Data Processing Agreement

Processor: N32 TECHNOLOGIES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (N32 Technologies sp. z o.o.), ul. Młynarska 42/115, 01-171 Warszawa, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) kept by the District Court for the Capital City of Warsaw in Warsaw (Sąd Rejonowy dla m.st. Warszawy w Warszawie), Commercial Division of the National Court Register, under number 0001182221, NIP 5273172168, REGON 542179999, EU VAT ID PL5273172168, share capital PLN 5,000
Contact: team@crang.ai (general, legal and data protection), support@crang.ai (support)

This Data Processing Agreement ("DPA") is entered into between the Customer, as controller, and N32 Technologies sp. z o.o. ("N32"), as processor, under Article 28 of Regulation (EU) 2016/679 (the "GDPR"). It forms part of the Agreement described in the Terms of Service at crang.ai/terms and applies from the moment the Agreement is concluded. Capitalized terms not defined here have the meaning given in the Terms of Service or the GDPR.

1Definitions

1.1. Customer Personal Data: personal data contained in Customer Data that N32 processes on behalf of the Customer when providing the Service.

1.2. Data Protection Law: the GDPR and all other laws on the protection of personal data that apply to the processing of Customer Personal Data under the Agreement, including the UK GDPR and the Swiss Federal Act on Data Protection where applicable.

1.3. Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by N32 or its Sub-processors.

1.4. Sub-processor: a third party engaged by N32 that processes Customer Personal Data on N32's behalf.

1.5. SCCs: the standard contractual clauses for the transfer of personal data to third countries adopted by Commission Implementing Decision (EU) 2021/914, as amended or replaced.

2Roles and scope

2.1. The Customer is the controller of Customer Personal Data and N32 is its processor. If the Customer acts as a processor for a third-party controller, the Customer confirms that its instructions to N32, including the appointment of N32 as a sub-processor, are authorized by that controller, and the Customer remains N32's sole point of contact.

2.2. This DPA does not apply to personal data that N32 processes as a controller, such as data about the Customer's account owners, Authorized Users, billing contacts and website visitors used for account management, billing, security and N32's own communications. That processing is described in N32's Privacy Policy at crang.ai/privacy.

2.3. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.

3Customer instructions

3.1. N32 processes Customer Personal Data only on documented instructions from the Customer, unless required otherwise by Union or Member State law to which N32 is subject. In that case, N32 will inform the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

3.2. The Customer's complete documented instructions are: the Agreement; the Customer's configuration and use of the Service, including the Agent Configurations, knowledge base, campaigns, contact lists, retention settings and other settings it chooses; and any other written instructions that N32 accepts in writing. The Customer instructs N32 to process Customer Personal Data also as necessary to secure the Service, prevent and investigate abuse, check compliance with the Acceptable Use Policy, and comply with law.

3.3. Additional instructions outside the scope of the Agreement require N32's prior written agreement, and N32 may charge for them.

3.4. N32 will inform the Customer if, in its opinion, an instruction infringes Data Protection Law. N32 may suspend the performance of that instruction until the Customer confirms or changes it. N32 is not obliged to perform a legal review of the Customer's instructions or processing.

4Customer obligations

4.1. The Customer is responsible for the lawfulness of the processing of Customer Personal Data and of its instructions. In particular, the Customer warrants that: (a) it has a lawful basis under Data Protection Law, and all consents required by law, for each processing operation it instructs, including calling, recording, transcribing and analyzing Calls with AI; (b) it has given data subjects all information required by Articles 13 and 14 GDPR and by other laws, including about AI calls, call recording and the use of processors; (c) it collects Customer Personal Data lawfully and keeps it accurate and up to date; (d) it does not provide special categories of personal data or data about criminal convictions unless strictly necessary and lawful, and has informed N32 in advance; (e) it configures retention periods, do-not-call lists and other settings in line with Data Protection Law; (f) it has assessed the security measures in Annex 2 and finds them appropriate for the risks of its processing; and (g) for each custom voice made from a recording, it has the valid, informed, freely given and documented consent of the voice owner, as required by section 5.7 of the Terms of Service, and it withdraws the voice at once when that consent is withdrawn.

4.2. The Customer is responsible for responding to data subjects and supervisory authorities about the processing of Customer Personal Data, and for any notifications of Personal Data Breaches to them.

5Confidentiality

5.1. N32 ensures that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process it only as needed to perform the Agreement.

6Security

6.1. N32 implements the technical and organizational measures described in Annex 2, which take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as required by Article 32 GDPR.

6.2. N32 may update these measures over time, provided that the updates do not reduce the overall level of security of Customer Personal Data.

6.3. The Customer is responsible for the secure use of the Service, including protecting its credentials and the email accounts of its Authorized Users, managing user access and roles, and the security of its own systems and telephony account.

7Sub-processors

7.1. General authorization. The Customer gives N32 general written authorization to engage Sub-processors. The categories of Sub-processors that N32 currently uses, with the location of processing where known, are listed in Annex 3.

7.2. Current list. The names and locations of N32's current Sub-processors are available to the Customer at any time on request at team@crang.ai. N32 sends the current list within 5 business days after the request. N32 provides the list as its Confidential Information under the Terms of Service, and the Customer may disclose it only to its advisers, its own controllers where the Customer is a processor, and supervisory authorities.

7.3. Changes. N32 will notify the Customer by email to its account owners at least 14 days before it adds or replaces a Sub-processor. If a Sub-processor must be replaced urgently for reasons outside N32's control, such as security, insolvency or discontinuation of the Sub-processor's service, N32 will notify the Customer as soon as reasonably possible, and the 14-day period will apply to the Customer's right to object.

7.4. Right to object. The Customer may object to a new Sub-processor on reasonable grounds relating to the protection of Customer Personal Data, by email to team@crang.ai within the 14-day notice period. If no objection is received within that period, the change is deemed accepted. If the Customer objects, the parties will discuss the objection in good faith. If N32 cannot resolve the objection within a reasonable time, for example by offering an alternative, the Customer may terminate the affected part of the Service, or the Agreement, by notice to N32. The termination is the Customer's sole remedy, and no refund is given for fees already paid.

7.5. Obligations of Sub-processors. N32 engages each Sub-processor under a written contract that imposes data protection obligations providing sufficient guarantees within the meaning of Article 28(4) GDPR. N32 remains liable to the Customer for the performance of each Sub-processor's obligations, subject to section 12.

7.6. Customer's own providers. Where the Customer connects its own telephony account or other service of its own provider to the Service, that provider is engaged by the Customer under its own contract and is not N32's Sub-processor. N32 is not responsible for that provider's processing.

8International transfers

8.1. N32 may transfer Customer Personal Data outside the European Economic Area, including to the United States, where needed to provide the Service through its Sub-processors.

8.2. Each such transfer is based on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the recipient is certified, or on the SCCs (module three, processor to processor) or another transfer mechanism permitted by Data Protection Law. Where needed, N32 assesses the transfer and applies supplementary measures.

8.3. Where the Customer is located outside the European Economic Area and in a country without an adequacy decision, the SCCs (module four, processor to controller) apply to the transfer of Customer Personal Data from N32 to the Customer, with the details in Annex 1 and Polish law and courts as chosen in the Terms of Service.

8.4. For transfers subject to the UK GDPR or Swiss law, the SCCs apply with the UK International Data Transfer Addendum or the adaptations required by Swiss law, as applicable.

9Assistance

9.1. Data subject requests. If N32 receives a request from a data subject about Customer Personal Data, N32 will not answer it except to direct the data subject to the Customer, and will forward the request to the Customer without undue delay where N32 can identify the Customer. Taking into account the nature of the processing, N32 assists the Customer by appropriate technical and organizational measures, insofar as possible, mainly through the functions of the Service, such as viewing, exporting and deleting data and managing do-not-call lists.

9.2. Other assistance. Taking into account the nature of the processing and the information available to N32, N32 provides reasonable assistance to the Customer with its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultations with supervisory authorities, mainly by providing the information in this DPA and the Service documentation.

9.3. Costs. Assistance that goes beyond the functions of the Service and the information in this DPA is provided at the Customer's cost, at N32's reasonable rates, unless the need for it results from N32's breach of this DPA.

10Personal Data Breaches

10.1. N32 notifies the Customer of a Personal Data Breach without undue delay after becoming aware of it, and aims to do so within 48 hours. The notice is sent by email to the Customer's account owners.

10.2. The notice includes, to the extent known, the information listed in Article 33(3) GDPR. Where it is not possible to give all information at once, N32 provides it in phases without undue further delay.

10.3. N32 takes reasonable steps to contain and remedy the Personal Data Breach and to mitigate its possible adverse effects, and reasonably cooperates with the Customer's investigation.

10.4. Notification of, or response to, a Personal Data Breach is not an acknowledgment by N32 of any fault or liability.

11Information and audits

11.1. N32 makes available to the Customer, on request, the information reasonably necessary to demonstrate compliance with Article 28 GDPR, in the form of this DPA, written answers to reasonable security questionnaires, and summaries of relevant policies, certifications or audit reports of N32 or its Sub-processors where available.

11.2. If the information in section 11.1 is not sufficient to demonstrate compliance, or if a supervisory authority requires it, the Customer may carry out an audit, including an inspection, under these conditions: (a) the Customer gives at least 30 days' prior written notice to team@crang.ai with a proposed scope and plan; (b) audits take place no more than once in any 12 months, unless required by a supervisory authority or following a Personal Data Breach caused by N32; (c) the audit is carried out during N32's business hours, without unreasonably disrupting its operations, and remotely where possible; (d) the audit is carried out by the Customer or an independent auditor who is not a competitor of N32 and who is bound by confidentiality obligations acceptable to N32; (e) the audit does not extend to data of other customers, to information subject to confidentiality obligations towards third parties, to information that would compromise security, or to the premises and systems of Sub-processors, whose compliance is shown by their own certifications, reports and contractual terms; and (f) the Customer bears all costs of the audit, including N32's reasonable costs of time and resources, at N32's then current rates.

11.3. The Customer must give N32 a copy of the audit report free of charge. The report is N32's Confidential Information.

12Liability

12.1. Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except to the extent that Data Protection Law does not allow such limitation towards data subjects or supervisory authorities.

12.2. Under section 24 of the Terms of Service, the Customer redresses damage and holds N32 harmless against claims, fines and costs arising from processing carried out on the Customer's instructions or from the Customer's breach of Data Protection Law or this DPA.

13Duration, return and deletion

13.1. This DPA applies for as long as N32 processes Customer Personal Data on behalf of the Customer.

13.2. During the term of the Agreement (including any suspension) and for 30 days after it ends, the Customer can export Customer Personal Data using the export functions of the Service. Exporting the data within that period is the Customer's way of exercising its choice to have the data returned.

13.3. Deletion by request in the Service. An account owner can request deletion of the Workspace in the Service (Settings, Privacy & data). This is the Customer's documented instruction to delete. A waiting period of 14 days follows, during which the Customer can cancel the request and N32 stops all Calls immediately. This instruction replaces the 30-day period in section 13.2: the Customer is responsible for exporting its data before the waiting period ends. After the waiting period, or otherwise after the 30-day period in section 13.2, N32 deletes Customer Personal Data, including copies held by its Sub-processors, within 90 days, unless Union or Member State law requires N32 to keep it. Copies in backups are kept secure, are not actively processed, and are deleted in the ordinary backup cycle. On written request, N32 confirms the deletion in writing.

13.4. During the Agreement, Customer Personal Data is kept for the retention periods the Customer sets in the Service, or until the Customer deletes it. Unless the Customer sets another period, the defaults are: call recordings 90 days; call transcripts 24 months; call analysis results (summaries, evaluations, collected data) 24 months; webhook delivery logs 30 days; data exports available for download for 7 days; audit logs for the term of the Agreement. The Customer can change the period for recordings and transcripts in the Service.

13.5. Custom voices. N32 deletes a custom voice and the recordings and voice model held for it, including at its Sub-processors: when the Customer withdraws the voice in the Service (the Customer's documented instruction), when a voice owner's withdrawal is passed on to N32, at the Customer's request, when N32 disables and deletes it under the Terms of Service, automatically when no Agent has used it for 90 days and 14 days after a notice to the Customer, and when the Workspace is deleted. Recordings made to create a voice are not kept by N32 once the Sub-processor has accepted them. The consent clip is deleted with the voice. Other consent records are kept by N32 as controller, as described in the Privacy Policy.

14Final provisions

14.1. In case of conflict between this DPA and the Terms of Service on the processing of Customer Personal Data, this DPA prevails. In case of conflict with the SCCs, the SCCs prevail.

14.2. N32 may change this DPA under the change procedure in the Terms of Service, or where required by Data Protection Law or a supervisory authority.

14.3. This DPA is governed by Polish law, and disputes are subject to the jurisdiction set out in the Terms of Service, except where Data Protection Law or the SCCs require otherwise.

Annex 1: Description of processing

Subject matter. Processing of Customer Personal Data to provide the Service under the Agreement.

Duration. The term of the Agreement, plus the export and deletion periods in section 13.

Nature and purpose. Hosting and storing contact lists and do-not-call lists; importing, normalizing, deduplicating and checking contact data; placing outbound Calls and answering inbound Calls with AI voice Agents, including speech recognition, speech synthesis and AI conversation processing; transferring Calls to the Customer's operators; recording and transcribing Calls; extracting the data the Customer chooses to collect, and producing summaries, evaluations and analytics; creating and using custom AI voices; AI analysis of transcripts by the voice AI Sub-processor; giving the Customer access to and exports of the results; measuring usage; providing setup, support and maintenance; securing the Service and preventing abuse.

Categories of data subjects.

• Contacts: persons whose details the Customer uploads, persons called by the Customer's Agents, and persons who call the Customer's phone numbers.
• Persons mentioned in Customer Data, such as in Calls or the knowledge base.
• The Customer's staff and representatives, to the extent their personal data is part of Customer Data, such as operators who receive transferred Calls or persons who receive test Calls.
• Voice owners: people whose voice the Customer copies to make a custom voice.

Types of personal data.

• Identification and contact data: name, phone number, external identifiers, language and timezone.
• Any additional fields the Customer chooses to upload or collect.
• Do-not-call and opt-out status.
• Call data: time, duration, direction, phone numbers, outcome and related metadata.
• Voice recordings of Calls, and transcripts.
• Voice recordings made for creating a custom voice, the AI voice model, and consent records.
• Information disclosed by data subjects during Calls, and data extracted from Calls.
• AI Output about Calls, such as summaries, sentiment, topics, reasons and evaluations.

Special categories of data. Not intended. The Customer must not provide or collect them except as allowed under section 4.1(d) of this DPA and the Acceptable Use Policy. Data subjects may disclose them during Calls on their own initiative. Voice recordings and voice models of custom voices are used only to create and run the voice and are not processed to uniquely identify a person; N32 does not use them for identification.

Frequency. Continuous, for the term of the Agreement.

Annex 2: Technical and organizational measures

Isolation of customer data

• Each customer's data is logically separated in a shared database and isolated on three independent layers: the request context, a data access layer that scopes every query to one customer, and database row-level security that is enforced for all tables containing customer data and that the application cannot bypass.
• Customer identification is derived only from the authenticated session and the customer's own subdomain, or from an API key, never from data supplied by the client.
• Automated tests check that one customer cannot read or change another customer's data.

Access control and authentication

• Passwordless sign-in with single-use codes sent by email, valid for 10 minutes, stored only as keyed hashes, with limits on attempts and requests.
• Session cookies that are HTTP-only, secure and limited to the customer's own host; server-side sessions that are revoked on sign-out.
• Protection against cross-site request forgery by origin checks.
• Role-based access control (owner, admin, member), enforced on the server.
• Access by N32 personnel is limited to authorized staff, is needed for setup, support and security, and is recorded in the customer's audit log.

Encryption and secrets

• Encryption in transit (TLS) for all connections to the Service.
• Telephony credentials and webhook secrets encrypted at the application level with AES-256-GCM, bound to the customer they belong to, with key versioning and rotation.
• Secrets are never shown in full in the user interface and are excluded from logs.
• API keys and one-time tokens stored only as hashes.

Data minimization

• No separate AI analytics provider: transcripts are analyzed by the voice AI Sub-processor that already processes the Call, and its copies are deleted at the Customer's retention periods (section 13.4).
• Phone numbers masked in the user interface and exports by default.
• Call audio streamed to authorized users through the Service on demand.

Integrity and accountability

• Append-only audit log of security-relevant events, including sign-ins, role changes, telephony changes, campaign actions, status changes, exports, and staff access.
• Verification of signatures on incoming webhooks, and idempotent processing to prevent duplicate or forged events.
• Rate limits on public and authentication endpoints.

Availability and resilience

• Application and database hosted in the European Union (Netherlands), daily database backups, a tested database restore procedure, and monitoring of the Service.
• Assessment of Personal Data Breaches and notification of the Customer under section 10.

Retention and deletion

• Customer-configurable retention for recordings (default 90 days) and transcripts (default 24 months); call analysis 24 months, webhook delivery logs 30 days, exports available 7 days, audit logs for the term of the Agreement.
• Custom voices: deletion of the voice, its recordings and its model on withdrawal of consent, on request and when the Workspace is erased, and automatic deletion of unused voices (notice after 90 days of non-use, deletion 14 days later); private to the Workspace that made it.
• Customer self-service data export, deletion of the Workspace on the Customer's request in the Service after a 14-day waiting period, and a deletion process covering the database, caches and copies held by Sub-processors.

Personnel and providers

• Confidentiality obligations for all personnel with access to Customer Personal Data.
• Selection of Sub-processors that provide sufficient guarantees, under written data protection terms.

Annex 3: Categories of Sub-processors

The current list of named Sub-processors is available to the Customer at any time on request at team@crang.ai and is sent within 5 business days (section 7.2).

Category	Processing	Location
Cloud hosting	Hosting of the application, background jobs and networking	Netherlands (Amsterdam); service logs are stored in the United States, and the provider may access the data from the United States (EU-US Data Privacy Framework where the provider is certified, otherwise SCCs)
Database and storage	Storage of Customer Data, backups and caches	Netherlands (Amsterdam), with the cloud hosting provider (backups: with the same provider, location confirmed on request); the provider may access the data from the United States (EU-US Data Privacy Framework where the provider is certified, otherwise SCCs)
Voice AI and speech	AI voice Agents, speech recognition, speech synthesis, creating custom AI voices, checking spoken consent, Call recordings and transcripts	United States (EU-US Data Privacy Framework; SCCs)
Telephony	Connecting Calls, only where N32 provides telephony (section 7.6)	Depends on the Customer's numbers and Contacts
AI analytics	AI analysis of Call transcripts (summaries, evaluations, collected data), carried out by the voice AI and speech provider	United States (EU-US Data Privacy Framework; SCCs)
Email delivery	Transactional emails, such as sign-in codes, invitations and usage alerts	United States (EU-US Data Privacy Framework; SCCs)
Payments	Payment processing for the Customer's subscription (Stripe), limited to billing contact data	United States, through the provider's European entity in Ireland (EU-US Data Privacy Framework; SCCs)
Error monitoring	Diagnosing errors in the Service, when enabled	Germany (Frankfurt); the provider may access the data from the United States (EU-US Data Privacy Framework; SCCs)