Effective Date: September 28, 2026
Last Updated: September 28, 2026
Last Reviewed: September 28, 2026
Next Review Due: March 28, 2027
This Data Processing Addendum ("DPA") is part of the Terms of Service between ARC DEV SYSTEMS LLC, a Texas limited liability company doing business as Recall Systems ("Recall Systems," "we" or "us"), and the business that buys our Services ("Client" or "you").
It explains how we handle the personal information of your leads, customers and staff when we process it for you. You accept it when you accept the Terms.
1. Definitions
- Personal Data: information about an identifiable person that you put into, or receive through, the Services, such as your leads' and customers' names, phone numbers, messages and call recordings.
- Processing: anything done with Personal Data, including collecting, storing, using, sending or deleting it.
- Subprocessor: a company we engage that may process Personal Data while helping us provide the Services.
- Data Protection Laws: U.S. federal and state privacy laws that apply to the Personal Data, including the Texas Data Privacy and Security Act (TDPSA) and the CCPA/CPRA.
- Security Incident: a confirmed breach of security that leads to unauthorized access to, or loss, disclosure or alteration of, Personal Data.
2. Roles
You are the "controller" or "business" for Personal Data. We are your "processor" or "service provider." You decide why the data is processed. We process it only to provide the Services to you.
3. Details of Processing
| Item | Details |
|---|---|
| Purpose | Providing the Services in your plan: your website, Platform, CRM, business phone, SMS/MMS, voice, automations, marketing campaigns and review tools. |
| People involved | Your leads, customers, website visitors, employees and contractors. |
| Types of data | Names, phone numbers, email and street addresses, messages and photos, call records, voicemails and recordings, form answers, reviews, and appointment details. |
| Duration | For as long as you have a Subscription, plus the 30-day export window in Section 10. |
4. Our Commitments
- We process Personal Data only on your documented instructions, which include these Terms, this DPA and how you configure the Services.
- We do not sell or share Personal Data, and we do not use it for our own marketing or advertising.
- We do not combine it with data from other sources except as needed to provide the Services.
- Everyone on our team who can access Personal Data is bound by confidentiality.
- We will tell you if we believe an instruction from you breaks the law.
5. The Client's Commitments
- You have a lawful basis, and the consent the law requires, for every piece of Personal Data you put into the Services.
- You give people the privacy notices the law requires, including notice of call recording where needed.
- You follow the TCPA, CAN-SPAM, A2P 10DLC carrier rules and state privacy laws for every message and call you send (see Section 15 of our Terms).
6. Subprocessors
You authorize us to use the Subprocessors listed on our Subprocessors page. Each one is bound by written terms that protect Personal Data at least as well as this DPA does.
We will give you at least 30 days' notice by email before adding or replacing a Subprocessor. If you object for a reasonable data-protection reason, tell us within that window. If we can't resolve it, you may cancel the affected Services.
7. Security
We keep reasonable technical and organizational safeguards in place, including encryption in transit (TLS), encryption at rest through our hosting providers, access controls, logging of staff access to business accounts, and vendor due diligence.
8. Security Incidents
If we confirm a Security Incident affecting your Personal Data, we will notify you without undue delay, share what we know, and help you meet any notification duties you have under the law.
9. Helping With Requests
If one of your leads or customers asks us to access, correct or delete their information, we will forward the request to you. We will give you reasonable help responding to these requests and to regulators.
10. Return and Deletion
When your Subscription ends, you have 30 days to export your Client Content. After that, we may delete or archive it, except where the law requires us to keep it, such as billing and tax records.
11. Audits and Information
On reasonable written request, no more than once every 12 months, we will provide the information you need to confirm that we are meeting this DPA.
12. Data Location
We and our Subprocessors store and process Personal Data mainly in the United States. Any Subprocessor located outside the U.S. is shown on our Subprocessors page.
13. Liability
Each party's liability under this DPA is subject to the limitation of liability in our Terms of Service.
14. Order of Precedence
If this DPA conflicts with the Terms on how Personal Data is handled, this DPA controls. Texas law governs this DPA, just as it governs the Terms.
15. Contact
Questions about this DPA go to team@recall-systems.com.
