Data processing agreement

This Data Processing Agreement (the “Agreement”) is entered into between the customer holding an account with Threll (the “Controller” or the “Customer”) and Threll.ai AS, Org. no. 935 054 702, Vulkan 16, 0178 Oslo, Norway (the “Processor” or “Threll”). The Agreement is intended to meet the requirements of Article 28 of the General Data Protection Regulation (GDPR) and forms part of the terms of service.

01Parties and Background

The Customer uses the Threll platform for AI-powered telephone calls, transcription, summarization and workflows (the “Service”). When the Customer uses the Service, Threll processes personal data on behalf of the Customer. The Customer is the controller of that data and Threll is the processor.

The Agreement applies from the moment the Customer begins using the Service and for as long as Threll processes personal data on behalf of the Customer. In the event of any conflict between the Agreement and the terms of service, the Agreement prevails with respect to the processing of personal data.

02Definitions

The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given to them in Article 4 of the GDPR. “Data Protection Legislation” means the GDPR, the Norwegian Personal Data Act (personopplysningsloven) and any other applicable data protection legislation in Norway and the EEA. “Supervisory Authority” means the data protection authority competent for the Customer, such as Datatilsynet in Norway, Integritetsskyddsmyndigheten (IMY) in Sweden or Datatilsynet in Denmark.

03Purpose, Nature and Scope

Threll processes personal data solely to provide the Service to the Customer, as described in the terms of service and as configured by the Customer. The categories of data subjects and personal data processed are set out in Appendix A.

The Customer’s configuration of the Service constitutes the Customer’s documented instructions. This includes, among other things, which calls are conducted, which scripts and documents are used, which integrations are connected and how long recordings, transcripts and caller details are retained.

04Obligations of the Controller

The Customer is responsible for ensuring that the processing has a valid legal basis and that data subjects receive the information required by Data Protection Legislation. This includes informing the people on the call, where applicable, that the call is recorded, transcribed and analysed. The terms of service set out the Customer’s obligations regarding AI transparency and telemarketing.

The Customer shall not instruct Threll to process personal data in breach of Data Protection Legislation. Nor shall the Customer use the Service to process special categories of personal data (Article 9 of the GDPR) unless the Customer has a valid basis for doing so and has assessed the risks involved, including by carrying out a data protection impact assessment (DPIA) where required.

05Obligations of the Processor

Threll shall:

• process personal data only on the Customer’s documented instructions, including with regard to transfers to countries outside the EEA, unless required to do so by EEA or Norwegian law to which Threll is subject. In that case, Threll shall inform the Customer of that legal requirement before the processing, unless that law prohibits it;
• immediately inform the Customer if Threll considers that an instruction infringes Data Protection Legislation;
• ensure that persons authorized to access the personal data are bound by a duty of confidentiality;
• assist the Customer in fulfilling data subjects’ rights under Chapter III of the GDPR, including the rights of access, rectification and erasure. Requests received directly by Threll shall be forwarded to the Customer without undue delay;
• assist the Customer in complying with the obligations under Articles 32–36 of the GDPR, including security, personal data breach notification, data protection impact assessments (DPIAs) and prior consultation with the Supervisory Authority;
• not use the Customer’s personal data for its own purposes, including for training or improving AI models, without the Customer’s prior written consent. Collection of call audio for such purposes is switched off for every account unless the Customer has given that consent.

06Information Security

Threll shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. The measures are set out in Appendix C. Threll may change the measures, provided that the level of security is not reduced.

07Personal Data Breaches

Threll shall notify the Customer without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting the Customer’s personal data.

The notification shall, to the extent possible, describe what has occurred, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed to be taken. Where not all information is available at once, Threll shall provide it in phases as it becomes available. The Customer is responsible for any notification to the Supervisory Authority and to the data subjects.

08Sub-processors

The Customer grants Threll general prior authorization to engage the sub-processors listed in Appendix B. Threll shall enter into written agreements with sub-processors that impose the same data protection obligations as this Agreement, and remains liable to the Customer for the sub-processors’ performance of their obligations.

Threll shall notify the Customer by email at least 30 days before engaging a new sub-processor or replacing an existing one. The Customer may object in writing on reasonable data protection grounds within that period. If the parties cannot reach agreement, the Customer may terminate the Service with effect from the date the change takes effect, and Threll shall refund prepaid fees for the period after termination.

09Transfers to Countries Outside the EEA

The Customer’s personal data is stored in the EEA. Some sub-processors are established in, or belong to groups with parent companies in, countries outside the EEA, and may process or access personal data from there. Such transfers take place only where a valid transfer mechanism exists under Chapter V of the GDPR, namely an adequacy decision, such as the decision on the EU-US Data Privacy Framework (DPF), or the European Commission’s Standard Contractual Clauses (SCCs) together with any supplementary measures required. Appendix B states the location and transfer mechanism for each sub-processor.

If Threll receives a legally binding request from a public authority for access to the Customer’s personal data, Threll shall notify the Customer unless prohibited by law, disclose no more than required, and challenge requests that Threll considers unlawful.

10Audits and Access to Information

Upon request, Threll shall make available to the Customer the information necessary to demonstrate compliance with the Agreement and Article 28 of the GDPR. The Customer may conduct an audit, including an inspection, either itself or through an independent auditor bound by a duty of confidentiality, no more than once per year. At least 30 days’ prior notice of the audit shall be given, unless there is a personal data breach or a specific reason to suspect non-compliance. The Customer shall bear its own costs of the audit.

11Deletion and Return of Data

For the duration of the customer relationship, the Customer may itself delete the recording and the transcript of individual calls, delete a threll together with all its calls, and set retention periods for recordings, transcripts and caller details within the options of its plan. Where no retention period is set, the data is kept until the Customer deletes it or the customer relationship ends.

When the customer relationship ends, Threll shall, at the Customer’s choice, delete the Customer’s personal data or return it. The Customer can download recordings and transcripts in the Service before closing its account. If Threll ends the customer relationship, the Customer may request an export within 14 days. Threll deletes or anonymizes the data no later than 14 days after the customer relationship has ended or, if the Customer has requested an export, after the export has been delivered, unless EEA or Norwegian law requires it to be retained. Encrypted backups are overwritten within 30 days.

12Liability

This Agreement does not limit either party’s liability to data subjects under Article 82 of the GDPR. As between the parties, the limitations of liability in the terms of service apply, also to claims under this Agreement.

13Term and Amendments

The Agreement remains in force for as long as Threll processes personal data on behalf of the Customer. Threll may update the Agreement to reflect changes in legislation or in the Service. The Customer will be notified of material changes by email at least 30 days in advance. If the Customer does not accept a material change, the Customer may terminate the Service before the change takes effect, and Threll shall refund prepaid fees for the period after termination. The current version is always available in the Threll account and at threll.ai.

14Governing Law and Jurisdiction

The Agreement is governed by Norwegian law. Disputes shall be settled by the Oslo District Court (Oslo tingrett) as the exclusive venue.

15Appendix A – Description of the Processing

• Purpose: Conducting inbound and outbound telephone calls with AI assistants, transcribing, summarizing and analysing calls, and performing tasks in the Customer’s connected systems.
• Categories of data subjects: Persons who call or are called by the Customer via the Service, the Customer’s contacts and customers, and the Customer’s employees and users.
• Categories of personal data: Name, telephone number, email address and other contact details; audio recordings, transcripts, summaries and analyses of calls; information provided during the call; documents and knowledge bases uploaded by the Customer; and data from integrations such as CRM and calendar systems.
• Special categories: Processed only if the Customer configures the Service to do so, or if data subjects themselves disclose such data during the call.
• Duration: For the duration of the customer relationship, within the retention periods set by the Customer, and thereafter as described under “Deletion and Return of Data”.

16Appendix B – Sub-processors

• Amazon Web Services (Sweden): Cloud infrastructure, storage, computing, telephony switching and email (Amazon SES), in Stockholm. The parent company is in the USA; SCCs and the EU-US DPF.
• Supabase (Sweden): Database and authentication, stored in Stockholm. The contracting entity is in Singapore; SCCs.
• Google Cloud – Gemini Enterprise Agent Platform (EU): AI models, speech recognition and speech synthesis, processed in Google’s EU regions. The parent company is in the USA; SCCs and the EU-US DPF.
• Munin (Netherlands): Customer support by chat and email, processed in the EU. Covers anything the Customer shares in support conversations.
• RunPod (EU): Speech recognition (Whisper) on servers in the EU. RunPod is a US company; SCCs.
• Telenor SIP trunk (Norway): Telephony.
• Twilio (Ireland/USA): Relaying the audio of calls made in the browser when a direct connection is not possible (TURN). The audio is encrypted end to end, so Twilio sees only IP addresses and connection data. SCCs and the EU-US DPF. Customers who connect their own Twilio account have their own agreement with Twilio for those calls.
• Telenor AI Factory (Norway): AI compute capacity.
• Vercel (Sweden/USA): Hosting of the web application. Web requests are handled in Stockholm; account data and logs are processed in the USA. SCCs and the EU-US DPF.
• Vipps MobilePay (Norway): Identity verification during calls, for Customers who enable it.

17Appendix C – Security Measures

• Personal data is stored in data centres in Stockholm, Sweden;
• encryption of data at rest, covering both the database and file storage;
• encryption of data in transit using TLS 1.2 or higher;
• separation of customers’ data enforced in the database by row-level security;
• role-based access control, with the Customer controlling which users have access to what, and multi-factor authentication available to users;
• access to the production environment restricted to authorized personnel on a need-to-know basis;
• automatic deletion of recordings, transcripts and caller details according to the Customer’s retention settings;
• logging, monitoring and alerting of systems and access;
• encrypted daily backups stored in Stockholm and retained for up to 30 days;
• regular security reviews.

18Contact

Questions regarding the Agreement or the processing of personal data may be directed to: