Data Processing & Privacy Schedule

This schedule forms part of your agreement with EsyDial under the Customer Terms. It applies whenever personal information is handled through the service. How we handle personal information we collect for our own purposes (your account, billing and support records) is described in our Privacy Policy.

1. Roles: your data, our processing

• You collect; we process for you. Personal information about your callers, customers, staff and web-chat visitors that flows through the service is collected by your business for its own purposes. You are the responsible entity under the Privacy Act for that information. EsyDial processes it on your behalf and on your instructions, as your service provider, to deliver the service described in the Customer Terms.
• Your instructions are: the Customer Terms, your settings in the dashboard (recording, retention, integrations, features), and reasonable written instructions consistent with the service's functionality.

2. What the service processes

Depending on your plan and settings: call audio recordings; transcripts; caller and recipient phone numbers and call metadata; AI-generated classifications, summaries and extracted details; AI receptionist and web-chat conversations and captured leads (name, contact details, enquiry); contact records you sync from connected tools; alert messages; and staff account and device details (including, for VoIP devices, the physical address required for emergency calling).

Some of this may be sensitive information (for example, health information mentioned by callers to a dental or medical practice). You must not enable or use the service for sensitive information unless you have the right under privacy law to collect it that way.

3. Your obligations

• Keep the consent announcement on. The announcement is on by default and plays before recording begins. You may adjust wording but must not attempt to record without announcement. You are responsible for ensuring your recording configuration is lawful where you operate (Customer Terms clause 10).
• Keep your own privacy policy accurate. Your privacy policy must disclose your use of call recording, transcription and AI analysis, and the overseas processing described in section 5. We provide suggested wording you can adapt; using it does not transfer your compliance responsibility to us.
• Have a lawful basis for collecting and using the personal information you run through the service, including any staff monitoring and coaching features.
• Handle your callers' rights. Requests from your callers about their information (access, correction, deletion) are yours to answer. We provide tooling to help (section 6).
• Own your integrations. Where you connect third-party services (Customer Terms clause 12), you direct the transfer; those providers process the data under your arrangements with them, not as our sub-processors.

4. Our obligations

We will:

• process personal information only to provide, secure, support and improve the service, and as required by law, never sell it, and never use it to train third-party AI foundation models;
• protect it with technical and organisational measures appropriate to its sensitivity, including encryption in transit, tenant isolation, role-based access, audit logging, and per-device credential revocation;
• ensure our personnel are bound by confidentiality;
• bind sub-processors to written terms protecting personal information to a standard consistent with this schedule, and remain responsible to you for their processing;
• assist you, so far as reasonably practicable, with your obligations under the Privacy Act relating to information we process for you; and
• notify you without undue delay, and in any case within 48 hours of concluding our assessment, if we become aware of an eligible data breach affecting your data, giving you the information you reasonably need for your own obligations. Where you are the collector, notification duties to the OAIC and affected individuals may fall on you; we will cooperate in good faith.

5. Where data is processed (overseas disclosure)

Stored data stays in Australia.Call recordings, transcripts, analysis and account data are hosted and stored in Australia. Call carriage itself happens overseas, as set out below: audio is processed in our telephony provider's United States region while the call is in progress, and the recording is stored in Australia once the call ends.

Some processing occurs overseas. In providing the service, personal information is disclosed to service providers in the following categories and countries. A current list of providers by name is available to customers on request.

By using the service you authorise these disclosures, and you must reflect them in your own privacy policy (section 3). If a category's country changes, we will update this schedule and notify you under Customer Terms clause 20.

6. Retention, deletion, export

• Defaults: recordings 90 days; transcripts 180 days. You can set each between 1 and 3650 days in the dashboard; changes are audit-logged. Expired content is permanently deleted by an automated job; minimal metadata is retained for the audit trail.
• Derived content follows the source: summaries, AI raw output, quotes, coaching notes and alert message bodies derived from a transcript are deleted with it.
• Per-call deletion:account owners can permanently delete an individual call's recording, transcript, AI output and derived content, and mask the caller's number, at any time, for example to honour a caller's request.
• Provider copies of recordings are deleted from the telephony provider at ingest, so the Australian-hosted copy is the only copy under our control.
• Records of consent and acceptance (which announcement version played on a call; terms-acceptance records) are retained as evidence of lawful handling and are not deleted by content-deletion mechanisms.
• Export:you can export your data at any time via the dashboard's privacy export or by asking us.
• After cancellation: your data remains exportable for 30 days after your service ends, and is then permanently deleted, except minimal records we must keep for legal, billing or audit purposes.

7. Changes to sub-processing

We may add or replace providers within an existing category and country without notice. If a change moves a category to a new country, we will give you at least 30 days' notice under Customer Terms clause 20; if the change materially adversely affects you, the remedies in that clause apply.