Terms & Conditions

Appendix – Data Processing Agreement (DPA)

This Data Processing Agreement (“Agreement”) is entered into under Article 28 of Regulation (EU) 2016/679 (GDPR) between Reached LLC (the “Processor”) and the User (the “Customer” or “Controller”). It forms an integral part of these Terms and is accepted by the Customer when creating its account.

Article 1 — Parties

Reached LLC, a company registered in the State of Wyoming (United States), 30 N Gould St, Ste N, Sheridan, WY 82801, publisher of the Reached solution, acts as Processor for the personal data processed on the Customer’s behalf. The Customer acts as Controller.

Article 2 — Purpose and term

This Agreement sets out the conditions under which Reached processes personal data on the Customer’s behalf in connection with the Reached service (outbound calling, call recording, transcription and CRM synchronization). It takes effect on the date the Customer accepts it and remains in force for the whole contractual relationship. It ends automatically upon termination of the service, subject to Article 15.

Reached also acts as controller for its own processing activities (account management, billing, support, service security, complaint handling), which are not covered by this Agreement and are described in the Privacy Policy.

Article 3 — Nature and purposes of processing

On the Customer’s behalf, Reached performs the following processing: storage and management of imported contacts and leads; management of prospecting campaigns and calls; recording of outbound calls; automatic call transcription, where enabled; AI-generated call summaries and briefs; synchronization of data with connected CRMs; call logging (date, duration, outcome and notes); reporting and analysis of sales activity. The nature of processing includes collection, storage, organization, consultation, transmission, recording and deletion.

Article 4 — Categories of data and data subjects

Categories of data: identification data (first name, last name, job title, company); contact details (phone numbers, email addresses); interaction data (call audio recordings, transcripts, summaries, notes); professional data (industry, position, LinkedIn profile); technical data (usage and connection logs).

Data subjects: the Customer’s prospects and professional contacts, consumers contacted by the Customer with their consent, and service users designated by the Customer.

No special-category data within the meaning of Article 9 GDPR is processed as part of the service. The Customer must not upload any.

Article 5 — Reached’s obligations as Processor

Reached undertakes to: process personal data only on the Customer’s documented instructions, including regarding transfers outside the European Union; ensure the confidentiality of the data and that authorized persons are bound by confidentiality obligations; implement the security measures described in Article 9 and Schedule 1; use sub-processors only under the conditions of Article 8; notify the Customer of any data breach under Article 11; assist the Customer with its obligations under Articles 10 and 12; delete or return the data at the end of the service under Article 15; keep a record of the categories of processing carried out on the Customer’s behalf; make available the information needed to demonstrate compliance and allow the audits provided for in Article 13; promptly inform the Customer if, in its opinion, an instruction infringes the GDPR.

Article 6 — Customer’s obligations as Controller

The Customer undertakes to:

• give Reached clear and lawful instructions;

• ensure that data provided to Reached was lawfully collected and relies on a valid legal basis (legitimate interest for B2B; prior consent for B2C, unless a legal exception applies) and keep proof of that legal basis;

• inform data subjects that Reached is used to process their data;

• inform people called of the recording, its purpose and their right to object;

• honor every objection to prospecting and exclude the people concerned from its campaigns;

• comply with the calling rules described in Section 4 of these Terms, including prior consumer consent, calling days and hours, frequency limits, caller identification rules and, in the United States, the TCPA, the FTC’s TSR rule and Do Not Call lists;

• provide Reached, within 24 hours, with proof of the legal basis of any call subject to a complaint or report, in accordance with Section 7 of these Terms;

• comply with its obligations as controller under the GDPR and any other applicable data protection law.

Article 7 — Data location and transfers

Data is hosted in the European Union (Paris). Some sub-processors listed in Schedule 2 process data in the United States. These transfers are covered by the European Commission’s standard contractual clauses or by the EU–US Data Privacy Framework where the sub-processor is certified. Call recordings are stored by Twilio in the European Union (Germany). Where the Customer is subject to other data protection laws, including the UK GDPR or the Swiss FADP, Reached applies equivalent safeguards, including the UK Addendum to the standard contractual clauses.

Article 8 — Sub-processors

The Customer authorizes Reached to use the sub-processors listed in Schedule 2. Reached imposes on its sub-processors data protection obligations equivalent to those of this Agreement and remains liable to the Customer for their performance. Reached informs the Customer of any addition or replacement of a sub-processor with reasonable prior notice, allowing the Customer to raise reasoned objections.

Article 9 — Data security

Reached implements technical and organizational measures appropriate to the risk, detailed in Schedule 1.

Article 10 — Data subject rights

If a data subject exercises their GDPR rights directly with Reached (access, rectification, erasure, restriction, portability, objection), Reached informs the Customer without undue delay so that the Customer can respond. Reached assists the Customer, through appropriate technical and organizational measures, in responding to such requests within a reasonable time.

Article 11 — Personal data breaches

In the event of a personal data breach, Reached notifies the Customer within 72 hours of becoming aware of it, in accordance with Article 33 GDPR. The notification includes at least: the nature of the breach; the categories and approximate number of data subjects concerned; the data concerned; the likely consequences; the measures taken or planned to remedy it.

Article 12 — Assistance to the Customer

To the extent reasonable and taking into account the nature of the processing, Reached assists the Customer with its obligations relating to security, breach notification, data protection impact assessments (DPIAs) and prior consultation with the supervisory authority.

Article 13 — Audit

The Customer may audit Reached’s compliance measures once a year, subject to 30 days’ prior written notice, to not compromising the security or confidentiality of other customers’ data, and to a reasonable scope and frequency. Reached may first provide its compliance documents, including this Agreement and its schedules, to limit the need for on-site audits.

Article 14 — Retention periods

Unless otherwise instructed in writing by the Customer or required by law, data is retained for the following periods: