Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) supplements the agreement between FirstCue, LLC (“Service Provider”) and the business customer (“Business”) and governs FirstCue’s processing of Personal Information on the Business’s behalf. By checking the box “I have read and agree,” the Business accepts this DPA together with the Terms of Service and Privacy Policy — no separate signature is required. Enterprise clients who require a separately signed agreement do so through the Master Services Agreement, which incorporates this DPA by reference.

1. Definitions

“Personal Information,” “Business,” “Service Provider,” “sell,” “share,” “processing,” and “verifiable consumer request” have the meanings in the California Consumer Privacy Act (CCPA) and its regulations, including CCPA regulation §7051. “Services” means FirstCue’s AI inbound-call dispatch service.

2. Roles

The Business is the business/controller. FirstCue is a service provider/processor that processes Personal Information (including call recordings, transcripts, and caller intake data) solely to provide the Services to the Business.

3. FirstCue’s obligations (CCPA §7051)

FirstCue will:

1. Not sell or share the Personal Information.
2. Process only for the specified business purposes — answering, recording, transcribing, intake, routing, notifications, support, security, billing, and operating/improving the Services for the Business — and for no other purpose.
3. Not use the Personal Information for any purpose other than those specified, and not retain, use, or disclose it outside the direct business relationship with the Business.
4. Not combine the Personal Information with data from other sources except as permitted by the CCPA to perform the Services.
5. Provide the same level of privacy protection the CCPA requires of businesses.
6. Notify the Business promptly if it determines it can no longer meet these obligations.
7. On the Business’s instruction, stop and remediate unauthorized use.
8. Comply with all applicable CCPA obligations (§7051(a)(5)). FirstCue will comply with all applicable requirements of the CCPA and its implementing regulations, and will cooperate as needed to enable the Business’s own CCPA compliance — this undertaking is in addition to the same-level-of-protection commitment in (e).

4. Audit & monitoring rights

The Business may take reasonable and appropriate steps to monitor FirstCue’s compliance — including manual reviews, automated scans, or requesting FirstCue’s assessments/attestations — on reasonable notice and no more than once per year absent cause.

5. Assisting with consumer requests

FirstCue will assist the Business in responding to verifiable consumer requests, including to know/access, delete, and correct — by, at the Business’s direction, providing, deleting, or correcting the relevant consumer’s Personal Information in FirstCue’s systems within the time the CCPA allows.

6. Subprocessors (flow-down)

FirstCue may use subprocessors to provide the Services but will bind each subprocessor by written contract to data-protection and use-limitation obligations at least as protective as those in this DPA. FirstCue remains responsible for its subprocessors’ performance. Current subprocessor categories: telephony/voice, payments, email, and cloud infrastructure.

7. Security

FirstCue will maintain reasonable administrative, technical, and physical safeguards appropriate to the Personal Information, including encryption in transit and access controls, and will notify the Business without undue delay after becoming aware of a security incident affecting the Personal Information.

8. Return or deletion

On termination or the Business’s request, FirstCue will delete or return the Personal Information it processes for the Business, except copies required to be retained by law, which remain subject to this DPA.

9. Term & precedence

This DPA runs for the term of the underlying agreement. If it conflicts with other terms on the subject of data protection, this DPA controls.

Read the Terms of Service →  ·  Read the Privacy Policy →