Start free
Legal

Data Processing Addendum

Effective date: November 6, 2026
Version: 1.0

This Data Processing Addendum ("DPA") is part of the Ladoo Terms of Service or other agreement (the "Agreement") between Ladoo ("Ladoo") and the customer that accepted it ("Customer"). It applies when Ladoo processes Customer Personal Data in providing the Services. If this DPA conflicts with the Agreement, this DPA controls for data protection matters. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses control.

1. Definitions

  • "Customer Personal Data" means personal data or personal information in Customer Content that Ladoo processes on Customer's behalf, including data about Customer's callers, CRM contacts and end users.
  • "Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement, including the GDPR, UK GDPR, Swiss FADP, the California Consumer Privacy Act as amended ("CCPA") and its regulations, and other U.S. state comprehensive privacy laws.
  • "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as incorporated into UK law.
  • "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data in Ladoo's or its subprocessors' systems. It does not include unsuccessful attempts that don't compromise security, such as pings, port scans, or failed sign-in attempts.
  • "Standard Contractual Clauses" or "SCCs" means the clauses annexed to Commission Implementing Decision (EU) 2021/914.
  • "Subprocessor" means a third party Ladoo engages to process Customer Personal Data.
  • "Controller", "processor", "data subject", "personal data", "processing", "business", "service provider", "sell", "share" and "consumer" have the meanings given in Data Protection Laws.

2. Roles and scope

2.1 Roles. Customer is the controller (or business) and Ladoo is the processor (or service provider) of Customer Personal Data. If Customer is itself a processor for another controller (for example, an Agency processing for its Clients), Ladoo is Customer's subprocessor, and Customer warrants that its instructions, including the appointment of Ladoo, are authorized by that controller.

2.2 Details of processing. The subject matter, nature, purpose, duration, types of data and categories of data subjects are set out in Annex I.

2.3 Ladoo as controller. This DPA does not apply to personal data Ladoo processes as a controller, such as account, billing and website data, which is governed by Ladoo's Privacy Policy.

3. Customer obligations

Customer is responsible for:

  • (a) having a lawful basis and all notices and consents needed for Ladoo to process Customer Personal Data under the Agreement, including notice to callers that they are speaking with an AI assistant and that calls may be recorded and transcribed and processed by service providers, and any consent required by all-party-consent recording laws;
  • (b) the accuracy and lawfulness of Customer Personal Data and of the data it syncs from connected systems such as its CRM;
  • (c) not providing protected health information subject to HIPAA unless a Business Associate Agreement with Ladoo is in effect;
  • (d) not deploying the Services on services directed to children under 13 without Ladoo's prior written agreement, and giving any notices and obtaining any consents required by children's privacy laws;
  • (e) if Customer uses the Services in connection with automated decisions that have legal or similarly significant effects on individuals, complying with all related obligations (including notice, opt-out, access and risk-assessment requirements under the CCPA's automated decision-making technology regulations), since the AUP prohibits such use without human review;
  • (f) responding to data subject requests, using the self-service tools in the Services where available.

4. Processing on instructions

4.1 Ladoo will process Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise, in which case Ladoo will tell Customer before processing unless the law prohibits it. The Agreement, this DPA, and Customer's configuration and use of the Services (for example, its agents, workflows, integrations and settings) are Customer's complete instructions. Additional instructions require written agreement.

4.2 Ladoo will promptly tell Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend processing under that instruction until it is resolved.

5. Restrictions on use

5.1 Business purposes. Ladoo processes Customer Personal Data only for these specific business purposes: (a) providing the Services Customer uses, including answering and handling calls, transcription, generating agent responses and synthetic speech, call summaries and extracted fields, transfers, CRM and calendar synchronization, webhooks and APIs, and storage and display in the dashboard; (b) customer support requested by Customer; (c) detecting, preventing and investigating security incidents, fraud, abuse and violations of the Agreement; (d) debugging and repairing errors; and (e) complying with law (the "Business Purposes").

5.2 Prohibited uses. Ladoo will not:

  • (a) sell or share Customer Personal Data;
  • (b) retain, use or disclose it for any purpose other than the Business Purposes, including any commercial purpose other than providing the Services to Customer;
  • (c) retain, use or disclose it outside the direct business relationship between Ladoo and Customer;
  • (d) combine it with personal data Ladoo receives from or on behalf of any other person, or collects from its own interactions with individuals, except as Data Protection Laws allow for the Business Purposes;
  • (e) use it to train, fine-tune or improve artificial intelligence or machine learning models, whether Ladoo's or a third party's, or use it to provide services to anyone else;
  • (f) create voiceprints or other biometric identifiers from it, or use it to identify individuals by their voice; or
  • (g) use product-analytics or session-recording tools to capture it.

5.3 AI subprocessors. Ladoo will configure each AI Subprocessor (speech-to-text, language model and text-to-speech providers) so that, to the extent the provider offers it, the provider (i) does not use Customer Personal Data to train or improve its models and (ii) does not retain it beyond what is needed to process each request. Ladoo will route language model requests only to providers that commit to zero data retention. Ladoo will not change these settings without Customer's prior written consent.

5.4 De-identified data. If Ladoo receives de-identified data derived from Customer Personal Data, it will take reasonable measures to ensure it cannot be re-identified, publicly commit to keeping it de-identified, and contractually require any recipient to do the same. Usage Data that contains no Customer Personal Data (such as call counts and durations) is not subject to this DPA.

5.5 CCPA certification. Ladoo certifies that it understands and will comply with the restrictions in this Section 5, will comply with the CCPA and provide the same level of privacy protection the CCPA requires of businesses, and will notify Customer if it determines it can no longer meet its CCPA obligations. On notice, Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

6. Subprocessors

6.1 Authorization. Customer gives general authorization for Ladoo to engage Subprocessors. The current list is at https://tryladoo.com/legal/subprocessors.

6.2 Notice of changes. Ladoo will give at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the list and emailing Customers that have subscribed to updates (and Customer's account owners, for Customers on paid plans). In an emergency, such as a Subprocessor outage or security issue, Ladoo may replace a Subprocessor sooner and will give notice as soon as practicable.

6.3 Objection. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing privacy@tryladoo.com within the notice period. The parties will discuss the objection in good faith. If Ladoo can't reasonably accommodate it, Customer may terminate the affected Services by written notice, and Ladoo will refund any prepaid fees for the terminated Services covering the period after termination.

6.4 Flow-down and liability. Ladoo will enter into a written agreement with each Subprocessor imposing data protection obligations no less protective than this DPA, to the extent applicable to the services the Subprocessor provides. Ladoo remains responsible for its Subprocessors' compliance.

7. Confidentiality and security

7.1 Ladoo will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed for the Business Purposes.

7.2 Ladoo will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, as described in Annex II, including measures that satisfy Cal. Civ. Code § 1798.81.5. Ladoo may update these measures as long as it does not materially reduce the overall level of protection.

8. Security Incidents

8.1 Ladoo will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident.

8.2 The notice will describe, to the extent known: the nature of the Security Incident; the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed to address it. Ladoo will provide updates as more information becomes available, take reasonable steps to contain and remediate the incident, and reasonably cooperate with Customer's investigation and obligations to notify regulators and individuals.

8.3 Customer is responsible for notifying regulators, individuals and others as required by law, unless the parties agree otherwise. Ladoo's notification is not an admission of fault or liability.

9. Assistance

9.1 Data subject requests. If Ladoo receives a request from a data subject relating to Customer Personal Data, Ladoo will not respond to it (except to tell the requester to contact Customer and that Ladoo has forwarded the request) and will forward it to Customer within 5 business days where Ladoo can identify Customer. Taking into account the nature of the processing, Ladoo will help Customer respond to data subject requests, primarily through self-service tools in the Services (such as finding calls by caller phone number, and exporting and deleting call records), and otherwise by reasonable assistance on request.

9.2 Assessments and consultations. Ladoo will provide reasonable information and assistance to help Customer carry out data protection impact assessments, prior consultations with supervisory authorities, and, where the CCPA applies, risk assessments, cybersecurity audits, and obligations relating to automated decision-making technology. In doing so, Ladoo will not misrepresent any fact.

9.3 Costs. Assistance beyond the self-service tools and Ladoo's standard documentation may be charged at reasonable rates, unless it is needed because of Ladoo's breach of this DPA.

10. Return and deletion

10.1 During the term. Customer can delete Customer Personal Data using the Services' deletion tools or by asking Ladoo.

10.2 After termination. For 30 days after the Agreement ends, Customer may ask Ladoo to export its call data. After that, Ladoo will delete Customer Personal Data from its production systems within 60 days, and from backups within a further 35 days, except to the extent Ladoo must keep it to comply with law. Any retained data remains protected by this DPA and will be processed only for the purpose requiring its retention. Ladoo will confirm deletion in writing on request.

10.3 CRM disconnection. When Customer disconnects a CRM integration or uninstalls a Marketplace app, Ladoo will stop synchronizing and will delete the synchronized copy of CRM records within 30 days. Call records already created remain in Customer's workspace under Section 10.1 and 10.2.

11. Audits

11.1 Ladoo will make available to Customer, on written request and no more than once a year, the information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and, once available, third-party audit reports or certifications (such as a SOC 2 report), subject to confidentiality.

11.2 If that information is not sufficient to satisfy an obligation under Data Protection Laws, or following a Security Incident, Customer may conduct an audit, or have an independent auditor bound by confidentiality conduct one, on at least 30 days' notice, during business hours, no more than once a year, and in a way that doesn't unreasonably disrupt Ladoo's operations or compromise other customers' data. Customer bears its own audit costs. This Section 11 constitutes Customer's right to take reasonable and appropriate steps to ensure Ladoo uses Customer Personal Data consistently with Customer's obligations under the CCPA.

12. International transfers

12.1 Location. Ladoo and its Subprocessors process Customer Personal Data in the United States and, where listed on the Subprocessor page, other countries.

12.2 EEA transfers. For transfers of Customer Personal Data from the EEA to Ladoo in a country without an adequacy decision, the SCCs are incorporated into this DPA as follows: Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor. For both: Clause 7 (docking clause) applies; in Clause 9, Option 2 (general written authorization) applies with the notice period in Section 6.2; the optional language in Clause 11 does not apply; in Clause 13, the competent supervisory authority is the one that has authority over Customer (or its EU representative); in Clauses 17 and 18, the governing law and courts are those of Ireland. Annexes I, II and III of this DPA complete the SCC Annexes.

12.3 UK transfers. For transfers from the UK, the UK International Data Transfer Addendum to the EU SCCs (version B1.0, or its successor) is incorporated, with Tables 1 to 3 completed by the information in this DPA and its Annexes, and "neither party" selected in Table 4.

12.4 Swiss transfers. For transfers from Switzerland, the SCCs apply as in Section 12.2, with references to the GDPR read as references to the FADP, the Swiss FDPIC as the competent supervisory authority, and "Member State" read to include Switzerland so that data subjects there can enforce their rights.

12.5 Government access. If Ladoo receives a legally binding request from a public authority for Customer Personal Data, Ladoo will, unless legally prohibited, notify Customer promptly, review the legality of the request, challenge it where there are reasonable grounds, and disclose only the minimum required. Ladoo will cooperate with Customer's transfer impact assessments.

12.6 Alternative mechanisms. If Ladoo adopts another lawful transfer mechanism (for example, certification under the EU-U.S. Data Privacy Framework), it may apply to the transfers instead of, or in addition to, the SCCs.

13. U.S. state laws

For Data Protection Laws of U.S. states other than California, Ladoo will: process Customer Personal Data only on Customer's instructions; ensure persons processing it are bound by confidentiality; delete or return it at the end of the Services as set out in Section 10; make available information necessary to demonstrate compliance and allow for assessments as set out in Section 11; give Customer notice of and an opportunity to object to Subprocessors as set out in Section 6; and help Customer meet its obligations, including data protection assessments.

14. General

14.1 Liability. Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, except where Data Protection Laws or the SCCs don't allow it.

14.2 Term. This DPA lasts as long as Ladoo processes Customer Personal Data.

14.3 Changes. Ladoo may update this DPA to reflect changes in law, regulator guidance or the Services, on 30 days' notice. Updates won't materially reduce the protection of Customer Personal Data without Customer's agreement.

14.4 Health data. If the parties sign a Business Associate Agreement, it controls for protected health information.

Annex I: Details of processing

A. Parties

  • Data exporter: Customer, as identified in its account. Contact: Customer's account owner. Role: controller (or processor, for an Agency acting for its Clients). Signature and date: by accepting the Agreement.
  • Data importer: Ladoo, 7901 4th St N, #34188, St Petersburg, FL 33702, United States. Contact: privacy@tryladoo.com. Role: processor (or subprocessor). Signature and date: by providing the Services under the Agreement.

B. Description of processing and transfer

Item Description
Categories of data subjects Callers to Customer's phone numbers; people whose records are in Customer's connected CRM or calendar; Customer's staff and others who receive transferred calls; individuals named in knowledge-base content; Customer's users of the Services
Categories of personal data Phone numbers and caller ID names; real-time call audio and, if Customer enables recording, stored recordings; transcripts; call summaries and extracted fields (such as name, reason for calling, callback number, urgency, appointment details); call metadata (time, duration, outcome, transfer destination); CRM contact records and notes (names, phone numbers, emails, addresses, custom fields, pipeline stages, appointments); personal data in knowledge-base files and crawled pages; personal data in prompts and workflows
Sensitive data Not intended. Callers may volunteer sensitive information (for example health, financial or other special category data) in conversation. Safeguards: encryption in transit and at rest, access controls, no model training, zero-retention AI processing, the prohibition on PHI without a BAA, and Customer's deletion tools.
Frequency of transfer Continuous, for as long as Customer uses the Services
Nature of processing Receiving and routing calls; real-time speech-to-text; language model processing to generate responses, summaries and extracted fields; text-to-speech; storage; display; synchronization with Customer's connected systems; delivery through APIs and webhooks
Purpose The Business Purposes in Section 5.1
Duration and retention For the term of the Agreement, then as set out in Section 10. Within the term, as configured by Customer.
Transfers to Subprocessors As listed in Annex III, for the purposes stated there, for the duration of the Agreement

C. Competent supervisory authority: as set out in Section 12.2.

Annex II: Technical and organizational security measures

  1. Encryption. TLS 1.2 or higher for data in transit between users, Ladoo and Subprocessors; encrypted media transport for calls where supported by the carrier path; encryption at rest for databases and backups through Ladoo's hosting provider.
  2. Tenant isolation. Every request is authorized against the workspace it targets, and database access is scoped by workspace. Agency access to client workspaces is limited to the Agency's own clients.
  3. Access control. Role-based access in the Services (owner, admin, editor, viewer). Production access limited to named personnel who need it, protected by multi-factor authentication, and removed promptly when no longer needed.
  4. Authentication. Passwordless email sign-in links with short expiry, optional Google and GitHub sign-in, session expiry, and hashed API keys that can be revoked.
  5. Integrity. Signature verification of inbound webhooks from carriers, payment processors and CRMs; signed outbound webhooks.
  6. Availability and resilience. Managed database with automated daily backups and point-in-time recovery; restore procedures tested periodically; monitoring and alerting.
  7. Secure development. Code review of changes; dependency vulnerability scanning; separate development and production environments; no production Customer Personal Data in development.
  8. Logging. Logs of administrative actions and security-relevant events; caller personal data is minimized in operational logs, which are kept for a limited period.
  9. Data minimization and retention. Call recording off unless Customer enables it; Customer-controlled deletion; no model training; zero-retention settings with AI Subprocessors.
  10. Vendor management. Due diligence and written data protection agreements with every Subprocessor.
  11. Incident response. A documented incident response process, including notice to Customer as described in Section 8.
  12. Personnel. Confidentiality obligations and security awareness for all personnel with access to Customer Personal Data.
  13. Physical security. Provided by Ladoo's hosting and infrastructure Subprocessors, which maintain industry-standard certifications (such as SOC 2 or ISO 27001).

Annex III: Subprocessors

The Subprocessors authorized at the date of this DPA are those on the Subprocessors page, which is incorporated into this Annex as updated under Section 6.