Annex I
(Annex I to the Data Processing Agreement)
This Annex forms part of the Data Processing Agreement between SantaClues (Processor) and the Controller.
1. Subject Matter of the Processing
The subject matter of the processing is the provision of the SantaClues sales coaching platform, which enables:
- Real-time transcription of sales calls;
- Analysis of transcript content using rule-based systems and large language model (LLM) providers;
- Generation of coaching insights, scoring, and performance metrics;
- Storage and display of transcripts and related data;
- Export of reports and user data upon request.
2. Nature and Purpose of the Processing
The processing consists of:
- Receiving audio streams from the Controller’s users;
- Transcribing audio into text;
- Storing transcript content in a database;
- Analysing transcript content using automated systems, including LLM providers;
- Logging processing interactions for operational integrity and troubleshooting;
- Generating metrics, triggers, and coaching outputs;
- Enabling dashboards, reports, and exports;
- Enabling deletion and data subject access requests.
The purpose of processing is to provide performance coaching, analytics, and related services to the Controller and its authorised users.
SantaClues does not independently determine the purposes of processing beyond providing the Services.
3. Duration of the Processing
Processing shall continue for the duration of the Agreement.
Personal Data is retained in accordance with the retention schedules described in Annex II (Technical and Organisational Measures), including:
- Transcript and primary content retention (standard 30 days unless deleted earlier);
- Prompt log retention (database: 30 days; file-based logs: 7 days);
- Backup retention (7-day rolling retention);
- Export files retained temporarily and deleted after download or expiry.
Deletion from active production systems occurs in accordance with these schedules or upon valid deletion request.
4. Categories of Data Subjects
The categories of Data Subjects may include:
- Sales representatives or employees of the Controller;
- Prospective customers or clients participating in recorded calls;
- Existing customers of the Controller participating in calls;
- Business contacts engaged in sales conversations;
- Authorised users of the SantaClues platform.
5. Types of Personal Data
The types of Personal Data processed may include:
- Voice data contained in audio streams;
- Transcribed text of call content;
- Names, job titles, and contact details disclosed during calls;
- Commercial and conversational information disclosed during calls;
- Performance metrics and behavioural indicators derived from transcripts;
- User account information (name, email address, organisation affiliation);
- Technical metadata (timestamps, call identifiers, system logs);
- Prompt inputs and outputs used in automated analysis;
- Billing-related data (processed separately via payment provider).
Sensitive categories of personal data are not intentionally collected by SantaClues. However, transcript content is user-generated and may contain personal data depending on the nature of the call.
SantaClues does not perform automated redaction or anonymisation prior to analysis.
6. Processing Operations
Processing operations include:
- Collection (audio stream ingestion);
- Recording and temporary storage (as necessary for transcription);
- Organisation and structuring of transcript data;
- Storage in managed database systems;
- Transmission to subprocessors for transcription and LLM-based analysis;
- Retrieval, consultation, and display via dashboards;
- Logging for operational integrity;
- Deletion and erasure in accordance with retention policies.
7. International Transfers
Certain subprocessors engaged for transcription, LLM processing, infrastructure hosting, or storage may process Personal Data outside the European Economic Area.
Where such transfers occur, SantaClues relies on appropriate safeguards, including Standard Contractual Clauses, as described in the DPA.
EU-only processing is not guaranteed by default.