish and English versions differ, the Polish prevails.