Terms of Service, Data Processing Agreement, and Appendices

Terms of Service

Effective date: 2.6.26

1. About these Terms

These Terms govern access to and use of Qallio's AI-powered phone, messaging, routing, booking, and related workflow services for businesses (the "Service").

The Service is provided by Qallio AB, company registration number 559573-8815, Kivra: 559573-8815, 106 31 Stockholm, Sweden.

By creating an account, placing an order, checking an acceptance box during signup, clicking to accept, or otherwise using the Service, the customer agrees to these Terms. Where Qallio processes personal data on the customer's behalf, the customer also accepts the Data Processing Agreement and its appendices below.

2. Business customers and authority

The Service is intended for business and professional use. By accepting these Terms, you confirm that you are acting on behalf of a business or other organisation, or otherwise in a professional capacity. If you accept these Terms on behalf of an entity, you confirm that you have authority to bind that entity to the agreement.

3. The Service and customer control

The customer controls how the Service is configured and used, including call flows, message handling, booking rules, automations, integrations, and any content or data submitted to the Service.

Qallio may improve, update, add, remove, or modify features from time to time. We aim to provide reasonable notice where a change materially affects the Service.

4. Customer responsibilities and lawful use

The customer is responsible for ensuring that its use of the Service complies with applicable law and regulation.

This includes, where relevant, responsibility for:

• GDPR and other privacy obligations
• the EU AI Act, where applicable, and any other local or sector-specific laws that apply to the customer's use case
• telecommunications and marketing rules
• any notice, transparency, or consent requirements
• updating the customer's own privacy notices, processor lists, and internal compliance documentation where required
• informing callers, leads, customers, employees, or other data subjects where the law requires that information
• call recording and message retention choices
• the lawfulness, accuracy, and appropriateness of customer content and instructions

You may not use the Service to:

• break the law or infringe third-party rights
• send spam or unlawful marketing
• interfere with, disrupt, or degrade the Service
• collect, record, store, analyse, infer, or otherwise process special categories of personal data under Article 9 GDPR
• process personal data relating to criminal convictions, offences, or related security measures through the Service
• attempt unauthorised access, bypass security, or reverse engineer the Service except where the law clearly permits it

5. Accounts and security

The customer is responsible for maintaining the confidentiality of account credentials and for all use of the Service through its accounts. The customer must ensure that only authorised users have access to the Service and must notify Qallio without undue delay if it becomes aware of unauthorised access or a compromise of account credentials.

6. Fees, billing, payments, and renewals

Subscription fees and any usage-based fees are described on Qallio's website, in an order form, or on an invoice. Unless otherwise agreed in writing, subscriptions renew automatically for successive periods until cancelled in accordance with the applicable plan or order terms.

Payments may be processed by Qallio or another designated payment provider. The customer is responsible for applicable taxes, including VAT, except where Qallio is legally required to collect or pay them.

If payment is overdue, Qallio may suspend access to the Service after reasonable notice, unless the unpaid amount is subject to a genuine good-faith dispute.

7. Free tier, promotions, price changes, and plan changes

Qallio may offer a free tier, pilot periods, or promotional pricing. Qallio may change, limit, or withdraw promotional offers with reasonable notice where required by law.

Qallio may change prices, fees, or plan features from time to time. Updated pricing will generally apply from the next renewal term, unless another effective date is stated. Qallio will provide reasonable notice of material pricing changes where required by law or contract.

8. Availability, support, and service changes

Qallio aims to provide a stable and reliable service, but does not guarantee uninterrupted or error-free operation. Maintenance, updates, incidents, connectivity issues, third-party dependencies, and force majeure events may affect availability. Unless expressly agreed otherwise, any support, response times, or service levels are provided on a reasonable-efforts basis and are not a separate warranty.

9. Customer data and intellectual property

Qallio and its licensors retain all rights, title, and interest in the Service, including related software, documentation, branding, and intellectual property. The customer retains its rights in its own data, content, configurations, and materials submitted to the Service. The customer grants Qallio a limited right to host, process, transmit, copy, and otherwise use that data to provide, secure, support, and improve the Service in accordance with the agreement.

10. Confidentiality

Each party shall protect the other party's confidential information with reasonable care and use it only for the purposes of performing or exercising rights under the agreement. This does not apply to information that is publicly available without breach, was already lawfully known, is independently developed, or must be disclosed by law or by a competent authority.

11. AI outputs and customer review

AI-generated outputs may be incorrect, incomplete, misleading, or unsuitable for a particular use case.

The customer is responsible for reviewing outputs, business decisions, communications, automations, and any downstream actions before relying on them where such review is appropriate for the customer's use case and regulatory context.

12. Data protection and the DPA

Where Qallio processes personal data on the customer's behalf, Qallio acts as processor and the customer acts as controller, unless applicable law clearly requires otherwise in a specific context. In those cases, the Data Processing Agreement below is incorporated into, and forms part of, these Terms. Acceptance of these Terms also constitutes acceptance of the DPA. If there is any conflict between the DPA and these Terms with respect to personal data processing, the DPA prevails to the extent of that conflict.

13. Suspension and termination

Qallio may suspend or restrict access to the Service immediately if reasonably necessary for security, legal compliance, prevention of abuse, protection of other customers, or if the customer materially breaches the agreement. Either party may terminate the agreement in accordance with the applicable plan, order form, or agreed notice period.

14. Warranties and disclaimers

Except as expressly stated in the agreement, the Service is provided on an "as is" and "as available" basis. To the fullest extent permitted by law, Qallio disclaims implied warranties, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

15. Limitation of liability

To the maximum extent permitted by law, neither party shall be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, including lost profits, lost revenue, lost goodwill, or loss of data, arising out of or in connection with the agreement.

Qallio's total aggregate liability arising out of or relating to the Service and the agreement shall not exceed the fees paid or payable by the customer to Qallio for the Service during the 12 months immediately preceding the event giving rise to the claim.

Nothing in these Terms limits liability that cannot lawfully be limited, including liability arising from wilful misconduct or gross negligence where applicable law does not permit exclusion.

16. Governing law and disputes

These Terms are governed by the laws of Sweden, without regard to conflict-of-law rules.

Any dispute arising out of or relating to these Terms, the DPA, or the Service shall be subject to the exclusive jurisdiction of the Swedish general courts, with Stockholm District Court (Stockholms tingsrätt) as the court of first instance, unless mandatory law requires otherwise.

17. Changes to these Terms

Qallio may update these Terms from time to time. The latest version will be published on this page with an updated effective or last-modified date. Where a change is material, Qallio may provide additional notice.

Data Processing Agreement

Effective date: 2.6.26

This Data Processing Agreement (the "DPA") forms part of the agreement between the customer, business, organisation, or other professional user that creates an account, places an order, checks the acceptance box during signup, or otherwise uses Qallio's service (the "Customer" or "Data Controller"), and Qallio AB, company registration number 559573-8815, Kivra: 559573-8815, 106 31 Stockholm, Sweden ("Qallio" or "Data Processor").

The person accepting this DPA on behalf of a Customer confirms that they have authority to bind that Customer. This DPA is accepted electronically and does not require handwritten signatures. Qallio may record acceptance metadata such as the acceptance timestamp, document ID or version, user ID, and email address.

1. Background and status of this DPA

This DPA, together with Appendix 1 and Appendix 2 below, governs Qallio's processing of caller and end-customer personal data on behalf of the Customer. The purpose of this DPA is to meet the requirements of Article 28.3 of Regulation (EU) 2016/679 (the "GDPR") and to protect the rights and freedoms of data subjects.

The parties have also entered into terms governing the Customer's use of Qallio's AI-powered phone, messaging, booking, routing, and related workflow services (the "Main Agreement"). The Main Agreement may include Qallio's online Terms of Service, an order form, or another agreement accepted by the Customer.

If there is a conflict between this DPA and the Main Agreement regarding processing of personal data on behalf of the Customer, this DPA prevails to the extent of that conflict. If there is a conflict between this DPA and an appendix to this DPA, the appendix prevails for the subject matter it covers.

2. Definitions

The terms "controller", "processor", "data subject", "personal data", "personal data breach", "processing", and "special categories of personal data" have the meanings given to them in the GDPR. "Data Protection Legislation" means the GDPR and any other privacy, data protection, electronic communications, or personal data legislation that applies to the processing carried out under this DPA.

3. Roles of the parties

For caller and end-customer personal data processed through the Service, the Customer determines the purposes and essential means of the processing and acts as Data Controller. Qallio processes that personal data only on behalf of the Customer and in accordance with the Customer's instructions, and acts as Data Processor. This DPA does not create joint controllership under Article 26 GDPR.

4. Processing and instructions

The Customer appoints Qallio to process personal data on the Customer's behalf for the purposes described in this DPA, Appendix 1, Appendix 2, and the Main Agreement. Qallio shall process personal data only on documented instructions from the Customer, unless applicable law requires Qallio to process personal data otherwise. If legally permitted, Qallio shall inform the Customer before carrying out such legally required processing.

5. Customer responsibilities

The Customer is responsible for ensuring, and being able to demonstrate, that its processing of personal data through the service complies with Data Protection Legislation.

• having a valid legal basis for the processing
• giving Qallio lawful, clear, and complete instructions
• ensuring that the personal data collected through the service is necessary and proportionate
• informing data subjects about AI-supported interactions, transcription, call recording, messaging, booking, and related processing where required by law
• handling data subject rights requests where the Customer is controller
• updating the Customer's own privacy notices, processor lists, internal records, and compliance documentation where required

The Customer shall not configure or instruct the service to collect or process special categories of personal data or personal data relating to criminal convictions or offences. If such information is accidentally provided through the service, the Customer remains responsible for having a lawful basis and appropriate notices, and Qallio may delete, ignore, restrict, or otherwise handle the information in accordance with applicable law, this DPA, and the Customer's lawful instructions.

6. Qallio responsibilities

Qallio shall process personal data only for the purposes set out in the instructions and only to the extent necessary to provide, secure, support, maintain, and improve the service in accordance with the Main Agreement. Qallio shall ensure that people authorised to process personal data are subject to an appropriate duty of confidentiality, restrict personnel access to what is necessary, and implement and maintain appropriate technical and organisational measures as described in Appendix 1.

7. Subprocessors

The Customer gives Qallio general written authorisation to engage Subprocessors for the processing of personal data. Qallio shall impose written data protection obligations on each Subprocessor that are no less protective, in substance, than the obligations in this DPA. Qallio remains responsible to the Customer for the performance of its Subprocessors to the extent required by Data Protection Legislation.

Current Subprocessors are listed in Appendix 2. Qallio may update the Subprocessor list from time to time. Where required by law or contract, Qallio shall make updated Subprocessor information available and give the Customer an opportunity to object before a new Subprocessor starts processing personal data.

8. Transfers outside the EU/EEA

Qallio may transfer personal data to a country outside the European Union and European Economic Area only where a valid transfer mechanism under Chapter V GDPR is in place. Valid transfer mechanisms may include an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful safeguard, together with supplementary measures where required.

9. Personal data breaches

Qallio shall notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA. Qallio shall provide information reasonably available to Qallio and reasonably necessary for the Customer to meet its personal data breach notification obligations, and shall take reasonable steps to contain, investigate, and mitigate the breach.

10. Data subject requests and supervisory authorities

The Customer is responsible for responding to data subject requests where the Customer is controller. If Qallio receives a request from a data subject relating to personal data processed on behalf of the Customer, Qallio shall, where legally permitted, inform the Customer without undue delay and shall not respond except on the Customer's instructions or as required by law.

11. Audits and information

Qallio shall make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA. Where required by Data Protection Legislation, the Customer may request a reasonable audit or inspection relating to the processing covered by this DPA. Any audit must be proportionate, subject to reasonable prior notice, limited to the relevant processing, protected by confidentiality, and conducted in a way that avoids unnecessary disruption to Qallio, its systems, and other customers.

12. Return and deletion

Upon termination or expiry of the Main Agreement, Qallio shall delete or return personal data processed on the Customer's behalf, at the Customer's choice, unless applicable law requires continued storage. Qallio may retain personal data in secure backups for a limited period where immediate deletion is not technically feasible, provided the retained data remains protected and is not processed for any purpose other than backup integrity, recovery, security, or legal compliance.

13. Liability and indemnification

The parties' liability to data subjects and third parties for processing of personal data is governed by Article 82 GDPR and other applicable law. Between the parties, the Customer is responsible for claims, losses, costs, fines, and liabilities arising from Qallio processing personal data in accordance with the Customer's lawful instructions, except to the extent caused by Qallio's breach of this DPA or Data Protection Legislation. Qallio is responsible for claims, losses, costs, fines, and liabilities to the extent caused by Qallio's breach of this DPA, Data Protection Legislation, or processing outside the Customer's lawful instructions.

Subject to any liability that cannot lawfully be limited, the limitations and exclusions of liability in the Main Agreement apply to all claims between the parties arising out of or relating to this DPA, including claims for indemnification, compensation, costs, fines, losses, damages, or expenses. Nothing in this DPA limits either party's liability to data subjects, supervisory authorities, or other third parties to the extent such liability cannot lawfully be limited under Data Protection Legislation or other mandatory law.

14. Term, changes, governing law, and contact

This DPA takes effect on the effective date stated above, or on the date the Customer accepts it electronically, whichever is later, and remains in force for as long as Qallio processes personal data on behalf of the Customer under the Main Agreement. Qallio may update this DPA from time to time. This DPA is governed by Swedish substantive law. Any dispute arising out of or relating to this DPA shall be settled by Swedish general courts, with Stockholm District Court (Stockholms tingsrätt) as the court of first instance, unless mandatory law requires otherwise. Questions about this DPA may be sent to privacy@qallio.com.

Appendix 1: Processing instructions and security measures

1. Contact details

2. Service and purpose of processing

Qallio provides an AI-powered phone, messaging, booking, routing, and workflow service for business customers. The service helps the Customer receive, route, transcribe, summarise, structure, and act on customer contacts, primarily through phone calls and related messages. Qallio processes personal data only on the Customer's documented instructions.

Qallio processes personal data for the following purposes:

• enabling End Customers to interact with the AI assistant to administer, create, modify, or cancel bookings
• collecting information from End Customers according to the Customer's instructions
• storing, structuring, and processing collected information to execute and administer bookings, inquiries, messages, and related workflows
• providing the Customer with summaries, transcripts, structured outputs, booking information, and relevant notifications
• performing quality checks, debugging, service monitoring, security monitoring, and abuse prevention
• sending confirmations or messages, such as SMS messages, where configured by the Customer
• identifying and flagging suspected abuse of the service
• forwarding specific information, such as complaints or service issues, to the Customer

3. Categories of personal data and data subjects

The exact personal data processed depends on the Customer's configuration and instructions. Categories may include:

• contact details such as name, phone number, email address, postal address, and similar contact information
• communication data such as voice recordings, call audio, call transcripts, call summaries, message content, message metadata, call metadata, routing events, and booking events
• service-specific data such as appointment details, vehicle registration numbers for automotive services, requested service type, preferred time, location, notes, or other information the Customer instructs the AI assistant to collect
• account and user data such as account owner, administrators, authorised users, login identifiers, access logs, support records, and configuration records
• other personal data voluntarily provided by an End Customer or by the Customer during use of the service

Data subjects may include End Customers who contact, call, message, or book with the Customer; prospective customers, leads, guests, patients, clients, or other contacts of the Customer; the Customer's employees, representatives, account users, administrators, and service staff; and third parties whose personal data is mentioned during a call, message, booking, or other interaction.

4. Retention defaults

Unless the Customer configures or instructs different retention periods, Qallio applies the following product defaults:

• voice recordings are deleted after 48 hours
• transcripts are deleted after 30 days
• call summaries and analyzer outputs are deleted after 30 days
• messages and tool-call records are deleted after 30 days
• booking records are deleted after 30 days
• account, billing, security, and audit records may be retained for longer where needed

Where configurable retention settings are available in the product, the Customer may choose supported periods such as 24 hours, 48 hours, 72 hours, 7 days, 14 days, 30 days, 90 days, 180 days, 365 days, or no automatic deletion.

5. Security measures

Qallio shall maintain appropriate technical and organisational measures to protect personal data against unauthorised access, accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or other unauthorised processing. Measures include documented access control practices, role-based access, vendor and Subprocessor review, incident response routines, regular review of security and access permissions, data minimisation, confidentiality obligations, authentication controls, least-privilege access, encryption in transit, provider-managed storage security, logging and monitoring, backup and recovery arrangements, separation of environments, secure secret handling, and deletion and retention controls.

Appendix 2: Approved Subprocessors

The Customer authorises Qallio to use the following Subprocessors to process caller and end-customer personal data within the scope of the Data Processing Agreement.

Qallio may update this Subprocessor list as described in the Data Processing Agreement.