Data Processing Agreement (DPA)

When phoneless handles data about the people who call your business — for example a name and phone number in a booking or a message — you are the controller and phoneless is the processor. We process this data on your behalf.

This agreement governs that processing and applies together with the terms and the privacy policy.

We process personal data only on your documented instructions and to deliver the service — answering the phone, booking appointments and taking messages. We do not use it for our own purposes.

The processing covers the data the service requires: contact details and the content of the call as needed for the booking or the message.

We use a small, carefully chosen set of subprocessors to deliver the service. The register at the bottom of this page lists every one of them by category, role and processing location; the fully named list is available to customers on request and is set out in the signed version of this agreement.

If we add or replace a subprocessor that processes personal data, we notify you in advance, so you have the opportunity to respond before the change takes effect.

Data is encrypted both in transit and at rest: the database encrypts all content with AES-256 at rest, and all traffic runs over encrypted connections (TLS). Each account only sees its own data — calls, bookings and settings are isolated per business.

A more detailed overview of the security measures is on the trust page.

See security and trust

We assist you in meeting your obligations under the GDPR, including with requests from data subjects and by giving you the information you need to document that the processing is in order.