Data Processing Agreement

1. Parties and roles

For the personal data your widget collects from your own visitors, you are the data controller and OTOWOTO is the data processor acting on your instructions. For your own account data, OTOWOTO is the controller — that processing is described in our Privacy Policy, not here.

OTOWOTO acts as processor under this DPA. Where a signed counterpart is requested, OTOWOTO’s full legal name and registered address are stated on that counterpart; request one at [email protected].

If you use OTOWOTO on behalf of a company, you confirm you are authorised to enter into this DPA for that company.

2. What we process, and for how long

• Subject matter and purpose: providing the OTOWOTO widget, callback and lead-capture service described in the Terms.
• Duration: for as long as your account is active, plus the short retention period set out in the Privacy Policy.
• Nature of processing: collection, storage, transmission, display and deletion, carried out by automated means.
• Categories of personal data: phone number, country, consent flags, IP address, a browser-generated device identifier, call metadata (time, duration, outcome, optional rating), and any data you choose to put into your own widget content.
• Categories of data subjects: the visitors to your website who interact with your widget.

We do not record calls, and we do not use your visitors’ data to build profiles or to train models.

3. Processing only on your instructions

We process this personal data only on your documented instructions, which include these Terms, this DPA, and the settings you choose in your dashboard. If we are ever required by law to process it otherwise, we will tell you before doing so unless that law forbids the notice.

If we believe an instruction you give us would breach applicable data-protection law, we will tell you.

4. Confidentiality

Everyone we authorise to process this personal data is bound by a duty of confidentiality, and access is limited to those who need it to run and support the service.

5. Security

We apply appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit, hashed passwords, access controls, rate limiting, and a security log of account actions that records the event rather than the value.

Security is a moving target, so these measures may change over time — but they will not be reduced below the level of protection described here.

6. Sub-processors

You give us general authorisation to engage sub-processors. The current list, with each provider’s role, location and purpose, is published at otowoto.com/subprocessors and forms part of this DPA.

We impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

We will give at least 30 days’ notice before adding or replacing a sub-processor. You may object on reasonable grounds relating to data protection; if we cannot resolve your objection, you may terminate the affected subscription without penalty.

7. Helping you answer your visitors’ requests

Your visitors exercise their rights with you, not with us. Taking into account the nature of the processing, we will help you respond — by appropriate technical and organisational measures and as far as is possible.

In practice most requests need no help from us: you can view, export and delete lead and call data yourself from your dashboard at any time. If you need more, email [email protected].

8. Helping you meet your other obligations

We will provide reasonable assistance with your obligations under Articles 32 to 36 GDPR — security of processing, breach notification to the authority and to data subjects, data protection impact assessments, and prior consultation — taking into account the nature of the processing and the information available to us.

9. Deletion or return at the end

When your account or a site is closed, we delete the personal data we process on your behalf, or return it to you if you ask before deletion, unless applicable law requires us to keep it. Deleting a site deletes its leads and call records with it.

You can also export your data at any time while the account is open.

10. Audit and information

We will make available the information reasonably necessary to demonstrate compliance with this DPA, and will contribute to audits — including inspections — conducted by you or an auditor you appoint.

Audits are on reasonable prior notice, no more than once a year unless a supervisory authority requires otherwise or we have suffered a breach affecting your data, during business hours, and subject to confidentiality. Answering documented questions is usually faster for both of us and we will always offer that first.

11. International transfers

Our providers may process personal data outside your country, including outside the EEA, the UK, or Türkiye. Where they do, transfers rely on appropriate safeguards — the European Commission’s Standard Contractual Clauses (SCCs), the UK Addendum where the UK GDPR applies, or an adequacy decision.

For customers subject to the KVKK, we undertake to transfer personal data abroad only on a basis permitted by Article 9 of the KVKK, and to provide the written undertakings that basis requires on request.

The current location of each provider is listed at otowoto.com/subprocessors.

12. Personal data breach

If we become aware of a personal data breach affecting the data we process for you, we will notify you without undue delay, with the information you need to meet your own notification duties, and we will keep you updated as we learn more.

13. Order of precedence and contact

If this DPA conflicts with the Terms of Service, this DPA prevails for the processing it covers. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.

To request a signed counterpart, ask a question, or raise a concern: [email protected].