Data Processing Agreement (DPA)

Data Processing Agreement (DPA)

according to art. 28 GDPR

Date of publication for the current version: November 2, 2026

Data controller

For data processing responsible client

(hereinafter referred to as the client)

Data processor
Talkturo LLC
2261 Market Street STE 22180
San Francisco, CA 94114
United States
(hereinafter referred to as the contractor)

Unless otherwise agreed between the Client and the Contractor, this Data Processing Agreement forms an integral part of the Contractor’s General Terms and Conditions, which are available at https://www.talkturo.com/terms. This Data Processing Agreement applies between the Client and the Contractor whenever the Contractor processes personal data on behalf of the Client in connection with the provision of its services.

1. BACKGROUND AND SPECIFICATION OF DATA PROCESSING

1.1 The contractor is a company that offers the following services:

• Configuration, Management, and Deployment of an AI Telephony Assistant via the Talkturo Web App

1.2 The client is a company that plans to use the contractor's services in the areas specified.

1.3 This Data Processing Agreement specifies the conditions for the processing of personal data by the contractor with the client's approval in accordance with the General Data Protection Regulation (GDPR). The contractor acts as a processor within the GDPR's definition.

2. NATURE, PURPOSE, OBJECT, AND LEGAL BASIS OF DATA PROCESSING

2.1 The Contractor’s services are described in the Contractor’s General Terms and Conditions (GTC), which can be accessed at https://www.talkturo.com/terms

2.2 In the course of providing services, the client shall provide the contractor with the personal data required for the provision of services in the appropriate manner in each case, for example, by electronic or physical means, via discussions and analyses, the performance of other contractually regulated activities, verbally, or via software tools.

2.3 Personal data may be processed, in particular, by organizing, arranging, storing, and, if necessary, adapting or modifying, querying, linking, restricting, deleting, combining, copying, hiding, connecting, analyzing, reading, receiving, sending, and updating, insofar as this is necessary for the provision of the agreed services.

2.4 The purpose of the processing is the contractually agreed provision of services to the client.

2.5 The Contractor is not obliged to verify the lawfulness of the client's underlying data processing.

3. CATEGORIES OF PERSONAL DATA AND DATA SUBJECTS CONCERNED

3.1 As part of the agreed services, several categories of personal data may be processed. In particular, this can be the following categories:

• Log data
• Communications Data
• Information that you send us by e-mail
• Contact data
• Telephony metadata
• Configuration data
• Technical Information
• Appointment data
• AI prompts and other AI-related information
• Telephone numbers
• Cookies and similar technologies
• Payment data
• Personal preferences
• IP Address
• Identifying Data
• Audio Voice Data
• Browser information
• Data on user behavior and interactions
• Invoice data
• Error-related technical data
• Device Information
• Phone-conversation data
• All data that conversation participants themselves introduce in the course of the conversation with the AI
• User behavior relevant for error analysis
• Technical authentication data (e.g., API keys)
• Transaction data
• Information you provide as free text
• Authentication data
• Data related to service quality
• Subscription related data

3.2 In general, the processing covers all special categories of personal data (Art. 9 GDPR) necessary for the provision of the agreed services. In particular, the following special categories of personal data may be processed in connection with the provision of the agreed services (for example, for healthcare providers):

• Health data

3.3 In general, all categories of data subjects necessary for the provision of the agreed services are covered by the processing. In particular, this includes the following categories of data subjects:

• Customers
• Third parties under contract with the Client
• Employees of the Client
• Customers of the Client's customers
• Partners of the Client
• Suppliers of the Client

3.4 Given the nature of the agreed services, the client acknowledges that the contractor cannot review or maintain the list of categories of data subjects. Therefore, the client shall inform the contractor of any necessary changes to the list of categories of data subjects.

3.5 The contractor shall process the client's personal data regarding all data subjects listed above in accordance with the agreed services. If, due to changes to the list of categories of data subjects, changes to the agreed processing operations become necessary, the client shall issue additional instructions to the contractor accordingly.

3.6 No Voice Identification or Voice Verification

(a) The contractor does not perform voice identification or voice verification in connection with the agreed services. In particular, it does not create, store, or compare voice profiles ("voiceprints", voice templates) and does not deploy technical methods aimed at the unique identification of, or cross-conversation recognition of, a natural person on the basis of their voice. Audio voice data is processed exclusively for voice input and output as well as for transcription (speech-to-text/text-to-speech). A technically necessitated distinction between conversational contributions within a single conversation (e.g., separating caller and assistant) does not serve identification and does not enable recognition beyond the respective conversation.

(b) According to the contractor's own understanding, the audio voice data processed therefore does not constitute biometric data for the purpose of uniquely identifying a natural person within the meaning of Art. 4 No. 14, Art. 9 para. 1 GDPR. Point 3.6(a) contains a statement of fact, point (b) a legal opinion of the contractor; no warranty or representation in the legal sense is associated with it. The data-protection classification, in the individual case, of the processing operations initiated by the client is the responsibility of the client as controller; Point 2.5 remains unaffected.

(c) This is without prejudice to the fact that the processing may, for other reasons, comprise special categories of personal data within the meaning of Art. 9 GDPR, in particular health data (Point 3.2), and that the content of conversations may allow inferences to be drawn as to such data.

4. TERMS AND CONDITIONS OF DATA PROCESSING

4.1 The contractor shall comply with all requirements of the GDPR during the entire provision of services.

4.2 The contractor shall only process personal data based on written instructions in the form of a contract with the client. Deviations from these instructions require the client's prior written consent.

4.3 The contractor processes the personal data in accordance with the principle of data minimization pursuant to Art. 5 para. 1 lit c GDPR and therefore only to the extent necessary to provide the agreed services.

4.4 Access to the client's personal data is only granted to individuals who require this access due to contractual or legal obligations.

4.5 All individuals on the contractor's side who have access to the client's personal data shall be obliged to maintain confidentiality. In particular, the duty of confidentiality of the individuals entrusted with data processing shall remain even after termination of their activity with the contractor.

4.6 The contractor shall implement and maintain all suitable, appropriate, and state-of-the-art technical and organizational measures to ensure the availability, confidentiality, and integrity of personal data. A list of the agreed technical and organizational measures is attached to this data processing agreement in Appendix 1.

4.7 The contractor shall support the client in complying with its obligations under the GDPR, in particular with regard to the rights of data subjects.

4.8 Unless otherwise required by law, the contractor shall inform the client immediately if it receives information or notification from a data subject, the data protection supervisory authority, or another authority or a third party, and this information or notification is directly or indirectly related to the processing of personal data under this Data Processing Agreement.

4.9 In the context of the contracted data processing, the contractor shall support the client—to the extent required by law—in the creation and updating of the record of processing activities, in the performance of the data protection impact assessment, and, if required, in prior consultations with the data protection supervisory authority within the meaning of Art. 36 GDPR. The contractor shall provide all necessary details and information for this purpose. In addition, the contractor shall maintain its own record of processing activities and, if required, carry out data protection impact assessments and appoint a data protection officer.

4.10 The contractor shall inform the client immediately, but at the latest within 24 hours, if the personal data provided to the contractor has been used unlawfully and/or the data subjects are at risk of harm. The contractor shall provide the client with all necessary information so that the Client can fulfill its reporting obligations to the data subjects in accordance with data protection laws.

4.11 Any transfer of personal data by the contractor to a third country or international organization shall be in accordance with Union or national law and must, in particular, comply with the provisions of the GDPR.

4.12 The parties may agree in Appendix 2 on other clauses concerning the provision of the personal data processing service, as long as they do not contradict directly or indirectly this data processing agreement or prejudice the fundamental rights or freedoms of the data subject and the protection afforded by the GDPR.

4.13 The contractor shall immediately inform the client if it believes that an instruction from the client violates data protection regulations of the Union or the Member States.

5. SUB-PROCESSORS

5.1 Depending on the contractually agreed service provision, a dedicated approved list of subprocessors is involved in the data processing.

5.2 The use of subprocessors may result in data being transferred to third countries. The contractor shall ensure that the requirements of Articles 44–49 GDPR are complied with when transferring personal data to third countries and shall inform the client of the guarantees used in each case (e.g., standard contractual clauses, adequacy decision).

5.3 A list of sub-processors approved by the client upon conclusion of the agreement is included in Appendix 3.

5.4 A contract shall be concluded between the Contractor and the subprocessors in accordance with Art. 28 (4) GDPR. The subcontract shall take into account the data protection requirements to the same extent as those agreed between the client and the contractor in this agreement, and data processing may only be carried out for the purpose specified in the separately contracted service.

5.5 The contractor shall regularly check that subprocessors comply with the data protection obligations applicable under this data processing agreement. If, in the course of this check, the contractor becomes aware that the subprocessor is not fulfilling, or is not sufficiently fulfilling, the data protection obligations incumbent upon it under this data processing agreement, it shall immediately inform the client without being asked to do so.

5.6 The outsourcing to subprocessors or / the change of the existing subprocessors is permissible insofar as:

• the contractor announces such subcontracting to subprocessors at least two weeks in advance in writing or in text form, and
• the client does not raise any objections to the planned outsourcing in writing or in text form within two weeks of receipt of the announcement, or, in the case of the first-ever transfer of data to the contractor, at the latest by that point in time. In the event of an objection to the planned involvement of a subprocessor, the latter may not be used until an agreement has been reached. A change within the meaning of this point also includes the expansion of the scope of use of a subprocessor already named, in particular the addition of a further processing location in a third country.

6. AUDIT AND COMPLIANCE

6.1 The contractor shall permit the client or its designated representatives to conduct audits and inspections to verify compliance with the terms of this Data Processing Agreement. Such audits shall be conducted with reasonable advance notice and shall not unreasonably interfere with the contractor's operations. The client is aware that any inspections of sub-processors must be coordinated directly with these sub-processors, and that the contractor has no influence on the conditions applied.

The client shall bear the costs of conducting the audit, unless the audit reveals a serious breach of this Data Protection Agreement by the contractor.

6.2 Any third-party auditors shall be subject to confidentiality agreements.

6.3 The contractor shall provide the client with all necessary information and work with the client to demonstrate compliance with the GDPR.

7. DURATION AND TERMINATION OF CONTRACT

7.1 This Data Processing Agreement shall remain in force for the duration of the data processing activities and shall terminate upon completion of the provision of the services or as otherwise agreed by the parties.

7.2 Upon termination of the Data Processing Agreement (or at any time prior thereto at the client's request), the contractor shall, at the client's discretion, either destroy the processed personal data (including any copies) itself or hand them over to the client in their entirety, provided that this does not conflict with any statutory obligation to retain them. The contractor shall continue to guarantee compliance with these clauses until the data is deleted or returned. If the client does not comment on the procedure, the contractor shall destroy the data 30 days after termination of the agreement, subject to statutory obligations to retain the data.

7.3 The contractor shall arrange the destruction or handover of data by any sub-processors.

8. FINAL CLAUSES

8.1 Amendments and supplements to this data processing agreement and all its components require a written agreement, which may also be in an electronic format (text form), and the express indication that it is an amendment or supplement to this data processing agreement. This also applies to the waiver of this formal requirement.

Clause 2.3 of the Terms and Conditions (amendment by fictitious consent) does not apply to this Agreement and its Appendices.

8.2 This Data Processing Agreement is governed by the law that also governs the underlying main agreement (terms and conditions).

8.3 In case individual provisions of this Data Processing Agreement become invalid or unenforceable, the remainder of the Data Processing Agreement shall remain unaffected. These provisions shall be deemed to be replaced by valid and enforceable provisions that best achieve the economic purpose intended by the contracting parties.

Appendix

Appendix 1: Technical and Organisational Measures(TOMs)

Technical Measures

• Service operation in an ISO 27001-Certified Data Center: The Talkturo app is operated in an ISO 27001-certified data center.
  Third-party security certifications, such as ISO 27001, provide evidence that an organization has met a specific standard of information security management. They are an important element in building trust with customers and partners.
• Physical Security / Access Control to Office Premises: Office premises are adequately protected against unauthorized entry, are closed outside business hours, and visitors may enter only with constant escort/accompaniment.
  Protecting office premises from unauthorized access and ensuring that external persons are constantly accompanied helps protect personal data within office spaces.
• Strict Separation of Production and Test Environments: Production and testing environments are strictly segregated at both the logical and infrastructural levels. The processing of actual production data (live personal data) within staging environments is strictly prohibited. If data is required for testing purposes, it must be completely anonymized or synthetic data must be used.
  The strict separation of environments ensures that software development and testing activities do not impact the stability or security of live systems. Prohibiting the use of production data in non-production environments prevents accidental data leaks, since development environments typically lack the stringent security controls found in production systems.
• Firewalls: Firewalls monitor and control inbound and outbound network traffic, allowing only necessary, explicitly authorized connections.
  Firewalls are network security systems that monitor and control incoming and outgoing network traffic based on predefined security rules. They establish a barrier between trusted internal network segments and untrusted external networks, such as the internet.
• State-of-the-Art Network Protocols and Configurations: Secure, state-of-the-art network protocols and configurations are deployed as hardening measures to protect data during transmission.
  Secure network protocols, such as correctly configured, TLS-based HTTPS, provide security controls—including encryption during data transmission—and help safeguard data in transit.
• Network Monitoring: Network activities are continuously monitored to detect and respond to security threats.
  Network monitoring is a critical IT process in which all network components, such as routers, switches, firewalls, servers, and VMs, are continuously monitored and evaluated for faults, security incidents, and performance issues to maintain and optimize their availability. Early detection of issues or security incidents can prevent unexpected downtime.
• System Hardening: Hardening measures are applied to all relevant systems through secure configuration based on CIS Benchmarks and/or the provider's recommendations.
  A secure system configuration means setting up systems and software to reduce the risk of exploitation by malicious actors. This includes measures such as disabling unnecessary services, establishing appropriate user permissions, and keeping systems up to date.
• Malware Protection: Anti-malware measures have been implemented to protect systems and data from malicious software. This includes installing and operating malware detection software on relevant systems, as well as monitoring and handling alerts triggered by potentially detected threats.
  Anti-malware measures involve deploying software tools to detect and remove malicious software that could compromise system security and data integrity.
• Patch Management Process: All software and hardware components are regularly updated through a dedicated patch management process to protect against known vulnerabilities. Patches are applied at varying intervals depending on the system type, at least once per quarter, and immediately if a patch addresses a critical vulnerability.
  Regular updates to software and hardware ensure protection against known vulnerabilities. Updates often include patches for security flaws discovered since the last version of the software or hardware.
• Identity & Access Management (IAM) and Lifecycle Processes: A centralized Identity and Access Management (IAM) system is implemented alongside a structured "Joiner-Mover-Leaver" (JML) process.
  An integrated IAM and JML process ensures that user identities, access rights, and permissions are managed systematically throughout the entire employment lifecycle—from onboarding (Joiner), to internal role changes (Mover), to offboarding (Leaver). Upon termination of employment or contract, all access privileges to personal data and internal systems are revoked automatically and immediately. It effectively mitigates the risk of "privilege creep" and prevents unauthorized access by former employees or external contractors.
• Authorization Concept: Strict access controls have been implemented based on the "Need-to-Know" and "Least Privilege" principles regarding personal data. Where feasible and appropriate, multi-factor authentication (MFA) is implemented, and the mandatory use of password managers and randomly generated passwords with a minimum length of 20 characters is required. Administrative privileges are granted in accordance with the dual-control principle and may only be used for legitimate purposes. The use of administrative privileges is monitored.
  Access controls are measures that define who is permitted to access specific resources, such as personal data. They are crucial for preventing unauthorized access and ensuring that only authorized individuals can access data.
• Limitation of Administrative Activities to Qualified Personnel: Only specifically trained, qualified, and authorized personnel may perform administrative tasks on infrastructure components. Authorization is granted strictly based on verified technical competence, and administrative users are required to complete regular, documented security-related training for administrative activities.
  Restricting administrative access to verified experts ensures that critical system modifications are only executed by competent individuals. This minimizes the risk of security vulnerabilities, misconfigurations, or accidental data loss caused by human error or a lack of technical expertise.
• Session Management and Automatic Timeout: User and administrator sessions within the application and internal administrative systems are automatically terminated after a predefined period of inactivity.
  Automatic session timeouts mitigate the risk of unauthorized data access if a workstation or mobile device is left unattended in an unsecure environment.
• Handling of Credentials and Other Sensitive Information: To secure access to personal data, two-factor authentication (2FA) is utilized. Credentials and other sensitive information are stored in a password manager. All access points to the password manager are encrypted.
  Two-factor authentication adds an extra layer of security by requiring users to provide two forms of identification before accessing data. This makes it significantly harder for unauthorized individuals to gain access.
• Password Management Tools: Password management tools are used to create, store, and manage secure passwords for systems and applications in accordance with internal password policies.
  Password management tools help users generate, store, and manage unique, complex passwords for different accounts, thereby reducing the risk of password reuse and improving overall password security.
• Data Encryption: Stored data (Data at Rest) and data in transit (Data in Transit) are encrypted in compliance with industry best practices to protect them from unauthorized access.
  Data encryption ensures that sensitive data is stored and transmitted in encrypted form on the storage medium, protecting it from unauthorized access, particularly in the event of theft or loss of the medium.
• Data Pseudonymization: Data pseudonymization techniques are used to reduce the risk of data breaches.
  Pseudonymization is a de-identification procedure in which personal identification fields within a dataset are replaced by one or more artificial identifiers or pseudonyms to protect data privacy.
• Audit Logs: Audit logs are maintained to record who accessed which personal data and when. Further, security-relevant logs are stored immutably.
  Audit logs record when users access systems and data. This can be crucial in the event of a security incident, as it helps trace actions and identify potential perpetrators.
• Regular Backups: Data is regularly backed up where necessary and appropriate to prevent data loss.
  Regular data backups are crucial to prevent data loss during incidents such as data breaches or technical failures. They ensure that even in the worst-case scenario, the organization can restore data and maintain business continuity.
• Automated Vulnerability Scanning: Automated internal and external vulnerability scans are performed regularly across all infrastructure components, applications, and network segments.
  Automated scanning complements periodic penetration testing by providing real-time detection of newly discovered security vulnerabilities and misconfigurations, allowing for swift patch remediation.
• Penetration Testing: Penetration tests are conducted regularly to identify potential vulnerabilities in systems.
  Penetration tests, also known as pen tests, are simulated cyberattacks on information systems and IT environments to identify vulnerabilities that can be exploited. The process includes gathering information about the target prior to the test, identifying potential entry points, attempting to breach them, and reporting back the findings.

Organizational Measures

• Information Security Policies: Information security policies are established and are regularly reviewed and updated.
  Information security policies set the framework for what is expected from employees and systems regarding information security. Regularly reviewing and updating these policies ensures they remain effective and relevant in light of the evolving security landscape.
• Data Protection Officer (DPO): A Data Protection Officer (DPO) has been appointed to monitor compliance with the GDPR.
  A Data Protection Officer (DPO) is responsible for overseeing a company's data protection strategy and its implementation to ensure compliance with GDPR requirements. The DPO serves as the point of contact for the company, data subjects, and supervisory authorities.
• Privacy by Design and Privacy by Default: The principles of Privacy by Design and Privacy by Default are adhered to.
  Privacy by Design and Privacy by Default refer to integrating data protection into processing activities and business practices, from the design phase throughout the entire lifecycle. This helps ensure that data protection is not an afterthought but is embedded into the design and architecture of IT systems and business practices.
• Data Minimization Principle: The principle of data minimization is respected; only the personal data required to provide the service is collected.
  Data minimization is a key principle of the GDPR. It means that an organization should collect and process only the personal data it needs for its specific purpose.
• Records of Processing Activities (RoPA): We maintain a GDPR-compliant Record of Processing Activities that documents all relevant processing operations, associated data flows, involved third parties, and the respective legal basis for processing.
  A Record of Processing Activities (RoPA) establishes transparency regarding data flows and helps identify potential risks in processing. It further ensures that every processing activity and transfer of personal data is based on a valid legal ground.
• Data Protection Impact Assessments (DPIA) & Transfer Impact Assessments (TIA): Regular Data Protection Impact Assessments as well as Transfer Impact Assessments are conducted to identify and mitigate risks both during processing and when transferring personal data across corporate and national borders.
  Data Protection Impact Assessments (DPIAs) and Transfer Impact Assessments (TIAs) identify, evaluate, and mitigate or minimize data protection risks in data processing. DPIAs are important because they help organizations identify and fix problems early, reducing the associated costs and potential reputational damage that might otherwise occur.
• Vendor Risk Management / Data Processing Agreements: Information security assessments of data processors are conducted, and Data Processing Agreements (DPAs) are concluded to ensure and contractually secure compliance with security standards.
  Information security assessments of data processors are crucial to verify whether third-party service providers or vendors adhere to the same data protection and security standards as the organization. This helps minimize the risk of data breaches or data leaks caused by third parties. According to the GDPR, this must be formalized through a Data Processing Agreement (DPA).
• Data Subject Rights Handling Procedure: A standardized workflow is established to ensure that requests from data subjects—such as the right to access, rectification, or data portability—are verified, processed, and fulfilled within the statutory timelines.
  Establishing a clear internal procedure for data subject rights ensures compliance with GDPR transparency obligations and prevents legal escalations or regulatory complaints.
• Employee Training: Employees receive regular training on data protection and GDPR compliance.
  Regular training ensures that employees are informed about data protection principles and their responsibilities under the GDPR. This can help prevent data breaches caused by human error and ensure that issues are correctly reported and resolved.
• Information Security Awareness Campaigns: Regular campaigns (awareness training) to sensitize users to information security are conducted to educate employees about potential cyber threats.
  Information security awareness campaigns (awareness training) are crucial for educating employees about cyber threats such as phishing, social engineering, and malware, and for promoting data protection best practices.
• Secure Coding Training for Developers: Software developers are regularly offered security training to ensure secure programming practices.
  Regular security training for developers is essential to raise awareness of the latest security threats and best practices for writing secure code, thereby reducing the likelihood of introducing vulnerabilities into the software.
• Deletion Procedures (Data Retention and Erasure): Based on a data deletion concept, personal data is automatically deleted—insofar as legally permissible—once the purpose of the service provision has been fulfilled or if the data subject explicitly requests it (Right to Erasure / Right to be Forgotten).
  The regular deletion of data that no longer serves a purpose is an important component of data management and GDPR compliance. It helps reduce the risk of data breaches and ensures that the organization does not retain personal data longer than necessary.
• Incident Response Plan: A detailed response plan has been established to handle potential data breaches or cybersecurity incidents affecting personal data.
  An incident response plan is a set of instructions that helps identify, respond to, and recover from security incidents. A robust plan is crucial to minimizing the impact of a data breach and enabling rapid recovery.
• Data Breach Notification Procedure: A data breach notification procedure is in place to inform affected data subjects, supervisory authorities, or other relevant parties.
  In the event of a data breach, the GDPR requires organizations to notify affected data subjects and competent supervisory authorities. This procedure enables timely notification and can help mitigate the consequences of a data breach.
• Regular Review of Data Protection Practices: Data protection management practices are reviewed at regular intervals to ensure up-to-dateness and proper implementation, and any deviations are evaluated and addressed.
  Regular reviews of data protection practices ensure that changes in processing or gaps in measures are identified and appropriately addressed, to avoid or, if necessary, detect and remediate deviations from GDPR requirements at an early stage.

Appendix 2: Additional clauses

Version date of this appendix: November 2, 2026

• Neither the contractor nor its subprocessors will use personal data for the training, improvement, or evaluation of AI models.
• The following default retention periods apply:
  • Audio recordings: 30 days from the end of the call
  • Transcripts and summaries of the conversation: 90 days from the end of the call
  • Webchats: 90 days for each message from message creation
  • Webchat-Traces: 14 days
  • Dialog logs and technical logs: 30 days from the end of the call
  • Telephony metadata: 6 months from the end of the call
  • Accounting-related documents: 7-year statutory retention period from the date of issuance
  • Backups: 90 days
  • For any other categories of data, Section 7.2 of this Data Protection Agreement applies
• Provisions Regarding Reseller Partners
  • If this Data Processing Agreement is entered into with a reseller partner, Talkturo will act as a sub-processor for that partner.
  • If the client obtains the services through a reseller partner and the contract between the client and the reseller partner refers to this Data Processing Agreement for processing by the contractor, this Agreement applies directly between the client and the contractor; the preceding provision does not apply in this respect.
  • If the reseller partner provides its own services to the client that involve access to personal data in the client’s account (in particular, support and implementation), it acts directly on behalf of the client in this regard. The client shall enter into the necessary agreement pursuant to Article 28 of the GDPR with the reseller partner.

Appendix 3: Sub-processors

Version date of this appendix: November 2, 2026

Providers always used

The following providers are used as soon as the client uses the contractor's services.

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
  • Description of the service: Hosting of the web app (servers and data center)
  • Processing location: Germany
  • Legal basis for any transfer to a third country: not required, processing takes place in Germany
  • Further information: https://www.hetzner.com/legal/privacy-policy
• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States
  • Description of the service: Hosting of the website and delivery of content (CDN)
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
  • Further information: https://vercel.com/legal/privacy-policy
• Supabase, Inc., United States
  • Description of the service: Database, login, files and call recordings (db1.talkturo.com)
  • Processing location: EU (data center in the European Union)
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
  • Further information: https://supabase.com/privacy
• LiveKit Inc., 4285 Payne Avenue, Suite 9154, CA 95157 San Jose, California, United States
  • Description of the service: Voice connection (virtual conversation rooms); the “Talkturo Fast” models run via the LiveKit Inference API
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
  • Further information: https://docs.livekit.io/deploy/admin/regions/region-pinning/
• Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, D02 H611 Dublin, Ireland
  • Description of the service: Payments, subscriptions, partner payouts
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
  • Further information: https://stripe.com/privacy
• Telnyx LLC, United States
  • Description of the service: Telephony and SMS (“Carrier 1” in the product)
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
  • Further information: https://telnyx.com/privacy-policy
• Twilio Ireland Limited, 25-28 North Wall Quay, D01 H104 Dublin, Ireland
  • Description of the service: Telephony, including the client's own numbers (“Carrier 2” in the product)
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
  • Further information: https://www.twilio.com/docs/global-infrastructure/edge-locations
• Meta Platforms Ireland Ltd., Merrion Road, D04 X2K5 Dublin, Ireland
  • Description of the service: WhatsApp messaging (WhatsApp Cloud API)
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
  • Further information: https://www.facebook.com/privacy/policy
• Nylas, Inc., 2100 Geng Rd. #2100, Palo Alto, CA 94303, United States
  • Description of the service: Email inbox of the assistants and Gmail connection in flows
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
  • Further information: https://developer.nylas.com/docs/dev-guide/platform/data-residency/
• Resend, Inc., United States
  • Description of the service: Transactional emails (summaries, system emails)
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
  • Further information: https://resend.com/legal/privacy-policy
• OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, D01 YC43 Dublin 1, Ireland
  • Description of the service: Knowledge-base embeddings, call summaries, image and document description, speech recognition (Whisper)
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
  • Further information: https://openai.com/enterprise-privacy/
• Cloudflare, Inc., United States
  • Description of the service: Bot protection at sign-in (Cloudflare Turnstile)
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
  • Further information: https://www.cloudflare.com/privacypolicy/
• Google Ireland Limited, Gordon House, Barrow Street, D04 E5W5 Dublin, Ireland
  • Description of the service: Sign in with Google (login)
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
  • Further information: https://policies.google.com/privacy
• Meta Platforms Ireland Ltd., Merrion Road, D04 X2K5 Dublin, Ireland
  • Description of the service: Sign in with Facebook (login)
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
  • Further information: https://www.facebook.com/privacy/policy

The contractor's knowledge base is additionally stored in a database operated by the contractor itself (FalkorDB). As long as it runs on the contractor's own servers, no further processor is involved.

Providers depending on the assistant's configuration

Call audio, transcripts and prompts are transmitted to exactly those of the following providers that the client selects or configures for the respective assistant. For real-time models (a single model for listening and speaking), the separate speech-to-text and text-to-speech providers are not used.

Speech-to-text

• Deepgram, Inc., 548 Market St, Suite 25104, CA 94104-5401 San Francisco, California, United States
  • Description of the service: Speech-to-text (default)
  • Processing location: EU (processing via Deepgram's EU instance)
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
• AssemblyAI, Inc., United States
  • Description of the service: Speech-to-Text
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
• Cartesia AI, Inc., United States
  • Description of the service: Speech-to-Text
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
• Eleven Labs Inc., 169 Madison Ave #2484, NY 10016 New York, New York, United States
  • Description of the service: Speech-to-Text
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
  • Further information: https://elevenlabs.io/docs/overview/administration/data-residency
• Theai, Inc. dba Inworld AI, 1975 W El Camino Real #300, CA 94040 Mountain View, United States
  • Description of the service: Speech-to-Text
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
  • Further information: https://trust.inworld.ai/
• Kugel Audio
  • Description of the service: Speech-to-Text
  • Processing location: Germany and EU
  • Legal basis for any transfer to a third country: Processing in the EU (marked as the EU option in the product)

Text-to-speech

• Cartesia AI, Inc., United States
  • Description of the service: Text-to-Speech
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
• Eleven Labs Inc., 169 Madison Ave #2484, NY 10016 New York, New York, United States
  • Description of the service: Text-to-Speech
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
  • Further information: https://elevenlabs.io/docs/overview/administration/data-residency
• Theai, Inc. dba Inworld AI, 1975 W El Camino Real #300, CA 94040 Mountain View, United States
  • Description of the service: Text-to-Speech
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
  • Further information: https://trust.inworld.ai/
• OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, D01 YC43 Dublin 1, Ireland
  • Description of the service: Text-to-Speech
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
• Alibaba Cloud (DashScope), international endpoint
  • Description of the service: Text-to-Speech
  • Legal basis for any transfer to a third country: EU Standard Contractual Clauses (Module 3); processing via the international endpoint – used only if expressly selected by the client
• Kugel Audio
  • Description of the service: Text-to-Speech
  • Processing location: Germany and EU
  • Legal basis for any transfer to a third country: Processing in the EU (marked as the EU option in the product)
• Fish Audio
  • Description of the service: Text-to-Speech
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)

Language models (LLM)

• OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, D01 YC43 Dublin 1, Ireland
  • Description of the service: LLM
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
• Google Ireland Limited, Gordon House, Barrow Street, D04 E5W5 Dublin, Ireland
  • Description of the service: LLM (Google Gemini)
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
• Anthropic, PBC, United States
  • Description of the service: LLM (Claude)
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
• Cerebras Systems Inc., United States
  • Description of the service: LLM
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
• DeepSeek (China)
  • Description of the service: LLM
  • Legal basis for any transfer to a third country: EU Standard Contractual Clauses (Module 3); third country without an adequacy decision – used only if the client expressly selects this model for the assistant
• Moonshot AI (Kimi, China)
  • Description of the service: LLM
  • Legal basis for any transfer to a third country: EU Standard Contractual Clauses (Module 3); third country without an adequacy decision – used only if the client expressly selects this model for the assistant
• LiveKit Inc., 4285 Payne Avenue, Suite 9154, CA 95157 San Jose, California, United States
  • Description of the service: LLM models behind “Talkturo Fast” (LiveKit Inference)
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)

Real-time models (listening and speaking in one model)

• OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, D01 YC43 Dublin 1, Ireland
  • Description of the service: OpenAI Realtime
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
• Google Ireland Limited, Gordon House, Barrow Street, D04 E5W5 Dublin, Ireland
  • Description of the service: Google Gemini Live
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply

Optional providers (connected by the client)

The following services are used only if the client connects them to the client's own account. The client acts on its own responsibility towards the respective provider; however, data is transmitted there via the contractor.

• HubSpot Ireland Limited, One Dockland Central, Guild Street, D01 R8H7 Dublin, Ireland
  • Description of the service: CRM connection
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
• Calendly LLC, United States
  • Description of the service: Appointment booking
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
• Cal.com (via mcp.talkturo.com)
  • Description of the service: Appointment booking
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
• Close.com
  • Description of the service: CRM connection
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
• Propstack (via mcp.talkturo.com; the data resides with Propstack)
  • Description of the service: Real-estate CRM
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
• Google Ireland Limited, Gordon House, Barrow Street, D04 E5W5 Dublin, Ireland
  • Description of the service: Gmail via Nylas
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply

Other services of the contractor

The following services concern only website visitors, leads and customer contacts of the contractor as well as sign-up and affiliate processes, not call content of the client's customers. They are listed for transparency.

• ActiveCampaign, LLC, United States
  • Description of the service: The contractor's own leads and customer contacts
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
• Crisp IM SAS, France
  • Description of the service: Live chat on the website
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
• Google Ireland Limited, Gordon House, Barrow Street, D04 E5W5 Dublin, Ireland
  • Description of the service: Google Analytics (website visitors)
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
• Meta Platforms Ireland Ltd., Merrion Road, D04 X2K5 Dublin, Ireland
  • Description of the service: Meta Pixel / Conversions API (website visitors)
  • Legal basis for any transfer to a third country: Contracting entity based in the EU; for any intra-group transfers to third countries, EU Standard Contractual Clauses (Module 3) or the EU-US Data Privacy Framework apply
• OpenAI, L.L.C.
  • Description of the service: OpenAI Ads pixel (website visitors)
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)
• Tolt
  • Description of the service: Affiliate attribution
  • Legal basis for any transfer to a third country: EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses (Module 3)

Changes to this list will be announced in accordance with clause 5.6.