Ringby
ProductPricingResourcesAbout
LEGAL

Data Processing Agreement

Last updated: 16 September 2026

1. Parties

This DPA forms part of the Terms of Service between Ringby UK ("Processor") and the Customer ("Controller"). Both parties agree to comply with their respective obligations under UK GDPR, the Data Protection Act 2018, and other applicable data protection laws.

Where the Customer is an agency or reseller. A Customer that runs outbound calling for its own clients is a Controller in its own right for the personal data in its own business, and acts as Controller for the personal data of each end client whose campaigns it runs. For that end-client data, the roles stack: the end client is the Controller, the Customer is the Processor, and Ringby is the Customer's Sub-processor. The Customer must have a written agreement with each end client authorising this processing before it begins. Ringby processes end-client data only on the Customer's documented instructions, under this DPA, and the Customer remains responsible for those instructions being lawful. Where this DPA conflicts with the Customer's agreement with an end client, the more protective obligation applies to us.

2. Scope & Duration

This DPA applies to the processing of personal data by Ringby on behalf of the Customer when providing the Service. It remains in effect for the duration of the Customer's subscription and for a reasonable period afterward to allow for data retrieval or deletion.

3. Categories of Data Processed

  • End User Personal Data. Names, phone numbers, email addresses, and any other personal information disclosed during sales calls.
  • Call Recordings and Transcripts. Audio recordings and AI-generated transcripts and summaries of outbound sales calls made by the Customer's team.
  • Meeting and Follow-up Data. Booked meetings, callbacks, and related communications.

4. Data Subjects

The personal data processed concerns the Customer's prospects, customers, and contacts. Typically business contacts called by the Customer's sales team for outbound prospecting, follow-up, or booked meetings.

5. Processor Obligations

Ringby will:

  • Process personal data only on documented instructions from the Customer, unless required to do otherwise by applicable law.
  • Ensure that persons authorised to process the data are subject to a duty of confidentiality.
  • Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (see Section 8).
  • Not engage any sub-processor without prior notice and the option for the Customer to object.
  • Use automated transcription and summarisation only as instructed to deliver the Service (EU region only, personal details redacted, no model training), with no solely automated decisions about End Users, outputs are for human review.
  • Assist the Customer in fulfilling their obligations regarding data subject rights, data breach notifications, and data protection impact assessments.
  • Delete or return all personal data at the end of the Service, at the Customer's choice.
  • Make available all information necessary to demonstrate compliance with this DPA.

6. Controller Obligations

The Customer will:

  • Ensure that the processing of personal data, and the instructions given to Ringby, comply with applicable data protection laws.
  • Provide required notices for the recording of calls (Ringby plays a recording notice by default), honour objections and opt-outs, and ensure a lawful basis for processing End User personal data through the Service.
  • Provide clear privacy notices to End Users explaining how their data is collected and processed through Ringby.
  • Maintain a record of processing activities under its own responsibility.

7. Sub-processors

The Customer authorises Ringby to engage the following sub-processors:

UK-Based

These providers process data within the UK. No international transfer safeguards are required.

  • Neon. Postgres database hosting (London, UK). Account data, call logs, and service data are stored in Neon's London region.
  • Resend Inc.. Transactional email delivery (USA; all account data, metadata and logs stored in the US under the IDTA below). Email content passes through Resend's infrastructure when sending.

EU-Based

Transfers to the EU benefit from the UK's adequacy decision under UK GDPR.

No EU-only sub-processors beyond those listed under UK-Based with EU operations.

US-Based

Transfers to these providers are safeguarded by the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses.

  • Clerk. Authentication and user identity management (USA).
  • Twilio Inc.. Telephony, call routing, recording and SMS for the calling workspace (USA). Call recordings are pinned to Twilio's EU region. UK number purchases additionally carry regulatory identity verification (business details or photo ID plus proof of address, per number-type rules).
  • HubSpot Inc. (when you connect it). Contact data pulled in; call outcomes, notes and summaries pushed back as CRM engagements (USA). Adding or removing HubSpot does not require a DPA re-sign, see Section 7 change control.
  • Google LLC (when you connect it). Contact lists pulled in from Google Sheets; call dispositions, notes and outcomes pushed back to the same rows (USA). Adding or removing Google Sheets does not require a DPA re-sign, see Section 7 change control.
  • AssemblyAI Inc.. Post-call transcription and summaries (EU region only). Audio and transcripts never leave the EU; personal details are redacted from stored transcripts; nothing is used to train models.
  • Vercel Inc.. Hosting and infrastructure (USA/EU), plus Vercel Web Analytics (cookieless page-view counting) and Speed Insights (Web Vitals) on our marketing site.
  • Stripe Inc.. Seat checkout, billing portal, and subscription webhooks (USA). Card details go directly to Stripe and never touch our servers.
  • Sentry (Functional Software Inc.). Error tracking for website and dashboard (USA/EU). Session replay is disabled.
  • Upstash Inc. Redis-backed rate limiting and abuse prevention (USA).
  • Cloudflare Inc.. CDN, DDoS protection, and Turnstile bot verification (global edge network).
  • Google Workspace. Email hosting and internal collaboration tools (USA/EU).

Ringby will notify the Customer at least 14 days before adding or replacing any sub-processor, giving the Customer an opportunity to object.

8. Technical & Organisational Security Measures

  • Encryption at rest. All data stored in our database is encrypted using AES-256.
  • Encryption in transit. All API traffic is TLS 1.3 encrypted.
  • Access controls. Strict role-based access to production systems. Multi-factor authentication required for all infrastructure access.
  • Incident response. Documented incident response procedures with audit-logged workspace actions for investigation.
  • Regular reviews. Periodic access reviews and dependency updates across hosting, database and identity providers.
  • Data minimisation. We collect and retain only the data necessary to provide the Service.
  • Staff training. All employees receive data protection and security awareness training.

9. Data Retention

Personal data is kept only as long as needed for the purposes below, then deleted automatically or on request:

  • Call recordings. Purged automatically 90 days after the call, from both our references and the telephony provider. Sooner on request.
  • Transcripts and summaries. Stored with your workspace with personal details redacted; deleted with the workspace or on request.
  • Contacts, campaigns and call history. Kept for the life of the workspace; exportable at any time; deleted on workspace closure or request.
  • Do-not-call and suppression lists. Retained while needed to honour opt-outs, including after other data is deleted, as required by PECR.

10. Data Breach Notification

Ringby will notify the Customer without undue delay upon becoming aware of a personal data breach affecting the Customer's data. We will provide reasonable information to assist the Customer in meeting their own breach notification obligations under Article 33 of UK GDPR.

11. Data Subject Rights

Ringby will assist the Customer in responding to data subject requests (access, rectification, erasure, portability, restriction, objection). Where an End User contacts Ringby directly with a request, we will forward it to the Customer promptly.

12. International Transfers

Where personal data is transferred outside the UK or EEA to sub-processors, we have implemented the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as approved by the Information Commissioner's Office. Where necessary, we also carry out Transfer Impact Assessments and implement supplementary measures to ensure an equivalent level of protection.

A copy of the relevant safeguards is available on request.

13. Governing Law

This DPA is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

14. Contact

Data Protection enquiries: dpo@ringby.co.uk