Kallin Terms and Conditions
These Terms govern Kallin's business communication services, including enabled AI telephone answering, website chat, WhatsApp, booking and routing tools, notifications and service-recovery messages. Schedule 1 is the Data Processing Agreement and Schedule 2 describes the processing and security arrangements. Read these Terms and your Order before activating a trial or purchasing or using the service.
1 The service provider
1.1 Kallin is a trading name of Kallin.
1.2 In these Terms, "Kallin", "we", "us" and "our" mean that legal provider. Our website is https://www.kallin.co.uk and our contact email is info@kallin.co.uk. The contact details of the legal provider also apply to Schedule 1.
2 Definitions
2.1 "Customer", "you" and "your" mean the person or organisation entering into the agreement. "Users" are the people authorised to access your workspace. "End Users" are callers, website visitors, messaging contacts and others who communicate with your business using the service.
2.2 "Services" means the functions included in your Order and enabled configuration. "Order" means the accepted order form, checkout or trial confirmation, or other durable record identifying your service and commercial terms. "Workspace" means your customer account and its associated settings and records.
2.3 "Customer Data" means information supplied by you or processed on your instructions, including business knowledge, contact information, call metadata, recordings where enabled, transcripts, messages, summaries, appointment records, integration data and customer-specific instructions generated through Kallin Intelligence.
2.4 "Service Message" means a communication limited to a genuine administrative, operational or customer-service purpose. "Recovery Message" means an enabled follow-up concerning a specific attempted contact affected by an identified service interruption. Calling a communication a Service Message or Recovery Message does not determine its legal classification.
2.5 "Data Protection Law" means the UK GDPR and Data Protection Act 2018, as amended, the EU GDPR where applicable, and other applicable laws governing the relevant processing. "Communication Rules" means applicable telecommunications, recording, electronic marketing, messaging, privacy and AI-transparency requirements, together with the relevant carrier and platform conditions. Other data protection terms have their meanings under Data Protection Law.
3 Business use and acceptance
3.1 The service is offered for business, trade and professional purposes. Account owners and administrators must be at least 18 and have authority to bind the Customer. An administrator accepting these Terms for an organisation confirms that authority.
3.2 The agreement is formed when you accept these Terms and we accept your Order, including by activating the requested trial or paid service. The agreement covers trials as well as paid use. We will make the applicable Terms available before acceptance and retain a record of the accepted version. You should retain your Order and a copy of the Terms.
3.3 Viewing a website, requesting information or taking part in a demonstration does not by itself create a paid subscription. A trial does not authorise recurring payment unless you separately choose a paid service and authorise its disclosed charges.
3.4 Acceptance of these Terms is contractual acceptance by the Customer. It is not consent on behalf of callers or other individuals to recording, marketing, optional tracking or any other processing that requires their own permission.
3.5 Nothing excludes a right or remedy that cannot lawfully be excluded. Where mandatory consumer protections apply to a transaction despite its intended business use, those protections prevail. Describing someone as a business customer does not remove rights they have under applicable law.
4 The agreement and document priority
4.1 The agreement consists of these Terms, Schedules 1 and 2, your Order and any separately agreed written service level, security or country-specific terms. The Privacy Policy and Cookie Policy explain relevant processing and tracking; they do not replace the Data Processing Agreement or obtain blanket consent.
4.2 In a conflict, mandatory law and properly executed international transfer clauses take priority. A separately signed agreement then takes priority, followed by Schedule 1 for personal-data processing matters, any agreed processing particulars or security annex for their subject matter, your Order and the remaining Terms. A specific commercial provision in an Order prevails over a general commercial provision here.
4.3 The Order must identify the service, price, billing period, included usage, extra charges and any initial commitment. A material commercial term must be disclosed before you agree to it. An administrator's recorded settings are documented service instructions within the agreed scope, but do not authorise an undisclosed charge or a new independent use of personal data.
5 What the service includes
5.1 Depending on your Order and configuration, Kallin can answer incoming calls, handle website or WhatsApp conversations, use approved business information, capture enquiries, create summaries, support bookings, route or transfer communications, send notifications and connect to supported systems. Notifications, Recovery Messages and full interactive messaging are separate functions; availability of one does not mean all are included.
5.2 Kallin Intelligence may review your workspace's conversations and update customer-specific instructions within the limits in clause 9. Features described as planned, coming soon or in development are not included unless expressly agreed and available for your deployment.
5.3 We will provide the agreed service with reasonable care and skill. We do not promise a particular number of leads, bookings, answered calls, conversions, savings or outcomes. Demonstrations and illustrative data do not guarantee results in your environment.
5.4 We do not provide an emergency response service or a substitute for medical, legal, financial or other regulated professional advice. You must maintain an appropriate alternative route for urgent matters. A service level agreement applies only where expressly agreed in writing.
6 Accounts and access security
6.1 Give accurate account and billing information, maintain appropriate administrator contacts, protect credentials and integration keys, and grant Users only the access needed for their work. Do not share individual logins, exceed your agreed seat allowance or allow unauthorised access. Remove access promptly when a User leaves or changes role.
6.2 You are responsible for authorised activity in your workspace and your Users' compliance. Tell us promptly about suspected compromise or unauthorised use. This does not make you responsible for access caused by our failure to meet our security obligations.
6.3 Optional social sign-in providers have their own terms and privacy notices. Their involvement does not permit either party to use information beyond the permissions and lawful purposes applicable to the service.
7 Setup and customer instructions
7.1 Supply accurate business information, opening hours, services, prices where relevant, routing destinations, booking rules, privacy information and an escalation contact. Provide the permissions and access reasonably needed for the agreed setup. Keep this information current and tell us about material changes.
7.2 Review and test the configuration before enabling live use. Test forwarding, greetings, recording and transcription settings, booking confirmations, transfers, notifications, replies and Recovery Messages as applicable. We remain responsible for performing setup work we have agreed to undertake with reasonable care and skill.
7.3 Set clear limits on the assistant's authority, including which enquiries it can handle, which actions it can take and when it must refer a matter to a person. Do not instruct it to invent prices, policies, availability, professional advice or promises your business cannot fulfil.
7.4 Changes made by an authorised administrator, an agreed written setup record and your enabled settings form part of your documented instructions. We may require additional verification for changes that materially affect security, spending, recording, sensitive processing or external communications.
7.5 Estimated setup or launch dates depend on timely information, testing and any carrier or regulatory verification. A date is a binding deadline only if expressly agreed as such. Keep your own source telephone service and alternative contact arrangements operational where needed.
8 AI disclosure and call recording
8.1 The interaction must accurately identify the assistant as AI where required by law and must not mislead an End User into believing it is a particular human. Kallin will supply disclosure controls appropriate to its service. The Customer must not remove, suppress, bypass or contradict a required AI disclosure through scripts, routing or other settings.
8.2 Recording, transcription, summarisation and real-time audio processing are distinct activities. Disabling storage of an audio recording does not necessarily disable speech processing or the creation or retention of a transcript. The enabled activities must be explained accurately to End Users.
8.3 You determine and document the lawful purposes and legal basis for processing your End Users' information. You must maintain an accessible privacy notice identifying your business and explaining the relevant purposes, recipients, retention, rights and contact options, including Kallin's involvement and enabled conversation-review functions.
8.4 We will provide a disclosure that matches the enabled AI, recording and transcription functions. The disclosure must be delivered at the start of the interaction, before the substantive enquiry. The required part may be fixed separately from your editable greeting. You must not configure a route that omits or defeats it. We remain responsible for the operation of disclosure controls we supply.
8.5 Where a call is always recorded, the disclosure must say that it is recorded rather than suggesting recording is merely possible. Where only transcription is retained, it must not falsely say that an audio recording is retained. Privacy information must be made available through an accessible route appropriate to the channel.
8.6 A recording announcement does not itself establish a lawful basis or obtain legally required consent. Where applicable law requires consent, the relevant recording or processing must not begin until valid consent has been obtained through a suitable flow. Provide an appropriate alternative for someone who declines, and honour applicable withdrawal or objection rights. Continuing a call or failing to hang up must not be used as a blanket substitute for required consent.
8.7 You must assess the recording and communications laws relevant to your business and the affected End Users, including rules in other countries or states. Tell us before deployment if your use needs a consent flow or local arrangements beyond the standard service. Neither party's legal duties are transferred entirely to the other by these Terms.
9 Kallin Intelligence
9.1 Where enabled and included, Kallin Intelligence can review conversations from your workspace, identify issues and useful patterns, and generate or apply updates to your assistant's instructions. Reviews may run on a daily cycle or another disclosed schedule. Updates are intended to improve your own assistant's handling of future enquiries and are not a promise that performance will improve on every occasion.
9.2 Your activation and recorded configuration authorise that processing within your agreed service purposes and Schedule 1. They do not give Kallin unrestricted rights to use identifiable conversation data for its own model development or another customer's assistant. You must include the review and improvement purposes in your privacy information where applicable.
9.3 The feature must operate within approved business information, permissions and escalation rules. It must not autonomously remove required disclosures, expand marketing permissions, change prices or commercial commitments, enable sensitive processing, alter spending permissions or give itself new authority to take consequential actions.
9.4 We will apply appropriate controls to prevent unnecessary personal details being retained in reusable instructions or exposed between customers. Where changes require approval under your agreed configuration, they must remain subject to that approval. Review material changes and report errors. We will maintain a record of applied instruction changes and provide a reasonable means to disable further automatic updates and address an unsuitable change.
9.5 Disabling the feature stops future scheduled review and automatic updating under that setting. It does not automatically erase existing conversation records or previously applied instructions. You may request correction, removal or a supported restoration of instructions under your agreement and applicable data rights.
9.6 Identifiable Customer Data will not be used under the standard agreement to train general-purpose AI models for Kallin's or an appointed supplier's independent purposes. Any proposed separate use requires an advance lawful arrangement, appropriate notices and permissions, and a review of the parties' data protection roles. Supplier retention and processing must comply with Schedule 1.
10 Bookings and other actions
10.1 The assistant may take only the actions authorised by your configuration and supported integrations. You are responsible for setting accurate availability, booking rules, authorised prices, confirmation requirements, cancellation rules and escalation destinations.
10.2 A booking or other external action must follow the agreed workflow and be confirmed by the relevant system before the assistant presents it as completed. An AI statement alone is not technical evidence that a calendar, CRM or other external system has accepted an action. Check material outputs and resolve discrepancies promptly.
10.3 These Terms do not determine or remove the rights of your customers arising from your business's representations, bookings or transactions. We remain responsible for our agreed service obligations; you remain responsible for your business's products, services and commitments to End Users.
10.4 Routing and live transfer depend on valid destinations, network conditions and the recipient's availability. You must configure an appropriate fallback where a transfer fails. Staff receiving a transferred call do not require a workspace seat solely for receiving that call, unless your Order says otherwise.
11 Notifications and service communications
11.1 Depending on your enabled service, notifications may include new-enquiry alerts, summaries, appointment confirmations and reminders, booking changes, requested follow-ups and operational updates. They may be sent to you, your authorised team or the relevant End User using supported email, SMS, WhatsApp, push or other channels.
11.2 Notifications to your team must go only to authorised recipients. You must keep destinations current and restrict access to notification content. Configure messages to include only the information reasonably needed, particularly where a number, inbox or device is shared.
11.3 Messages to End Users require an appropriate lawful purpose and channel permissions. A person giving a phone number or making a call does not automatically authorise promotional messages or communication through a different platform. You are responsible for the business purpose and instructions; we are responsible for complying with the obligations applicable to our role and supplied controls.
11.4 We may send the Customer necessary account, billing, security, legal and operational communications. Optional notification preferences do not stop communications that are reasonably necessary to administer the agreement or meet a legal duty. Such communications must not be used to bypass an objection to marketing.
11.5 Delivery, timing and recipient action are not guaranteed. Carriers, devices, spam filters, platform rules and unavailable destinations may prevent or delay a message. An alert is not proof that its recipient has read it, or that an appointment or external action was completed.
12 Recovery messages after an interruption
12.1 Where available and enabled, the recovery feature can use reliable call or contact-event information to identify an attempted enquiry affected by an interruption. After the relevant service is restored, it may send a limited follow-up on your behalf stating that the contact route is available again and explaining how to continue the original enquiry.
12.2 The feature's initial state, supported channels, sending window, relevant limits and charges must be disclosed before activation. Enabling it, or expressly accepting a disclosed enabled configuration, records your instruction to operate it within these Terms. You may switch it off through the available workspace control or ask support to disable it. Your approval is not consent from the recipient.
12.3 A Recovery Message may be sent only where there is a legitimate, sufficiently recent attempted contact with your business, a reliable and appropriate destination, and a lawful basis and any required channel permission. It must not be sent to purchased contacts, unrelated leads, withheld or invalid numbers, destinations known to be wrong, or people who have asked not to receive these optional follow-ups.
12.4 Messages must identify your business, refer neutrally to the interruption or attempted contact, and provide a working callback or reply route and an accessible privacy-information route where needed. A reply may be used to continue that enquiry and, where requested and authorised, arrange a booking. A failed call must not be treated as a blanket request for future sales messages or permission to initiate WhatsApp contact.
12.5 The feature is limited to the sending window shown in its settings and must not become an indefinite retry campaign. Unless an End User requests further communication, it must send no more than one initial recovery follow-up to the same destination for the same incident. Appropriate deduplication, timing and suppression controls apply. An expired, resolved or no-longer-relevant event must not trigger a stale follow-up.
12.6 Standard recovery content must not contain discounts, special offers, upselling, unrelated promotions or repeated invitations to purchase. If the content, purpose or context makes a message direct marketing, the applicable marketing rules apply regardless of its label or the workspace toggle. The standard recovery feature does not authorise such marketing.
12.7 An End User must have a straightforward way to stop optional recovery follow-ups. Where replies are supported, requests such as STOP must be handled as preference instructions and not as new enquiries. Otherwise a clearly disclosed, working alternative opt-out must be provided. You must not override a recipient's applicable objection or suppression setting.
12.8 Switching the feature off must stop new sends and cancel messages still queued under our control before dispatch. A message already handed to a carrier or platform may still be delivered and cannot necessarily be recalled. Properly disclosed charges already incurred remain payable.
12.9 The feature cannot recover call events that were not received or reliably recorded, cannot guarantee identification of every affected caller, and cannot ensure a message is delivered or acted upon. It supplements your incident response and alternative contact arrangements. It does not guarantee restoration, recovered leads or successful bookings.
13 Messaging permissions and preferences
13.1 You must comply with Communication Rules for every message and call you instruct. Maintain evidence of permissions where required, use accurate sender identification, provide applicable opt-out controls and respect objections. A contact number being publicly available or absent from a suppression register is not, by itself, permission to send an automated marketing call or promotional electronic message.
13.2 The standard service must not be used for unsolicited automated marketing calls, spam or unauthorised bulk campaigns. Any separately agreed outbound or marketing function requires its own lawful deployment, including channel-specific consent where required, applicable suppression checks and platform approval. Consent to live marketing calls must not be treated as consent to automated marketing calls.
13.3 WhatsApp and other platforms may require recipient opt-in, approved templates, restrictions on initiating conversations, service-window limits and a clear escalation route. Comply with those requirements even where a message may qualify as a non-promotional service communication under local law. A prior voice call does not automatically establish WhatsApp opt-in or open a WhatsApp customer-service window.
13.4 End User preferences and objections must be applied to the relevant Customer, purpose and channel. You must communicate relevant objections received outside Kallin to us or record them through the available control without undue delay. Kallin must apply objections received through the controls it supplies. Do not re-enable a suppressed destination merely by changing an administrator setting.
13.5 A reply to a Recovery Message is not permission for unrelated marketing. Any renewed permission or request for further contact must be sufficiently clear, valid for the intended use and recorded. Retain only the minimum suppression information needed to respect a preference while the relevant activity continues.
14 Telephone numbers and forwarding
14.1 Where we provide a number, you receive a right to use it for the active service, subject to availability, applicable law, verification and carrier conditions. The allocation does not give ownership of a number. We will meet any applicable number-use and portability duties and will not use these Terms to exclude a statutory transfer right.
14.2 Provide accurate identity, business, address and other information required for regulatory or carrier verification. A number may not be activated or retained until those requirements are met. Extra numbers, international numbers, messaging registration and special-number services are included only on the disclosed terms in your Order.
14.3 If you keep an existing number through forwarding, maintain that number and arrange forwarding with its provider. Test the configuration and confirm that provider's charges. Voice forwarding does not automatically forward SMS, connect WhatsApp or authorise outgoing use of the original number. Caller identification passed through a network may be incomplete or unreliable.
14.4 Contact us before cancellation if you want to arrange an available transfer. Do not disconnect a number before an agreed transfer is complete. We will give reasonable assistance and comply with applicable obligations; we cannot guarantee a transfer that is unavailable or barred by lawful carrier or regulatory requirements.
14.5 The AI answering service is not a replacement for an emergency-capable telephone service. Do not rely on it to contact emergency services. This does not exclude any emergency-access obligation that legally applies to a separately supplied telecommunications service.
15 Integrations and outside services
15.1 Connect only accounts you are entitled to use and give only the access needed for the agreed action. You are responsible for the accuracy of your calendar, CRM, website and other connected business information. Remove obsolete access and tell us about material changes.
15.2 Third-party services have their own terms, prices, availability, technical limits and policies. Changes can affect a connection. We will exercise reasonable care in operating our agreed integrations but cannot promise that every external function will remain available indefinitely.
15.3 A tool you independently select and connect is distinct from a subprocessor appointed by Kallin. We remain responsible for our appointed subprocessors as provided in Schedule 1. Disconnecting an integration does not automatically delete information already copied into another system; appropriate deletion instructions must cover the relevant recipients.
15.4 An integration description, logo or demonstration does not mean the outside provider endorses Kallin or that every action is supported. The scope and permissions of a material integration must be confirmed before you rely on it.
16 Trials and demonstrations
16.1 Unless your trial offer expressly states otherwise, the standard telephone trial lasts seven days and includes 60 call minutes without requiring a payment card. It ends when the time or minute allowance is exhausted, whichever happens first. Trial calls may be limited to five minutes each. Any trial messaging allowances or other limits must be disclosed before activation.
16.2 Schedule 1 applies when a trial processes personal data on your behalf. Required notices, lawful instructions, access safeguards and communication permissions apply during a trial in the same way as during paid use.
16.3 At expiry, the trial phone service pauses unless you choose an available paid plan. We will not convert a no-card trial into a paid subscription or charge a previously supplied payment method without a separate disclosed payment authorisation. An extension or different trial arrangement must be recorded.
16.4 Our own sales demonstrations are governed by the notice given for that demonstration and our Privacy Policy where we act as controller. Use fictional details in public demos and do not supply unnecessary sensitive information. Access to another customer's workspace or information is never included in a demonstration.
17 Prices and payment
17.1 Your Order must state the subscription price, currency, billing frequency, included usage, any setup work, additional charges and any minimum commitment. VAT or other transaction taxes are charged only where lawfully applicable and disclosed. A quoted monthly equivalent for annual billing does not mean the annual fee is payable monthly.
17.2 Subscription fees are payable in advance unless the Order provides otherwise. Extra usage is billed on the disclosed basis. By authorising a payment method you authorise only the recurring fees and usage charges you have agreed, not unrelated or undisclosed charges.
17.3 Number charges, SMS charges, transfer-related usage, chargeable WhatsApp templates, international routing and other provider charges must be included or separately identified before purchase or activation. The method of calculation, relevant rates and any currency-conversion basis must be available before you incur them. If a fee is described as passed through at cost, we will not add an undisclosed markup.
17.4 We will not add a setup charge or a chargeable feature without agreement. A usage alert is not a spending cap unless we expressly identify and operate it as a cap. Your Order or enabled spending control must explain whether the affected service continues, pauses or uses an agreed fallback when an allowance or cap is reached.
17.5 If a payment fails, we may notify you, retry payment under the disclosed billing arrangements and suspend the affected service after reasonable notice. Immediate action may be taken to prevent fraud or unlawful use. We will restore service reasonably promptly after payment is resolved, subject to technical and carrier availability.
17.6 Tell us promptly about a disputed invoice. We will investigate and correct established errors. Pay undisputed amounts when due. No short administrative reporting period in these Terms removes a legal right to dispute a charge.
18 Usage measurement and allowances
18.1 Your Order or incorporated usage specification must explain how calls are measured, including connected duration, the rounding increment, treatment of transfers and simultaneous call legs, allowance reset dates and any international or premium routing. We must not charge a measurement method or rate that was not disclosed before the relevant use.
18.2 Included call allowances reset for the period stated in your Order. Annual payment does not combine monthly allowances into an unrestricted annual pool unless agreed. Unused allowances expire at the end of their period unless rollover is expressly included.
18.3 Extra seats, numbers and other chargeable changes must be shown before confirmation. The account owner counts towards a workspace-seat allowance. An added User does not by itself upgrade your plan. The specific allowance and price are those you agree in your Order.
18.4 Where website chat or WhatsApp chat is advertised as unlimited, there is no undisclosed numerical conversation allowance or additional Kallin charge for ordinary included chat usage. Clearly disclosed provider charges may apply separately. Unlimited use does not permit unlawful use, reselling, artificial traffic or conduct that materially harms the service. We may apply proportionate safeguards under clause 23, explain an identified problem and seek a reasonable solution; we must not secretly replace an unlimited entitlement with a lower paid allowance.
18.5 Where SMS is chargeable by segment, the disclosed usage specification must explain segmentation, including the treatment of long messages, character encoding, multipart messages and applicable carrier fees. A displayed message count must not be presented as a one-charge-per-message limit if the agreed charging basis is per segment.
19 Renewal and cancellation
19.1 A recurring subscription renews for its disclosed billing period unless your Order states it is non-renewing or you cancel before the next renewal. The renewal date and any initial minimum commitment must be clear before purchase. A fixed-term arrangement renews automatically only if that renewal was disclosed and agreed.
19.2 You may cancel through an available account cancellation control or by emailing info@kallin.co.uk from your account email address, unless your Order specifies another reasonable method. We may proportionately verify authority but will not use verification or delayed acknowledgement to create an extra renewal. The time we receive a clear authorised cancellation request is the cancellation time.
19.3 Cancellation normally takes effect at the end of the paid period. You may continue the paid service until that date unless a lawful suspension or termination reason applies. Cancellation does not remove properly incurred usage charges or an expressly disclosed remaining fixed-term commitment.
19.4 Stopping forwarding, logging out or disabling an individual feature does not cancel the subscription. Make an express cancellation request. Consider number-transfer arrangements, data export and replacement contact routes before the service ends.
20 Refunds and service remedies
20.1 Except where the Order or mandatory law provides otherwise, we do not refund a paid period solely because you choose not to use it, disable a feature or cancel part-way through. This does not exclude a refund for an incorrect charge, our material breach, an agreed refund entitlement or a discontinued service without an equivalent agreed replacement.
20.2 If we terminate for our own convenience, or you validly terminate an affected service for our uncured material breach, we will refund prepaid fees for the unused affected period and address other remedies under the agreement and applicable law. An agreed service-credit scheme applies only where included in a service level agreement and does not remove a remedy that cannot lawfully be excluded.
20.3 We may deduct only properly incurred, undisputed charges from a refund where permitted. We will not impose an undisclosed cancellation or refund-processing charge. Where a supplier refund is relevant, our contractual responsibilities are not limited simply to whatever that supplier chooses to refund.
21 Plan and price changes
21.1 An upgrade, downgrade, seat change or different billing term takes effect on the date agreed and at the price and prorating shown before you confirm it. We will explain the treatment of existing allowances and prepaid fees before acceptance. A feature's availability in the dashboard does not itself authorise a new charge.
21.2 We may change prices for future renewals on at least 30 days' written notice. A price will not increase during a prepaid fixed commitment unless a specific lawful adjustment mechanism was disclosed and agreed. You may cancel before a proposed renewal price takes effect without an additional cancellation fee.
21.3 Any variable third-party rate or currency mechanism must be expressly disclosed as variable, with a meaningful way to see the applicable rate before chargeable use. A general reference to supplier fees is not permission to add an unexpected charge.
22 Availability and continuity
22.1 The service is intended to operate on an ongoing basis, but outages, maintenance, model errors, carrier failures and integration failures can occur. There is no contractual uptime percentage, guaranteed restoration time, support response time or service-credit scheme unless expressly agreed.
22.2 We will take reasonable steps to maintain and restore the agreed service, investigate material incidents and provide relevant operational information. We will give advance notice of planned maintenance where reasonably practicable, with shorter notice where urgent security or continuity work requires it.
22.3 Maintain an appropriate alternative contact route and a fallback for important enquiries. Keep your escalation details current and review material errors and missed notifications. These customer precautions do not excuse our failure to perform our own obligations with reasonable care and skill.
22.4 Recovery Messages operate only under clause 12 and are not a substitute for restoring service or a guarantee that affected calls are identified. If a material interruption makes an affected paid service unavailable for more than 30 consecutive days, either party may terminate that affected service and unused prepaid fees will be refunded proportionately. Earlier remedies for material breach or mandatory legal rights remain available.
23 Acceptable use
23.1 Do not use the service to commit an offence, defraud, harass, discriminate unlawfully, impersonate, distribute malware, access information without authority, infringe rights, evade safeguards or abuse a telecommunications or messaging network.
23.2 Do not use it for unsolicited automated marketing, unauthorised bulk messages, artificial traffic intended to exploit allowances, scraping or extraction in breach of law, or attempts to obtain another customer's information. Do not resell or sublicense the service without written agreement.
23.3 Do not supply a person's voice for cloning or imitation without the necessary lawful authority and any required informed permission. An authorised voice must not be used for unlawful impersonation or to defeat a required AI disclosure. You are responsible for rights in voices, materials and scripts you provide; Kallin remains responsible for its own use and safeguards.
23.4 Do not deliberately collect passwords, payment-card security codes, full card details or unnecessary sensitive identifiers through the standard assistant. Payment collection, if separately supported, must use an approved secure process rather than exposing payment credentials in ordinary call or chat records.
23.5 Deliberate processing of special-category data, criminal-offence information or children's information at scale requires prior written agreement, appropriate legal conditions and suitable safeguards. Incidental disclosure does not permit unrestricted retention or further use. Do not use the standard service as the sole decision-maker for decisions with legal or similarly significant effects without a separately assessed and expressly agreed lawful deployment.
23.6 Where misuse creates a material risk, we may apply proportionate restrictions or suspension, tell you the reason where lawful and practicable, and work towards an appropriate remedy. Legitimate ordinary use must not be treated as abuse merely because it approaches a disclosed allowance or uses an included unlimited feature.
24 Data protection responsibilities
24.1 Schedule 1 applies whenever Kallin processes personal data on your behalf, including during trials, live handling, customer-specific improvement, notifications, Recovery Messages, support, exports and deletion. Schedule 2 and your lawful recorded configuration identify the processing scope.
24.2 The Customer is normally the controller for its business communications and Kallin its processor. If you are a processor acting for another controller, obtain that controller's authorisation to appoint Kallin and pass on its lawful instructions and restrictions. Actual activities determine the parties' legal roles; a label cannot override the law.
24.3 We separately act as controller for our own account administration, billing, direct sales demonstrations, security and other purposes described in our Privacy Policy. That does not give us unrestricted rights over your callers' content. Any proposed independent use of identifiable Customer Data must be assessed and lawfully established before it begins.
24.4 Neither the DPA, a service toggle nor these Terms authorises a use that lacks a lawful basis, required notice, consent, transfer safeguard or other legal condition. Both parties must meet the duties applicable to their role and cooperate reasonably to give effect to individual rights.
25 Confidentiality
25.1 Each party must protect the other's confidential business information, use it only to perform or enforce the agreement or meet a legal duty, and disclose it only to people who need it and are subject to appropriate confidentiality obligations. This includes non-public business knowledge, credentials, call content and commercially sensitive configuration.
25.2 This obligation does not cover information the receiving party can show was already lawfully known, became public without breach, was lawfully received without restriction, or was independently developed without using the confidential information.
25.3 A legally required disclosure must be limited to what is required. Give advance notice where lawful and reasonably practicable. Personal data remains governed by Data Protection Law and Schedule 1 regardless of a confidentiality exception. These duties continue after the agreement ends.
26 Customer Data and intellectual property
26.1 You retain your rights in Customer Data and materials you supply. You give us only the rights needed to deliver, secure, support and administer the agreed service and fulfil lawful instructions, subject to Schedule 1. We do not obtain ownership of your data or unrestricted rights to train models with it.
26.2 Kallin and its licensors retain rights in the platform, software, models, documentation, branding and underlying technology. For the active agreement, you receive a non-exclusive, non-transferable right to use the purchased service for your own business purposes. Bespoke development has any ownership or licence terms expressly agreed in its Order.
26.3 As between you and Kallin, you may use generated summaries, messages and other outputs for your business purposes, subject to law and third-party rights. Outputs can be inaccurate, unoriginal or similar to others' outputs. We do not promise that every output attracts copyright or is exclusive. Review material outputs before relying on or publishing them.
26.4 You must have the necessary rights to business knowledge, photographs, logos, voices, documents and other materials you provide. Do not remove ownership notices or reverse engineer except where a restriction is prohibited by mandatory law. Statutory interoperability rights remain available.
26.5 We may use voluntarily supplied general feedback to improve the service, but this is not a licence to disclose confidential information or use identifiable conversation content for an independent purpose. We require your permission before presenting you as a named customer, publishing a case study or using your testimonial or logo beyond an otherwise lawful authorised use. Public claims and testimonials must be genuine and supportable.
27 Suspension
27.1 We may suspend affected functions proportionately for overdue undisputed payment, a material contractual breach, compromised access, fraud, unlawful instructions, a serious security or network risk, or a lawful carrier or regulatory requirement.
27.2 We will give reasonable notice and an opportunity to remedy where practicable. Immediate suspension may be necessary to prevent serious harm or comply with law. We will tell you the reason, scope and reasonable steps for restoration unless disclosure is prohibited or would undermine a legitimate security investigation.
27.3 We will avoid suspending more of the service than reasonably needed and restore affected functions reasonably promptly when the reason is resolved. Suspension does not authorise an independent use of retained data, remove applicable individual rights or permit charges for a service we are not entitled to charge for.
28 Termination and leaving the service
28.1 Either party may terminate for a material breach that cannot be remedied or remains unremedied 14 days after a written notice identifying the breach and required remedy. A longer period may be agreed where appropriate. Immediate termination may be used where continued performance would be unlawful or create a serious unmanageable risk.
28.2 We may end a rolling service for convenience on at least 30 days' written notice, subject to any longer agreed period. If we end a prepaid fixed commitment early for convenience, we will refund the unused affected period. Termination for insolvency is available only to the extent permitted by applicable insolvency law and restrictions on terminating supply contracts.
28.3 When service ends, future AI answering and customer-directed automated messages cease, subject to a message already dispatched to a carrier. Properly incurred charges remain due. A termination is not permission to restart marketing or reuse End User contact details for a different purpose.
28.4 You may request an available export of Customer Data during the service and within 30 days after termination. We will provide a reasonable standard export without requiring purchase of another subscription. Bespoke conversion or migration may be separately quoted in advance, but must not defeat a statutory right or our duties under Schedule 1.
28.5 At your choice we will return or delete processor personal data under Schedule 1. If no return instruction is received within the 30-day export period, the agreed default is deletion. Active service copies are deleted within 60 days after termination, with protected residual backup copies deleted or overwritten within a further 90 days, unless a valid instruction requires earlier action or law requires limited retention. Outstanding deletion instructions must be reapplied if a backup is restored.
28.6 Agree number-transfer and replacement contact arrangements before disconnecting service. Clauses concerning accrued charges, confidentiality, intellectual property, data protection, liability, disputes and other provisions intended to survive remain effective.
29 Liability
29.1 Nothing excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited. The agreement does not limit an individual's statutory data protection rights or a regulator's powers.
29.2 Subject to clause 29.1 and applicable law, neither party is liable to the other for indirect or consequential loss, or lost profits, revenue, anticipated savings, business opportunities or goodwill. This exclusion does not exclude reasonable direct costs of restoring Customer Data lost because of our breach, subject to the applicable lawful cap. It does not remove a refund expressly owed under the agreement.
29.3 Subject to clause 29.1, each party's total aggregate liability arising from the agreement, whether in contract, tort, breach of statutory duty or otherwise, is limited to the greater of GBP 1,000 and the service fees paid or payable for the 12 months immediately before the first event giving rise to the claim. For breach of confidentiality or data protection obligations, the corresponding cap is the greater of GBP 5,000 and twice those 12-month fees. That higher cap replaces rather than adds to the ordinary cap for those claims.
29.4 The caps do not limit payment of fees properly due or override a separately agreed higher cap. Related claims arising from the same event or series of connected events are treated together for the applicable cap, without excluding a liability that law requires to remain uncapped.
29.5 These limitations apply only so far as permitted and reasonable under applicable law. We remain responsible for our agreed obligations and appointed subprocessors; using a supplier does not itself excuse our breach. AI limitations and customer oversight requirements are relevant to the agreed service but do not remove our obligation to exercise reasonable care and skill.
30 Claims arising from unlawful customer instructions
30.1 You will reimburse reasonable losses and costs we incur from a substantiated third-party claim directly caused by unlawful Customer Data, unlawful customer instructions or unauthorised use of intellectual property or a person's voice supplied by you. This does not apply to the extent a claim results from our breach, negligence, unauthorised processing or failure to follow lawful instructions, and is subject to clause 29 where a limitation is lawful.
30.2 We must notify you promptly, take reasonable steps to reduce loss and give you a reasonable opportunity to participate in the defence. Neither party may agree a settlement imposing liability, an admission or a non-monetary obligation on the other without that party's written agreement, which must not be unreasonably withheld. No reimbursement is required for a regulatory penalty or other item where indemnification would be unlawful.
31 Events beyond reasonable control
31.1 A party is not liable for delay or failure caused by an event beyond its reasonable control that it could not reasonably prevent or mitigate. This can include major external network failures, natural disasters, government restrictions or widespread infrastructure disruption. An ordinary supplier problem or avoidable lack of resilience is not automatically such an event.
31.2 The affected party must notify the other where practicable, mitigate the effect and resume performance as soon as reasonably possible. Duties concerning protection of retained personal data continue. Fees for services already properly supplied remain payable. An affected service may be terminated and unused prepaid fees refunded under clause 22.4 if the interruption lasts more than 30 consecutive days.
32 International and sector-specific use
32.1 Services are available only where technically supported and lawfully deployable. Website access or an account does not establish that every feature is authorised in every country. Tell us the countries and sectors you intend to serve and any special recording, messaging, data-residency, accessibility or regulated-service requirements before activation.
32.2 Each party remains responsible for laws applicable to it. Country-specific recording consent, electronic marketing rules, AI disclosures, representative appointments, privacy rights and transfer safeguards may require additional arrangements. These Terms do not provide a worldwide compliance certification or remove mandatory local protections.
32.3 Healthcare, legal, financial, employment, education, children's services, biometric uses and consequential automated decisions may require a separate assessment and agreed safeguards. The standard service must not be configured to provide unapproved regulated advice, emergency decisions or prohibited processing.
32.4 We may restrict a territory or function where required by law, sanctions, carrier conditions or a material compliance risk that cannot reasonably be addressed. Any restriction must be proportionate and unused prepaid fees addressed under clauses 20 and 28. Our numbering and telecommunications obligations, where applicable to the actual service supplied, are not waived by these Terms.
33 Complaints and disputes
33.1 Send service complaints to info@kallin.co.uk with sufficient account details and a description of the issue. We will investigate and seek a reasonable resolution. Either party may request escalation to an appropriate decision-maker or propose mediation, without requiring the other to accept binding arbitration.
33.2 Send a complaint about our handling of personal data to the same address and identify it as a privacy complaint. We will acknowledge it within 30 days, investigate without undue delay, keep you appropriately informed and communicate the outcome. Ask for an accessible alternative if needed. You may complain to a competent regulator without first using our complaints process.
33.3 Complaints about a customer's purposes or decisions normally belong with that customer as controller. We must still address our own conduct and assist under Schedule 1. A complaints process does not suspend a legal deadline unless law or an express agreement provides otherwise, or prevent urgent court relief or a statutory remedy.
34 Changes and general provisions
34.1 We may update these Terms to reflect the service or law. We will give at least 30 days' notice of a material contractual change affecting an existing subscription unless a shorter period is legally necessary or the change is solely beneficial. The notice must explain the change and effective date.
34.2 A materially adverse change will not bind you during a prepaid fixed commitment without agreement, except where mandatory law requires it. For a rolling service, you may cancel before the change takes effect. If a legally necessary change must take effect sooner and materially disadvantages you, you may end the affected service and receive a proportionate refund of unused affected prepaid fees. Updates do not retrospectively remove accrued rights or authorise a new incompatible data use.
34.3 Neither party may assign the agreement without the other's reasonable consent, except as part of a genuine reorganisation or business sale where the successor assumes the obligations and safeguards are not materially reduced. The assigning party must give notice of a material transfer. If a transfer by Kallin materially prejudices you, you may terminate the affected service and obtain the applicable unused prepaid refund.
34.4 If a provision is unenforceable, the remaining provisions continue. Any permitted adjustment must go no further than law allows. A failure to enforce a right immediately is not a waiver. The agreement creates no general partnership or agency between the parties; this does not change the authority you expressly give an assistant to act for your business.
34.5 The agreement records the parties' agreed service terms. Any entire-agreement or non-reliance effect is subject to fraud, unlawful misrepresentation exclusions, mandatory rights and the reasonableness requirements of applicable law. No protected right is removed merely because a representation appeared in a demonstration or marketing material.
35 Governing law and contact
35.1 The agreement and related non-contractual obligations are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction for business disputes, subject to any mandatory local rule requiring otherwise.
35.2 This choice does not override mandatory consumer protections, privacy complaint rights, data-subject remedies or local jurisdiction rights. It does not require an individual to make a privacy complaint only in England and Wales. Except for rights that cannot lawfully be excluded, a third party has no contractual enforcement right under the Contracts (Rights of Third Parties) Act 1999.
35.3 Contractual notices may be sent to info@kallin.co.uk and the current account email or legal contact you maintain with us. Keep those details accurate. Formal court documents and statutory notices must be served as the law requires; email contact under these Terms is not a replacement for legal service rules.
Schedule 1 Data Processing Agreement
1 Scope and roles
1.1 This Schedule is a binding part of the agreement whenever Kallin processes personal data in Customer Data on the Customer's behalf. It applies to trials and paid service, including the processing described in Schedule 2 and recorded lawful service settings.
1.2 The Customer is normally the controller and Kallin its processor. Where the Customer is a processor, references to its controller responsibilities mean the responsibilities it must discharge or obtain authorisation for under its agreement with the relevant controller. It must ensure that controller has authorised Kallin's appointment and the applicable subprocessors and transfers.
1.3 Kallin's separate controller activities remain subject to its Privacy Policy and Data Protection Law. Processing does not become processor activity merely because it is described that way in a contract. A proposed change of role or purpose must be assessed before the new processing starts.
2 Processing particulars
2.1 Schedule 2 identifies the subject matter, duration, nature, purposes, data types and categories of people involved. The Order, enabled configuration and lawful durable instructions identify the applicable functions, recording and retention choices, recipients, integrations and limits.
2.2 Processing is limited to the agreed service and necessary security, support, return and deletion activities. Kallin must not expand processing to an unrelated purpose merely because the information is technically accessible. The Customer may impose lawful limits, request information about processing and instruct correction, return or deletion.
3 Documented instructions
3.1 Kallin will process Customer personal data only on the Customer's documented lawful instructions, including instructions concerning transfers, unless applicable law requires otherwise. Instructions may be recorded in the agreement, an accepted Order, administrator settings, written support instructions or another durable form that can be retained.
3.2 If law requires processing outside those instructions, Kallin will tell the Customer before it occurs unless the law prohibits that notification. If Kallin considers an instruction infringes Data Protection Law, it will inform the Customer promptly and may suspend the affected processing while the issue is resolved.
3.3 Instructions to send notifications or Recovery Messages must specify the relevant feature and configuration. An enabled setting does not replace any lawful basis, required recording or messaging consent, recipient preference or channel restriction. Processing must remain within clauses 8 to 13.
3.4 The Customer must provide lawful instructions and appropriate privacy information, identify necessary legal conditions, maintain the accuracy of material data and communicate relevant restrictions and individual requests. Kallin remains responsible for its own processor duties and agreed controls.
4 Confidentiality and authorised access
4.1 Kallin will ensure that people authorised to process Customer personal data are bound by confidentiality obligations or an appropriate statutory duty. Access must be limited to what their role requires, reviewed and removed when no longer needed.
4.2 Support access to conversation content must be necessary for a defined service, security or support purpose, appropriately authorised and recorded. Staff must not browse customer recordings or messages for unrelated purposes, or copy them into personal accounts or unapproved systems.
5 Security
5.1 Kallin will implement and maintain appropriate technical and organisational measures under Data Protection Law, including Article 32 where applicable. The measures must take account of the information, processing, risks, available safeguards and need for confidentiality, integrity, availability and resilience. Schedule 2 describes the minimum control areas.
5.2 Kallin will make sufficient information about its implemented measures available for the Customer to assess the service before processing begins. Controls may evolve with the service and risks, but must not materially reduce the agreed protection. No security certification is claimed unless actually held and identified.
5.3 Each party must safeguard the systems and access within its control. Kallin must investigate material weaknesses affecting the agreed processing and take appropriate protective and corrective steps. A customer's security obligation does not excuse a failure in Kallin's own controls.
6 Subprocessors
6.1 The Customer gives general written authorisation for Kallin to appoint subprocessors subject to this paragraph. Before the relevant processing starts, Kallin must provide a current register identifying each actual appointed supplier, its role, processing locations and applicable transfer safeguards. Categories of suppliers alone do not replace that register.
6.2 Kallin will notify the Customer of an intended new or replacement subprocessor at least 30 days before that supplier begins the relevant processing and provide a meaningful opportunity to object on reasonable data protection grounds. A shorter period may be used only where lawful and necessary for an urgent security or continuity issue, with prompt notification and the required opportunity to object or obtain a lawful alternative. Urgency does not override a requirement for prior authorisation.
6.3 The parties will seek a reasonable solution to a substantiated objection. If none is available, the Customer may terminate the affected service before unnecessary processing by the disputed supplier, without an additional termination fee, and receive a proportionate refund of unused affected prepaid fees.
6.4 Kallin must enter into a binding agreement with each subprocessor imposing equivalent applicable data protection obligations and must exercise appropriate oversight. Kallin remains responsible to the Customer for that supplier's performance of those obligations. A general authorisation does not permit an undisclosed supplier or an unlawful transfer.
7 Rights requests and assistance
7.1 Taking account of the processing and available information, Kallin will assist the Customer with appropriate measures to respond to access, correction, deletion, restriction, portability, objection, consent withdrawal and other applicable individual rights.
7.2 Kallin will promptly refer a request concerning Customer processor data to the Customer and not respond substantively except on its instructions or where law requires. It must protect other individuals' information during searches, exports and disclosure, and provide relevant information sufficiently promptly to support applicable deadlines.
7.3 Kallin will reasonably assist with security obligations, data protection impact assessments, regulator consultations and breach notifications. The Customer remains responsible for assessments and notifications required of it as controller. Kallin remains responsible for those required of its own role.
7.4 Exceptional assistance outside ordinary support may be separately priced in advance where lawful, but a charge must not prevent or delay compliance or be imposed to correct Kallin's own breach. An individual's request must not be conditioned on purchasing a subscription.
8 Personal data breaches
8.1 Kallin will notify the Customer without undue delay after becoming aware of a personal data breach affecting its processor data. Notification must not be delayed merely because the investigation is incomplete.
8.2 As information becomes available, Kallin will provide the nature of the breach, affected information and people where known, likely consequences, containment and remediation steps, and a contact for further information. It will cooperate reasonably with investigation and legally required notifications.
8.3 The Customer decides on its notifications to individuals and authorities for processing it controls, without limiting Kallin's separate statutory duties. Both parties must preserve relevant evidence securely, minimise further harm and avoid unnecessary disclosures during the response.
9 International transfers
9.1 Kallin will not make a restricted transfer of Customer personal data without an applicable lawful mechanism and required safeguards. The actual destinations, importers and mechanisms must be identified before transfer, including relevant overseas access by a supplier or support operation.
9.2 Where appropriate, safeguards may include valid adequacy arrangements, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses or applicable EU Standard Contractual Clauses, together with the necessary assessments and supplementary protections. Reliance on a certified adequacy framework requires verification that the recipient and the relevant data are covered.
9.3 This DPA does not itself complete an international transfer instrument. Required parties, selections and annex information must be properly completed for the actual transfer. Kallin will make relevant safeguard information available on request, subject to lawful protection of confidential details.
9.4 If a safeguard can no longer be met, Kallin must notify the Customer, take appropriate protective action and suspend the affected restricted transfer where necessary until a lawful arrangement is available. English governing law or an EU or UK hosting region alone does not establish compliance for every access and processing location.
10 Return and deletion
10.1 On termination or a lawful deletion instruction, Kallin will, at the Customer's choice, return or delete its processor personal data and delete existing copies unless applicable law requires limited retention. The standard export period is 30 days after termination; if no return instruction is received within that period, the Customer's default instruction is deletion.
10.2 Active service copies will be deleted within 60 days after termination, with protected residual backup copies deleted or overwritten within a further 90 days. A valid shorter instruction or applicable law may require earlier action. Backup information awaiting deletion must be kept protected and beyond ordinary use, and outstanding deletion instructions reapplied following a restoration.
10.3 Deletion must cover relevant recordings, transcripts, summaries, messages, integration copies under Kallin's control and identifiable information embedded in customer-specific instructions or other derived records. Kallin must transmit relevant instructions to its appointed subprocessors and account for their completion. Copies in independently controlled connected systems require the appropriate controller's instructions.
10.4 A legal hold must be limited to the necessary information and period, protected from unrelated use and explained where law permits. Kallin will confirm completion of return or deletion on reasonable request. Genuinely anonymised statistics that cannot identify an individual are distinct from pseudonymised or merely name-stripped information.
11 Information and audits
11.1 Kallin will make available the information reasonably necessary to demonstrate compliance with this DPA and allow and contribute to audits and inspections by the Customer or its appropriately appointed auditor.
11.2 Arrange reasonable notice, confidentiality, safe access and timing to protect other customers and minimise unnecessary disruption. Existing independent assurance may be used where it adequately answers the concern. Routine audits may normally be limited to once in 12 months, but that does not restrict an audit required by law or a regulator, or justified by a substantiated compliance concern or relevant breach.
11.3 Neither access restrictions nor charges may defeat a statutory audit right. Each party normally bears its own costs, except that Kallin bears reasonable additional audit costs attributable to an established material breach by Kallin. Disclosing another customer's personal information is not an acceptable method of demonstrating compliance.
12 Applicable service provider restrictions
12.1 Where a relevant United States or other privacy law treats Kallin as a service provider, contractor or equivalent processor, Kallin will comply with the applicable restrictions for that processing. It must use the information only for the specified permitted purposes and instructions and provide the legally required protection.
12.2 Kallin will not sell or share that Customer personal information for cross-context behavioural advertising, use it outside the permitted direct business relationship, or combine it with other customers' or independently obtained information except as the applicable law permits. Kallin certifies that it understands and will comply with these restrictions where they apply.
12.3 The Customer may take reasonable steps to verify compliance and, after notice, stop and remediate unauthorised processing. Kallin will tell the Customer if it can no longer meet an applicable obligation and impose equivalent relevant restrictions on its subprocessors. Any additional country-specific contractual terms required by law must be completed before the relevant deployment.
13 Duration and priority
13.1 This DPA continues for as long as Kallin or its subprocessors retain Customer processor personal data. Mandatory Data Protection Law and properly executed transfer safeguards prevail over inconsistent contractual provisions. Nothing here removes a data subject's statutory rights or either party's duties to an authority.
Schedule 2 Processing details and security measures
1 Subject matter and duration
1.1 The subject matter is delivery of the Customer's enabled business communication service and associated customer-specific configuration, security, support, exports and deletion. Processing lasts while the agreed functions operate and for the limited return, deletion or lawful retention periods in the agreement.
1.2 The Customer's recorded retention instruction controls active recordings, transcripts, summaries and other conversation records. The service's actual default and available controls are identified at [DEFAULT ACTIVE RETENTION PERIOD OR LINK TO THE INCORPORATED RETENTION SPECIFICATION]. Those particulars must be supplied before optional retained recording or transcription is enabled. Shorter lawful instructions must be applied; records must not be retained merely because storage is available.
1.3 End-of-service processing follows clause 28 and Schedule 1 paragraph 10: a 30-day export request period, deletion from active systems within 60 days after termination and protected residual backup removal within a further 90 days, unless a valid shorter instruction or specific legal obligation applies.
2 Nature and purposes
2.1 Operations may include receiving and transmitting communications; real-time audio and speech processing; retaining recordings where enabled; transcribing, summarising, classifying and retrieving information; capturing contact details; handling an enquiry; performing authorised booking or routing actions; delivering notifications; displaying and exporting records; and securing, supporting and deleting that information.
2.2 Enabled Kallin Intelligence may analyse the Customer's own conversations and generate or apply customer-specific instruction changes within the approved scope. Enabled recovery processing may identify a specific failed-contact event, select an appropriate recipient, apply timing and suppression checks, send one permitted initial follow-up, process a reply and record the outcome.
2.3 These functions operate to handle the Customer's business enquiries, perform authorised administrative actions, improve that Customer's assistant where enabled and maintain the agreed service. They do not authorise general-purpose model training, independent advertising, pooling identifiable conversations between customers or other unrelated uses.
3 People and information involved
3.1 Data subjects may include prospective and existing customers, callers, website visitors, messaging contacts, employees, contractors and other people whose information the Customer lawfully supplies or receives through the service.
3.2 Data types may include names and contact details; caller or sender identifiers; call time, route, duration and status; audio where enabled; conversation content and transcripts; summaries; business-enquiry and appointment details; preferences and opt-outs; authorised integration identifiers; customer-specific instructions; configuration and instruction-change records; and security or support information needed for that processing.
3.3 Special-category information, criminal-offence information, biometric identification and deliberate children's processing at scale are not authorised routine inputs under the standard service. Any necessary deliberate use requires the legal conditions and separately agreed safeguards described in clause 23. Incidental sensitive disclosures must be minimised and handled or removed appropriately.
4 Customer instructions and recipients
4.1 Before activation, the Customer's Order or durable setup record must identify enabled channels; recording, transcription and retention choices; the approved disclosure and privacy-information route; notification recipients; permitted actions and integrations; Kallin Intelligence settings; and the state and limits of the recovery feature.
4.2 Authorised customer staff and the recipients permitted in that record may receive only the information their role requires. Processor disclosures are limited to appropriately appointed suppliers and supported recipients needed for those instructions. A connected independent service must be identified and given only the authorised information and access.
5 Subprocessor register and locations
5.1 The current supplier register is provided at [CURRENT SUBPROCESSOR REGISTER LINK OR CONTRACTUAL ANNEX], version dated [REGISTER VERSION DATE]. Kallin must provide the completed register before relevant processing starts and operate the change process in Schedule 1 paragraph 6.
5.2 For each actual appointed supplier, the register must identify the legal entity, service role, relevant data, storage and processing locations, permitted support-access locations, and the applicable transfer mechanism. Material supplier retention or permitted input use must be explained accurately. A product brand or general supplier category does not establish the legal entity or a transfer safeguard.
5.3 No promise that all data stays in the UK, the EU or another single territory applies unless expressly agreed and implemented for the full relevant processing chain.
6 Technical and organisational safeguards
6.1 Access controls. Limit account, staff and supplier access to appropriate roles; protect authentication and administrative access; remove unnecessary access; and manage secrets and integration permissions securely. Support access must be authorised for a defined purpose and appropriately logged.
6.2 Customer separation. Enforce appropriate separation of customer information across database access, recordings, storage, search, AI retrieval, integration credentials, generated instructions and exports. A customer must not be able to obtain another customer's information through the interface, a direct link, an API or an AI instruction.
6.3 Protection of information. Use suitable protection for data in transit and at rest, including encryption where appropriate to the processing and risk. Recordings and other private records must not be exposed by unprotected public storage or unrestricted shared links. Limit the content of alerts and summaries to their authorised purpose.
6.4 Disclosures and instructions. Deliver the required disclosure accurately; prevent unauthorised changes to its required content; keep a durable record of material configuration and permission changes; and operate approval limits for consequential actions and instruction updates. Preserve the privacy-information route and appropriate escalation options.
6.5 Messaging controls. Check feature state, recipient eligibility, timing, permissions, suppression and disclosed spending conditions before a send. Apply incident-based deduplication and suitable rate limits. Protect replies, route preference instructions correctly and stop queued recovery sends when the relevant feature is disabled.
6.6 Resilience and response. Maintain appropriate backup, recovery, monitoring and incident procedures; test restoration and security effectiveness proportionately to risk; preserve relevant incident evidence; and respond to identified vulnerabilities and personal data breaches. These controls do not amount to an unagreed uptime or restoration-time guarantee.
6.7 Retention and individual rights. Operate appropriate retention and deletion controls across active records, recordings, derived instructions and subprocessors; protect backup information pending expiry; apply outstanding deletions after restoration; and support secure, appropriately verified searches and exports for individual rights.
6.8 Staff and supplier governance. Ensure relevant confidentiality commitments, training and operating procedures; assess appointed suppliers; limit their purposes and access; and maintain the information needed to demonstrate compliance. Actual measures must be documented and made available as required by Schedule 1.
7 Additional agreed particulars
7.1 Any agreed special-category use, additional jurisdiction, location restriction, higher security commitment, permitted additional retention or country-specific processing condition must be recorded in an appropriate written annex before it applies. It must not reduce a mandatory protection or give permission for an otherwise unlawful activity.