Skip to the text

Data Processing Addendum

Last updated November 13, 2026

This Data Processing Addendum (“DPA”) is part of the Terms of Service between 2587689 Alberta Ltd., operating as Five at a Time (“we”, “us”), and the business that uses the Service (“you”). It applies automatically, with no signature, whenever we handle personal information on your behalf. Words defined in the Terms mean the same here.

1. Roles and scope

  • 1.1. For the leads you upload, the calls your team places and what comes out of them, you decide why and how the data is used. You are the controller (a “business” under some laws) and we are your processor (a “service provider”). This DPA covers that data, called “Customer Data” below.
  • 1.2. For your own account, your business verification, your billing and our fraud and abuse checks, we are a controller in our own right. Our Privacy Policy covers that data, and this DPA does not.

2. What we process

  • Whose data: the people on your lead lists and the people your team calls or emails.
  • What data: names, companies, job titles, phone numbers, email addresses and anything else in the columns you import; call records; call recordings, transcripts and AI notes; notes, statuses and Do Not Call marks your team adds; emails sent to leads through the Service and their replies.
  • Sensitive data: the Service is not built for health, financial account, government ID or similar sensitive information. Do not import it, and tell your reps not to record it.
  • Why: to provide the Service to you: dial, connect, record, transcribe, summarise, score, store and show your team its leads and calls.
  • How long: for as long as your account is open, and then as section 8 says.

3. Your instructions

  • 3.1. We process Customer Data only on your instructions. Your instructions are the Terms, this DPA, and what you and your team do in the Service, such as importing a list, starting a session or deleting a lead.
  • 3.2. We do not sell Customer Data, share it for advertising, use it to train AI models, or use it for any purpose of our own, except as section 3.3 and the Terms allow.
  • 3.3. We may use call records (not audio or transcripts) to keep the calling account safe, as section 8 of the Terms and section 5 of the Privacy Policy describe, and we may produce counts and averages that identify no customer, rep, lead or call. We may disclose Customer Data where the law requires it, and will tell you first unless the law forbids that.
  • 3.4. If we believe an instruction breaks a privacy law, we will tell you and may hold off acting on it.

4. Your responsibilities

  • 4.1. You have a lawful basis to collect each contact and to call, record and email them, and you give any notice and get any consent the law requires. That includes consent to record a call.
  • 4.2. You import only data you are allowed to share with us and our sub-processors.
  • 4.3. You keep your sign-in details secure and remove reps who leave.

5. How we protect it

  • 5.1. Data travels over TLS. Tax IDs, mailbox passwords and other sensitive values are encrypted at rest with AES-256.
  • 5.2. Row-level security in the database keeps each business's data apart. Recordings sit in a private storage bucket and play through short-lived links.
  • 5.3. Access to production systems is limited to the people who need it to run the Service, and they are bound to keep Customer Data confidential.
  • 5.4. Our security page describes these measures and lists what we have not done yet, including that we hold no third-party security certification. We may change the measures as long as the overall protection does not get weaker.

6. Sub-processors

  • 6.1. You authorise us to use the companies on our sub-processor list to provide the Service. Each one is bound by terms that protect the data it handles.
  • 6.2. We update that page when a sub-processor is added or changed. If you email abhi@paperkites.co and ask, we will also tell you by email before a new one starts handling Customer Data.
  • 6.3. If you object to a new sub-processor on reasonable privacy grounds, tell us within 14 days of the change. If we cannot offer a way around it, you may cancel under section 5.1 of the Terms.
  • 6.4. We remain responsible to you for what our sub-processors do with Customer Data.

7. Security incidents

  • 7.1. If we become aware of a breach of security that leads to Customer Data being lost, changed, disclosed or accessed without authority, we will tell you without undue delay, by email to the account owner.
  • 7.2. We will tell you what we know: what happened, what data was involved, what we have done about it, and who to contact. We will add to it as we learn more.
  • 7.3. Telling the people affected, or a regulator, about a breach of Customer Data is your decision as the controller. We will give you the information you reasonably need to do it.
  • 7.4. A notice under this section is not an admission of fault.

8. Return and deletion

  • 8.1. While your account is open, you can delete leads and their records in the Service.
  • 8.2. For 30 days after your account closes, you can ask for a copy of your leads and call records (Terms, section 13.3).
  • 8.3. Within 30 days of the account closing we delete Customer Data from our live systems. Logs may be kept for up to one year for audit, fraud prevention and legal compliance, and we keep anything the law requires us to keep, for as long as it requires.

9. Requests from individuals

If someone on your lists asks us to see, correct or delete their information, or to stop being called, we pass the request to you and do not answer it for you, unless the law requires us to. We will help you respond with the tools in the Service and, where those are not enough, by reasonable effort on request.

10. Information and audits

  • 10.1. On written request, no more than once a year, we will answer reasonable questions about how we protect Customer Data, in writing, within 30 days.
  • 10.2. We do not offer on-site audits. If a law that applies to you gives you an audit right that written answers cannot satisfy, tell us and we will work out a way to meet it at your cost.

11. Where the data is processed

We and our sub-processors process Customer Data in the United States and Canada, and some sub-processors may process it elsewhere. The Service is for businesses in the US and Canada calling US and Canadian numbers. If a law requires a specific transfer agreement for your use, such as standard contractual clauses, tell us before you import that data.

12. Liability, order and changes

  • 12.1. Each side's liability under this DPA is subject to the limits in section 16 of the Terms.
  • 12.2. If this DPA and the Terms disagree about how Customer Data is handled, this DPA wins. If this DPA and a countersigned agreement between us disagree, the countersigned agreement wins.
  • 12.3. We may update this DPA the way we update the Terms, with at least 30 days' notice of material changes.
  • 12.4. This DPA needs no signature. If your process calls for a countersigned copy, email abhi@paperkites.co and we will send one.