Document Ops was withdrawn from new sales on 7 June 2026. References to Document Ops apply only where an existing agreement names that service.
These documents can support software, AI, automation, integrations, consultancy, configuration, support, managed telephony/receptionist and website work expressly agreed in an Order Form. Listing a service category does not mean it is already live or included in your service. The Order Form and, where required, DPA Schedule must identify the actual scope, dependencies and data processing before work starts.
1 · Roles + scope
The Controller (you) determines the purposes and means of processing the personal data submitted to the Service. The Processor processes such personal data solely on the Controller's documented instructions, as set out in this DPA, the Master Service Agreement (Terms of Service), and the applicable Order Form.
This DPA is entered into pursuant to Article 28 of Regulation (EU) 2016/679 ("GDPR") + the Irish Data Protection Acts 1988-2018.
2 · Subject matter, duration, nature, purpose
- Subject matter: only the personal-data processing for the Service(s) expressly named in the Order Form and completed DPA Schedule. This can include calls, website submissions or specifically agreed software, AI, automation, integration and consultancy work; legacy Document Ops requires an existing agreement.
- Duration: the term of the active Order Form, plus any post-termination retention period set out in §4.
- Nature: only the collection, access, use, transformation, storage, transmission, review, export or deletion operations specifically documented in the applicable Schedule. Voice answering, AI assistance, workflow automation, integration or support is enabled only where included in that Schedule.
- Purpose: the customer business purpose recorded in the completed Schedule, limited to the agreed service. The Schedule states the data subjects, data types, duration and instructions; an uncompleted service category is not a processing instruction.
3 · Hosting, providers and retention
The receptionist backend is hosted on Hetzner infrastructure in Germany. Voice processing and other configured third-party services may process data outside the EEA. EU storage does not mean that the complete service operates only in the EU.
The applicable Schedule and Order Form must identify the actual processing, providers, locations and retention settings before Customer Personal Data is processed. Provider-held audio, transcripts, logs and backups are separate copies; their retention is not inferred from the archive's expiry rule. Demo/admin storage is separate from a customer's agreed retention profile.
International transfers must meet Chapter V GDPR. See §14.
4 · End of service and data return
Cancellation and notice terms are set out in the Order Form and Terms §7.
At the Controller's choice, CallMeIE will delete or return Customer Personal Data after the processing service ends and delete existing copies, unless Union or Member State law requires storage. The agreed procedure must cover provider copies and backups, and any legally required retention must be identified. This summary does not promise a blanket seven-day export or thirty-day purge of every system.
5 · Sub-processors
CallMeIE will not engage another processor without the Controller's prior specific or general written authorisation. With general authorisation, CallMeIE will inform the Controller of intended additions or replacements so that the Controller can object before engagement. Any agreed notice period is recorded in the Order Form.
CallMeIE will impose the same data-protection obligations on each sub-processor by contract, including sufficient guarantees for appropriate technical and organisational measures, and remains fully liable to the Controller for that sub-processor's performance of those obligations under Article 28(4) GDPR.
The service-specific list and provider contract coverage must be confirmed before processing; the privacy notice describes provider roles.
6 · Security measures
CallMeIE will implement appropriate technical and organisational measures required by Article 32 GDPR, taking account of the processing and its risks. The signed Schedule records the service's access controls, transport protection, storage and backup controls, tenant separation, logging and recovery arrangements.
A product feature or an intended monitoring target is not a security guarantee. Human support is asynchronous and scheduled unless a different service level is agreed. Statutory breach-notification duties remain separate from support windows.
7 · Liability
Commercial liability terms are governed by the applicable Order Form and Terms §8. Nothing in this DPA limits duties or liability that cannot lawfully be limited, including applicable Article 82 GDPR rights.
8 · Processor identity
The Processor is Adam Vaughan trading as CallMeIE, a sole trader operating in Ireland. Contact: hello@callmeie.ie. The applicable Order Form identifies the contracting parties.
CallMeIE business-name registration: Companies Registration Office number 784516. The individual remains the contracting Processor.
Provider address: 40 Gouldavoher Estate, Limerick, V94 HWH7, Ireland. Telephone: +353 85 786 3564.
9 · Confidentiality
CallMeIE ensures that every person it authorises to process the personal data — whether an employee, director or contractor — is bound by an enforceable duty of confidentiality (by written contract or by a statutory obligation) and processes the data only on the Controller's documented instructions. This satisfies Article 28(3)(b) GDPR.
10 · Assisting you with data-subject rights
Taking account of the nature of the processing, CallMeIE assists the Controller by appropriate technical and organisational measures, insofar as possible, to fulfil the Controller's obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR (access, rectification, erasure, restriction, portability and objection). Where a data subject contacts CallMeIE directly, CallMeIE forwards the request to the Controller without undue delay and does not respond to it itself unless instructed by the Controller. This satisfies Article 28(3)(e) GDPR.
11 · Personal-data breaches, security and impact assessments
CallMeIE assists the Controller in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it. In particular:
- Breach notification. CallMeIE will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and will provide reasonable information available to assist the Controller with its obligations.
- Security. CallMeIE maintains the technical and organisational measures required by Article 32, as set out in §6 of this DPA.
- DPIAs and prior consultation. CallMeIE provides reasonable assistance to the Controller with any data-protection impact assessment (Article 35) and any prior consultation with the Data Protection Commission (Article 36) that relates to the processing under this DPA.
This satisfies Article 28(3)(f) GDPR.
12 · Audits and information
CallMeIE makes available to the Controller all information necessary to demonstrate compliance with the obligations in Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Audits take place on reasonable prior written notice, no more than once per year except where required by a supervisory authority or following a personal-data breach, and are conducted so as not to disrupt the provision of the Services to other customers. CallMeIE may satisfy an audit request by providing an up-to-date third-party certification or audit report where one is available. This satisfies Article 28(3)(h) GDPR.
13 · Unlawful instructions
CallMeIE immediately informs the Controller if, in its opinion, an instruction from the Controller infringes the GDPR or other Union or Irish data-protection law. This satisfies the final paragraph of Article 28(3) GDPR.
14 · International transfers
CallMeIE processes Customer Personal Data only on the Controller's documented instructions, including instructions concerning international transfers, unless required by Union or Member State law. CallMeIE will inform the Controller of that legal requirement before processing unless the law prohibits it on important public-interest grounds.
Before a transfer requiring a Chapter V safeguard, the applicable provider, recipient, processing locations and lawful transfer mechanism must be recorded in the signed Schedule. An adequacy decision applies only where its conditions are met; Standard Contractual Clauses apply only where the appropriate clauses are actually in place. This page does not certify providers, claim automatic fallback to SCCs, or guarantee no non-EEA processing.
Schedule A · AI Receptionist
Data subjects: the customer's callers. Data can include incoming number, caller-provided information, audio, transcripts, routing and call outcomes, and any agreed booking or message details. Processing includes answering, retrieving approved information, routing, reporting and agreed service checks.
The signed Schedule identifies the enabled operations, voice/model/telephony providers, hosting and processing locations, transfer safeguards and separate retention periods for each data type and provider copy. Customer data is not authorised for general-purpose model training by this DPA. The business customer determines the caller-facing lawful basis and notices.
Special-category data is not enabled merely because a customer operates in healthcare. Any required processing must be specifically assessed and documented before activation.
Schedule B · Document Ops (legacy)
Data subjects: people identified in the customer's accounting documents. Data can include names, addresses, contact and payment details, invoice fields, extracted results and reviewer corrections. Processing includes extraction, review and agreed export.
The signed Schedule records hosting, extraction/model providers, any international transfers and retention. A customer's obligation to retain tax records does not automatically require CallMeIE to store every document for six years. Public sandbox processing must be disclosed separately; this DPA does not certify zero logging or third-country processing.
Do not submit special-category data unless its processing has been specifically assessed and agreed.
Schedule C · Websites
Data subjects: visitors and people submitting forms to the customer's website. Data can include form contents, network/security logs and consented analytics information. Processing includes hosting, form delivery and the agreed analytics configuration.
The signed Schedule records the enabled hosting, CDN, form/email, analytics and payment providers, their locations and transfer arrangements, and retention periods or criteria. Analytics consent and any special-category forms require site-specific configuration; neither is enabled by default through this DPA.
Schedule D · Other agreed software, AI, automation, integrations and consultancy
Complete this Schedule with the Order Form before processing. Record the parties and roles, subject matter, duration, nature and purpose; categories of data subjects and personal data; permitted inputs, outputs and actions; AI/human review; providers and their roles; processing locations and transfer safeguards; access, security and recovery controls; retention for each relevant copy; data-subject assistance and return/deletion procedures.
Only documented instructions for the agreed engagement authorise processing. A general service description does not permit new data uses, general-purpose model training, regulated advice, significant automated decisions or unapproved external actions. Special-category or criminal-offence data requires a separately assessed and agreed lawful arrangement.
The existing duties in sections 1-14 apply to this Schedule. Additional services or processing changes must be documented before activation; mentioning future capability does not establish a live configuration.
Get the full DPA
Email hello@callmeie.ie to arrange the DPA and service-specific Schedule. They must be agreed before customer personal data is processed.