Translation. This is an English translation for your convenience. The Danish version applies; if the two differ, the Danish version prevails.

Data processing agreement

Last updated: 8 October 2026

This agreement forms part of Callster's terms. It applies between the customer (the data controller) and Callster I/S, CVR no. 46808266, Jægerstræde 8, 2690 Karlslunde (the data processor, "Callster"), and meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).

1. Purpose and scope

Callster processes personal data on the customer's behalf in order to deliver Callster: answering the customer's phone, booking, moving and cancelling appointments, taking messages, passing them on to the customer and reading in the systems the customer has connected.

Callster processes the data only on the customer's documented instructions. The instructions are this agreement, the terms and the choices the customer makes in the console and in messages to Callster.

2. Data and data subjects

• Data subjects: the persons who call or write to the customer (telephone, SMS, Messenger and Instagram), and the customer's own customers in the systems the customer connects.
• Types of data: name, telephone number, email address, what the enquiry concerns, bookings and messages, as well as data in the customer's connected systems (e.g. orders and sales).
• Sensitive data: Callster is not intended for sensitive data. A caller may, however, mention health, for example. At clinics, Callster passes such enquiries on and does not write diagnoses in the notes.

3. Callster's obligations

Callster:

• processes the data only on the customer's instructions,
• ensures that everyone with access is subject to a duty of confidentiality,
• has appropriate technical and organisational security measures (section 4),
• assists the customer in responding to requests from data subjects and with data protection impact assessments where relevant,
• notifies the customer without undue delay and no later than 48 hours after discovering a personal data breach,
• makes available the information necessary to demonstrate compliance with this agreement, and allows for audits.

4. Security

• The database is located in the EU (Frankfurt). Data is encrypted in transit and at rest.
• Each business's data is kept separate in the database with access rules per business.
• Keys and sessions for the customer's systems cannot be seen in the console and are used only by Callster's servers. Sessions and API keys are also stored encrypted in a separate vault (Vault).
• Passwords to the customer's own systems are never stored.
• Callster only reads in the customer's systems and changes nothing unless the customer has given permission for that specific action.
• Callster's actions (bookings, messages and changes in the customer's systems) are logged with time and result.
• Audio from calls is recorded only if the customer itself turns on recording. The voice provider deletes calls, including any audio, after 30 days.
• Access for Callster's staff is limited to what is necessary.

5. Sub-processors

The customer gives general authorisation for Callster to use sub-processors within the categories listed in Callster's privacy policy (e.g. hosting, artificial intelligence, voice, telephony and SMS, email and integrations). Callster keeps a list of its sub-processors and sends it to the customer on request. Callster gives the customer at least 30 days' notice before a new sub-processor is engaged, and the customer can object and terminate the agreement.

Callster imposes on the sub-processors the same data protection obligations as in this agreement.

6. Transfers to third countries

Some sub-processors process data outside the EU/EEA, particularly in the USA. Transfers take place only on a valid legal basis for transfer under the GDPR, e.g. the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses.

7. Termination

When the agreement ends, Callster immediately deletes logins and keys to the customer's systems. Callster deletes other personal data no later than 30 days after termination, unless the law requires it to be retained. Before then, the customer can ask us for a copy of its data.

8. Liability and duration

The agreement applies for as long as Callster processes personal data for the customer. Liability is governed by the terms, unless otherwise required by mandatory law.

Contact

Callster I/S, CVR no. 46808266, Jægerstræde 8, 2690 Karlslunde. Email: kontakt@callster.dk.