Data Processing Agreement

Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer" or "Data Controller") and Bubba Nugget Technologies LLC d/b/a DialYourCalls ("Processor" or "we"). This DPA reflects the parties' agreement regarding the processing of personal data.

Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on personal data
• "Data Controller" means the entity that determines the purposes and means of processing
• "Data Processor" means the entity that processes data on behalf of the controller
• "Sub-processor" means any processor engaged by the Processor

Scope and Roles

In the context of our services:

• You (Customer) are the Data Controller for your contact lists and campaign data
• We (DialYourCalls) are the Data Processor, processing your data to provide our services

Our Obligations as Processor

We will:

• Process personal data only on your documented instructions
• Ensure authorized personnel maintain confidentiality
• Implement appropriate technical and organizational security measures
• Assist you in responding to data subject requests
• Delete or return personal data upon contract termination
• Provide information necessary for compliance audits
• Notify you of data breaches without undue delay (within 72 hours)

Security Measures

We implement appropriate security measures including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls and authentication (role-based, MFA)
• Regular security assessments and penetration testing
• Incident response and breach notification procedures
• Employee training on data protection
• Physical security of data centers

Sub-processors

We use authorized sub-processors to provide our services. A current list is available at our Subprocessors page.

We will notify you of new sub-processors and you may object within 30 days.

Data Subject Rights

We will assist you in fulfilling your obligations to respond to data subject requests, including:

• Access to personal data
• Rectification of inaccurate data
• Erasure ("right to be forgotten")
• Data portability
• Restriction of processing
• Objection to processing

International Transfers

All data is processed and stored within the United States. For transfers to sub-processors outside the US, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) where applicable.

Term and Termination

This DPA remains in effect for the duration of our service agreement. Upon termination, we will delete or return all personal data within 30 days, unless retention is required by law.