Data processing agreement
Last updated: November 2026
When Future Ready processes personal data for a customer, the customer is the controller and we are the processor. Our data processing agreement is clause 7 of the Terms of Service. This page summarises it.
Roles
You are the controller and decide why and how personal data is processed. We are the processor and act only on your documented instructions. We are an independent controller only for the contact details we need to run the agreement, and for technical and usage data.
Scope of processing
We process what we need to deliver the modules you order: calls and transcripts, calls made by AI voice agents, call outcomes, evaluations of your users' calls, and contact details from your systems and call lists. Recordings are deleted as soon as they are transcribed, and voice is never used to identify anyone.
Where data is processed
Data is stored in AWS Europe (Stockholm). As a starting point, personal data is stored and processed in the EU/EEA. Where a sub-processor works outside the EU/EEA, the sub-processor list on our Security page shows who, and on what transfer basis.
Security measures
We apply technical and organisational measures under Article 32, including removal of personal data from transcripts, encryption in transit and at rest, least-privilege access, audit logging and independent testing. We may update them, but never in a way that materially lowers security. Details are on our Security page.
Sub-processors
You give us a general authorisation to use sub-processors, each bound by a data processing agreement with equivalent obligations. We notify you at least 30 days before adding one. You may object in writing, and if we cannot agree, you may terminate the affected module.
Assistance and data-subject rights
We help you respond to data-subject requests and meet your obligations under Articles 32 to 36. Help beyond the service's self-service functions is charged at our hourly rates, unless it is needed because of our own breach.
Breach notification
We notify you without undue delay after becoming aware of a personal data breach.
Audits
We first give you our audit and certification reports, including our ISO 27001 and ISO 27701 certificates. If that is not enough, you may audit us with at least 30 days' written notice.
Return and deletion
When the agreement ends, you can retrieve your data for 30 days. We then delete it, no later than 90 days after the end, and from backups no later than 35 days after that. We confirm the deletion in writing on request.
The full text
The full data processing agreement is clause 7 of our Terms of Service.
Contact
Questions about this policy or your data? Email our data protection team.