Data Processing Addendum

The Controller determines the purposes and means of processing the personal data it submits to the Service. The Processor processes that data only on the Controller’s documented instructions (including as set out in this DPA and the Service’s configuration).

Hosting, storing, transcribing, synthesizing, scoring, and displaying simulated sales calls and related coaching, for the purpose of training the Controller’s personnel.

• Data subjects: the Controller’s users (reps, managers, admins).
• Personal data: account details (name, email, role); voice recordings and transcripts of simulated calls; AI-generated scorecards; uploaded files; usage and technical logs; and account activity logs (sign-in/sign-out events, IP address, and device/browser derived from the User-Agent).
• Special categories: the Service is not intended to process special- category data. Voice recordings are of simulated calls and are not used for biometric identification.

The Controller authorizes the Processor to engage subprocessors to provide the Service. The current categories are: (a) cloud hosting, database, storage, and authentication; (b) speech-to-text and text-to-speech; and (c) large-language-model inference. A current list of named subprocessors is available on request. The Processor remains responsible for its subprocessors’ performance and will impose data-protection obligations on them no less protective than those in this DPA, and will give notice of intended changes so the Controller may object.

The Processor ensures persons authorized to process the data are bound by confidentiality and implements appropriate technical and organizational measures, including access controls enforced at the database layer, private storage with short-lived signed access, encryption in transit, and role-based access.

Taking into account the nature of the processing, the Processor will assist the Controller by appropriate measures to respond to data-subject requests (access, correction, deletion, portability, restriction), insofar as possible.

The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller’s data, and will provide information reasonably available to assist the Controller’s own obligations.

Where processing involves transfers across borders, the parties will rely on a lawful transfer mechanism (such as standard contractual clauses) as applicable.

By default, voice recordings and uploaded files are automatically deleted after up to 12 months (configurable by the Controller); transcripts and scorecards are retained as coaching history. On termination of the Service, the Processor will delete or return the Controller’s personal data (at the Controller’s choice) and delete existing copies, except where retention is required by law.

The Processor will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, subject to reasonable confidentiality and security conditions.

To request the named subprocessor list, exercise audit rights, or execute the binding DPA, contact your SalesSim representative, or Crown Media Service at lewisvillamor@crownmediasvc.com.