Data Processing Addendum
Effective Date: October 10, 2026
1. Scope and Incorporation
This Data Processing Addendum (“DPA”) forms part of, and is incorporated by reference into, the Terms of Service or other written agreement (the “Agreement”) between RingFuze Technologies LLC, doing business as Calladhere (“RingFuze,” “we,” or “us”), and the customer entity that has agreed to the Agreement (“Customer”).
This DPA applies to the extent RingFuze processes Customer Personal Data that is subject to Applicable Privacy Law in providing the Service. It takes effect automatically when Customer accepts the Agreement, without the need for a separate signature, and remains in effect for as long as RingFuze processes Customer Personal Data. Customers that require a countersigned copy may request one at compliance@calladhere.com.
Capitalized terms not defined in this DPA have the meanings given in the Agreement.
2. Definitions
“Applicable Privacy Law” means all U.S. state consumer privacy laws that apply to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act of 1999, as amended by the California Privacy Rights Act of 2020, and its regulations (“CCPA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Texas Data Privacy and Security Act (“TDPSA”), and similar laws, each as amended.
“Customer Personal Data” means personal data or personal information, as defined by Applicable Privacy Law, that Customer or its users submit to the Service, or that RingFuze otherwise processes on Customer’s behalf under the Agreement.
“Business Purpose” means providing, maintaining, securing, supporting, and improving the Service for Customer, as described in the Agreement and this DPA, and the other business purposes permitted for service providers and processors under Applicable Privacy Law.
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data in RingFuze’s possession or control.
“Subprocessor” means any third party engaged by RingFuze that processes Customer Personal Data on RingFuze’s behalf in providing the Service.
The terms “business,” “service provider,” “controller,” “processor,” “consumer,” “sell,” “share,” “processing,” and “deidentified” have the meanings given in Applicable Privacy Law.
3. Roles of the Parties
With respect to Customer Personal Data, Customer is the business or controller (or, where Customer processes data on behalf of another business, such as an insurance carrier, a service provider or processor to that business), and RingFuze is Customer’s service provider, contractor, or processor (or subprocessor, as applicable).
RingFuze acts as an independent business or controller for account, billing, and website data it collects for its own purposes, which is governed by our Privacy Policy and not by this DPA.
Customer is responsible for (a) providing all notices and obtaining all consents, authorizations, and rights required under Applicable Privacy Law and other laws to permit RingFuze to process Customer Personal Data under the Agreement, including call recording consents described in our Call Recording & Consent Notice; (b) the accuracy and lawfulness of Customer Personal Data and the means by which it was obtained; and (c) ensuring its instructions comply with Applicable Privacy Law.
4. Processing Instructions and Details
Instructions. RingFuze will process Customer Personal Data only on Customer’s documented instructions. The Agreement, this DPA, and Customer’s configuration and use of the Service (including integrations Customer enables, audit configurations, and retention settings) constitute Customer’s complete instructions. RingFuze will inform Customer if, in its opinion, an instruction violates Applicable Privacy Law, and may suspend the affected processing until the instruction is modified.
Subject matter. Provision of the Service to Customer under the Agreement.
Duration. The term of the Agreement, plus any period after termination until Customer Personal Data is deleted or returned in accordance with Section 12.
Nature and purpose. Hosting and storage of call recordings, documents, and records; speech-to-text transcription; AI-assisted compliance auditing and analysis; human quality assurance review workflows; reporting and analytics; forms and e-signatures; API access; customer support; and security and quality assurance of the Service.
Categories of personal data. For insured individuals and prospects: name, date of birth, email address, phone numbers, postal address, Medicare Beneficiary Identifier, Medicare Part A and Part B dates, special enrollment period details, policy number, carrier, plan, dependent information (including gender), contact preferences, call audio, transcripts, and AI audit results. For Customer’s users and agents: name, email address, role, organization, agent identifiers, performance and audit data, and multi-factor authentication status. Technical data: IP address, user agent, activity log events, and e-signature records.
Categories of data subjects. Customer’s consumers, insured individuals, prospects, and their dependents or representatives who appear in calls or records; Customer’s users, agents, and personnel; and other individuals whose information appears in content Customer submits.
Sensitive data. Customer Personal Data may include health and insurance information and government identifiers. Where such data is PHI, Section 13 applies.
5. Service Provider and Processor Obligations
RingFuze will process Customer Personal Data only for the Business Purpose and in compliance with Applicable Privacy Law. Without limiting the foregoing, RingFuze will not:
(a) sell or share Customer Personal Data;
(b) retain, use, or disclose Customer Personal Data for any purpose (including any commercial purpose) other than the Business Purpose, or as otherwise permitted for service providers under Applicable Privacy Law;
(c) retain, use, or disclose Customer Personal Data outside the direct business relationship between Customer and RingFuze; or
(d) combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as expressly permitted by Applicable Privacy Law.
RingFuze will provide the same level of privacy protection as required of Customer by Applicable Privacy Law, and will notify Customer if it determines that it can no longer meet its obligations under Applicable Privacy Law. Upon such notice, or if Customer reasonably believes RingFuze is processing Customer Personal Data in an unauthorized manner, Customer may take reasonable and appropriate steps to stop and remediate the unauthorized processing, including by suspending the affected data flows.
If RingFuze receives deidentified data from Customer or creates it from Customer Personal Data, RingFuze will take reasonable measures to ensure it cannot be associated with an individual, publicly commit to maintain and use it only in deidentified form, and not attempt to reidentify it, except as permitted by law. RingFuze does not use Customer Personal Data to train its own or third-party foundation models.
RingFuze certifies that it understands and will comply with the restrictions in this Section 5.
6. Confidentiality of Personnel
RingFuze will ensure that each person it authorizes to process Customer Personal Data is subject to a duty of confidentiality, whether contractual or statutory, and that access is limited to personnel who need it to provide, support, secure, or evaluate the quality of the Service.
7. Security Measures
RingFuze will implement and maintain reasonable administrative, technical, and physical security measures appropriate to the nature of Customer Personal Data and designed to protect it against Security Incidents. These measures include encryption in transit, encryption at rest provided by our infrastructure providers, role-based access controls, organization-level tenant isolation, and activity logging, as further described in our Security Overview. RingFuze may update its security measures from time to time, provided that updates do not materially reduce the overall protection of Customer Personal Data.
Customer is responsible for its own secure use of the Service, including managing user access, configuring roles and permissions, protecting credentials and API keys, and enabling multi-factor authentication for its users.
8. Subprocessors
Authorization. Customer grants RingFuze general authorization to engage Subprocessors. Information about RingFuze’s Subprocessors is provided to Customer under the Agreement.
Subprocessor obligations. RingFuze will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than those in this DPA, to the extent applicable to the services provided, and will remain responsible for each Subprocessor’s performance of those obligations.
Notice of changes. RingFuze will notify Customer of any new Subprocessor at least 30 days before the new Subprocessor begins processing Customer Personal Data, by email to Customer’s administrative contact or through the Service, except where an emergency replacement is required to maintain the security or availability of the Service, in which case RingFuze will notify Customer as soon as reasonably practicable.
Objection. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing compliance@calladhere.com within the notice period. The parties will work together in good faith to address the objection. If they cannot resolve it within a reasonable time, Customer may terminate the affected portion of the Service by written notice.
Third-party integrations that Customer chooses to enable (such as dialers, CRMs, or spreadsheet integrations) are not Subprocessors. Data exchanged with them is processed on Customer’s instruction and under Customer’s own agreements with those providers.
9. Assistance with Consumer Requests and Assessments
Consumer requests. Taking into account the nature of the processing, RingFuze will provide reasonable assistance, including through features of the Service, to enable Customer to respond to consumer requests to exercise rights under Applicable Privacy Law, such as requests to know, access, correct, delete, or obtain a copy of personal data. If RingFuze receives such a request directly and identifies Customer as the relevant business, RingFuze will promptly forward the request to Customer or direct the consumer to Customer, and will not respond substantively except as instructed by Customer or required by law.
Assessments. RingFuze will provide information reasonably available to it to help Customer conduct data protection assessments, risk assessments, and cybersecurity audits required by Applicable Privacy Law, to the extent Customer cannot reasonably obtain that information through the Service or our published documentation.
10. Security Incident Notification
RingFuze will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the Security Incident, the categories of data affected, and the steps RingFuze is taking to contain and remediate it, and RingFuze will provide updates as more information becomes available.
RingFuze will take reasonable steps to contain, investigate, and mitigate the Security Incident and will reasonably cooperate with Customer so that Customer can meet any notification obligations it has under applicable law. RingFuze’s notice of a Security Incident is not an acknowledgment of fault or liability.
11. Audits and Information Requests
Upon Customer’s written request, no more than once per year, RingFuze will make available information reasonably necessary to demonstrate its compliance with this DPA and Applicable Privacy Law, such as written responses to reasonable security and privacy questionnaires and relevant documentation of its practices.
If that information is insufficient to satisfy Customer’s obligations under Applicable Privacy Law, Customer may, no more than once per year, on at least 30 days’ written notice and at Customer’s expense, conduct a reasonable assessment of RingFuze’s compliance, or have one conducted by a qualified, independent assessor bound by confidentiality obligations. Any assessment will be conducted during normal business hours, in a manner that does not unreasonably disrupt RingFuze’s operations or compromise the security or confidentiality of other customers’ data, and subject to a mutually agreed scope.
Additional audits may be conducted where required by a regulator or following a Security Incident affecting Customer Personal Data. Information provided under this Section is RingFuze’s confidential information.
12. Deletion, Return, and Data Location
During the term. Customer can delete Customer Personal Data and configure recording retention periods through the Service.
After termination. Customer may export Customer Personal Data before the Agreement terminates. After termination, upon Customer’s written request, RingFuze will delete or return Customer Personal Data within 60 days, except for data held in backups (which roll off in the ordinary course) and data RingFuze is required to retain by law. Any retained data remains subject to this DPA for as long as it is retained.
Data location. RingFuze processes and stores Customer Personal Data in the United States. Web traffic may be routed through a global content delivery network to deliver the application.
13. Relationship to Other Agreements and Liability
Business Associate Agreement. To the extent Customer Personal Data is PHI subject to HIPAA and Customer has executed a Business Associate Agreement with RingFuze, the BAA governs the processing of that PHI and controls over this DPA in the event of conflict. See our HIPAA & Business Associate Agreement page.
Order of precedence. Subject to the preceding paragraph, if there is a conflict between this DPA and the Agreement regarding the processing of Customer Personal Data, this DPA controls. In all other respects, the Agreement governs.
Liability. Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Agreement, and this DPA does not create any separate or additional liability cap.
Changes in law. RingFuze may update this DPA to the extent reasonably necessary to comply with changes in Applicable Privacy Law, by posting the updated version on this page. No update will materially reduce the protections afforded to Customer Personal Data.
14. Contact Us
For questions about this DPA, to request a countersigned copy, or to object to a Subprocessor, contact compliance@calladhere.com. For privacy requests, contact privacy@calladhere.com. To report a security concern, contact security@calladhere.com. For contract notices, contact legal@calladhere.com.
RingFuze Technologies LLC (dba Calladhere)
3770 Shaw Ave, Suite 102-226
Clovis, CA 93619
USA