Accordo sul trattamento dei dati

This Addendum applies to personal data in Customer Content and Visitor Data that Crescelo ("Crescelo", the processor or service provider) processes for the customer ("Customer", the controller or business) through the service. Terms such as "personal data", "controller", "processor", "data subject" and "personal data breach" have the meanings in the GDPR and, where relevant, the UK GDPR, the CCPA/CPRA and similar laws ("Data Protection Laws").

For personal data of the Customer’s own team members and billing contacts, Crescelo acts as a controller as described in its Privacy Policy.

• Subject matter and purpose: hosting, indexing and processing Customer Content so the Customer’s assistants can answer visitors, book appointments, capture leads, hand conversations to people and deliver data to the Customer’s connected tools.
• Duration: the term of the agreement plus the deletion period in section 9.
• Categories of data subjects: the Customer’s website visitors, callers, leads and customers; the Customer’s staff.
• Types of personal data: names, contact details, messages and voice content, appointment details, IP address and device data, and any other data the visitor chooses to provide. The Customer must not submit special-category data.
• Nature of processing: storage, retrieval, transmission, analysis by AI models, and deletion.

Crescelo will process personal data only on the Customer’s documented instructions, which are these Terms, this Addendum, and the Customer’s use and configuration of the service, unless the law requires otherwise (in which case Crescelo will tell the Customer beforehand where permitted). Crescelo will tell the Customer if it believes an instruction breaches Data Protection Laws. The Customer confirms it has a lawful basis and has given all required notices to process the data, including that visitors are told they are talking to an AI.

Crescelo will ensure that people authorised to process personal data are bound by confidentiality and only access it as needed to provide the service.

Crescelo will keep appropriate technical and organisational measures, including: encryption of data in transit between users and the application; encryption of stored provider keys and secrets; hashed passwords; logical separation of each Customer’s data by workspace with access checks on every request; optional two-factor sign-in; rate limiting and bot protection; access, audit and error logging (metadata only); least-privilege access for personnel; and regular review of dependencies and configuration.

The Customer gives general authorisation for Crescelo to use the sub-processors listed at /subprocessors, including the AI model provider the Customer connects. Crescelo will bind sub-processors to data-protection terms no less protective than this Addendum and remains responsible for their performance. Crescelo will post any new sub-processor on that page at least 14 days before it starts processing Customer personal data; the Customer may object on reasonable data-protection grounds within that period, and if the parties cannot resolve it the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.

Taking into account the nature of the processing, Crescelo will reasonably help the Customer to respond to data-subject requests (the dashboard lets the Customer export and delete conversations, leads and documents), and to meet its obligations on security, breach notification, impact assessments and prior consultation. Crescelo may charge reasonable fees for assistance that goes beyond the normal operation of the service.

Crescelo will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer personal data, and will give the information it has to help the Customer meet its own notification duties, updating it as the investigation continues.

On termination the Customer may export its data for 30 days. After that Crescelo will delete Customer personal data within a further 30 days, except copies that the law requires it to keep (which stay protected) and backups, which are overwritten in the normal rotation. On request Crescelo will confirm deletion in writing.

Crescelo will give the Customer the information reasonably needed to show compliance with this Addendum and will allow and contribute to audits, including inspections, by the Customer or its appointed auditor, on reasonable written notice, no more than once a year (unless a regulator requires otherwise or after a breach), during business hours, under confidentiality and at the Customer’s cost.

Crescelo may process personal data in countries outside the Customer’s. Where personal data subject to the GDPR is transferred to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated by reference, with: clause 7 (docking) included; clause 9(a) option 2 (general authorisation, 14 days’ notice); clause 11 optional language omitted; clause 17 option 1 governed by the law of Ireland; clause 18 courts of Ireland; Annex I as sections 2 and 3 above with the Customer as exporter and Crescelo as importer; and Annex II as section 5 above. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum is incorporated in the same way. For Swiss transfers the same clauses apply with references read as to Swiss law.

Where the CCPA/CPRA or similar law applies, Crescelo is a service provider/processor: it will not sell or share personal data, will not retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in this Addendum, will not combine it with other data except as the law permits, will comply with applicable obligations and give the same level of protection, and will tell the Customer if it can no longer meet its obligations.

If this Addendum conflicts with the Terms on data protection, this Addendum prevails. Liability under it is subject to the limits in the Terms, except where the law or the Standard Contractual Clauses provide otherwise. Send questions or a signed copy request through https://www.crescelo.com/support/contact. Last updated September 24, 2026.