AcqoraGX · Legal
Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the AcqoraGX Terms of Service between the company operating AcqoraGX ("AcqoraGX", "Processor") and the customer that agreed to them ("Customer", "Controller"). It applies automatically when Customer accepts the Terms. Capitalized terms not defined here have the meanings in the Terms.
1. Roles and scope
- For personal data contained in Customer Data ("Customer Personal Data"), such as contact and lead records, call and message metadata, call recordings, message content, notes, files and skip-trace results, Customer is the controller (a "business" under U.S. state privacy laws) and AcqoraGX is the processor (a "service provider" or "processor").
- AcqoraGX is an independent controller of account, billing, security and support information about Customer's users, as described in the Privacy Policy.
- Customer-chosen providers are not AcqoraGX subprocessors. Carriers (for example Twilio, Telnyx, SignalWire, Plivo, Vonage), AI providers (for example Anthropic, OpenAI, Google) and other services that Customer connects using its own account and credentials process data under Customer's own agreement with them. AcqoraGX transmits data to them only on Customer's instruction.
2. Details of processing
| Subject matter and duration | Provision of the Service for the term of the Terms plus the deletion period in Section 10. |
|---|---|
| Nature and purpose | Hosting, storing, organizing, displaying, transmitting (calls, texts, emails), recording, transcribing and analyzing Customer Personal Data to provide the CRM, dialer, messaging, skip-trace, DNC scrubbing, AI and integration features Customer uses; security, support and billing; and, unless Customer opts out, the learning program in Section 4. |
| Data subjects | Customer's contacts, leads, property owners, sellers, buyers and other persons Customer communicates with; Customer's users. |
| Categories of data | Names, phone numbers, email and postal addresses, property information, communication content and metadata, call recordings, notes, consent and opt-out status, skip-trace and data-append results, and any other data Customer chooses to upload. |
| Sensitive data | Not intended. Customer won't upload special-category or sensitive data (such as health, financial-account or government ID numbers) except as the Service is designed to process and the law permits. |
3. Customer instructions
AcqoraGX processes Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA and Customer's use and configuration of the Service, unless the law requires otherwise (in which case AcqoraGX will inform Customer unless the law prohibits it). AcqoraGX will tell Customer if it believes an instruction violates applicable data protection law. Customer is responsible for the lawfulness of its instructions and for having a lawful basis, notices and consents for the processing, including for calls, texts and recordings.
4. Service improvement and the learning program
Customer authorizes AcqoraGX to use Customer Personal Data to maintain, secure and improve the Service, and, unless Customer's Workspace owner turns off "Help improve the AcqoraGX model" in Integrations → AI, to use masked AI requests and answers, feedback and approved knowledge to evaluate and train AcqoraGX models, as described in How AcqoraGX uses AI data. Contact lists, recordings and messages are not used for training. AcqoraGX won't use Customer Personal Data to build or modify profiles of data subjects for use with another customer, or for its own marketing.
5. Confidentiality
AcqoraGX ensures that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide and support the Service.
6. Security
AcqoraGX implements and maintains appropriate technical and organizational measures, including at least: encryption in transit (TLS); encryption of stored provider credentials; salted Argon2 password hashing; strict tenant isolation in every query; role-based access controls; CSRF protection, rate limiting and account lockout; signature validation of carrier and payment webhooks; audit logs of staff actions and a tamper-evident account security record; logging that redacts secrets; managed hosting with restricted administrative access; and backups. AcqoraGX may update these measures provided it doesn't materially reduce overall security.
7. Subprocessors
Customer authorizes AcqoraGX to engage the subprocessors listed at /legal/subprocessors. AcqoraGX imposes data-protection terms on each subprocessor that are at least as protective as this DPA and remains responsible for its subprocessors' performance. AcqoraGX will update that page and notify Workspace owners by email at least 15 days before adding or replacing a subprocessor (except in an emergency). Customer may object on reasonable data-protection grounds within that period; if the parties can't resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid Fees for the unused period.
8. Data subject requests and assistance
Taking into account the nature of the processing, AcqoraGX will assist Customer by appropriate measures in responding to requests from data subjects (access, deletion, correction, portability, opt-out) using the Service's export and deletion features, and will promptly forward any request it receives directly that identifies Customer. AcqoraGX will reasonably assist with data protection impact assessments and regulator consultations relating to the Service, at Customer's cost where the effort is significant.
9. Personal data breaches
AcqoraGX will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. The notice will describe the breach, its likely consequences and the measures taken, as that information becomes available. Notification isn't an admission of fault.
10. Return and deletion
Customer may export Customer Personal Data during the term and for 30 days after it ends. AcqoraGX will then delete or de-identify Customer Personal Data within 90 days, except copies in rolling backups (deleted as backups expire) and data AcqoraGX must retain by law, which remain subject to this DPA.
11. Audits
On written request no more than once a year, AcqoraGX will answer reasonable security questionnaires and provide available documentation demonstrating compliance with this DPA. Any on-site audit requires 30 days' notice, must be at Customer's cost, during business hours, and subject to confidentiality and scope limits agreed in advance, and only where the documentation provided is insufficient or a regulator requires it.
12. International transfers
Customer Personal Data is processed in the United States. If Customer transfers personal data subject to EU, UK or Swiss data protection law, the parties will agree on an appropriate transfer mechanism (such as the Standard Contractual Clauses) before that transfer.
13. U.S. state privacy law terms
For Customer Personal Data subject to the CCPA/CPRA or similar U.S. state laws, AcqoraGX: (a) won't sell or share it (as defined by those laws); (b) won't retain, use or disclose it for any purpose other than the business purposes in this DPA, or outside the direct business relationship with Customer; (c) won't combine it with personal data from other sources except as those laws permit for service providers; (d) will comply with applicable obligations and provide the same level of privacy protection the law requires; (e) will notify Customer if it can no longer meet these obligations; and (f) allows Customer to take reasonable steps to stop and remediate unauthorized use. AcqoraGX certifies that it understands and will comply with these restrictions.
14. General
If this DPA conflicts with the Terms regarding personal data, this DPA controls. Liability under this DPA is subject to the limitations in the Terms. This DPA ends when AcqoraGX no longer processes Customer Personal Data. Notices under this DPA go to [LEGAL_CONTACT_EMAIL not set].