PhrokData Processing Addendum
Last updated October 2026. Phrok is operated by WorkHub Platform Inc., c/o Raie & co, 1875 S. Bascom Ave, Suite 2400, Campbell, CA 95008, United States.
1. Scope and roles
This Data Processing Addendum (“DPA”) forms part of the Terms of Service. The customer is the controller and Phrok is the processor of personal data contained in call content (numbers, transcripts, summaries, goals and context) processed to provide the service.
2. Instructions
We process personal data only on documented instructions from the customer, including instructions given through the dashboard, API and connected AI assistants, unless required otherwise by law.
3. Confidentiality and security
Personnel with access are bound by confidentiality. We maintain appropriate technical and organizational measures including encryption in transit, tenant isolation, hashed credentials, least-privilege access, audit logging and configurable retention.
4. Sub-processors
The customer authorizes the use of sub-processors for telephony, AI speech and language processing, payments and hosting. We will give notice of new sub-processors and the customer may object on reasonable grounds. We impose data protection obligations on sub-processors equivalent to this DPA.
5. International transfers
Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards such as the Standard Contractual Clauses.
6. Assistance and data subject requests
We assist the customer, taking into account the nature of processing, in responding to data subject requests, including via self-service export and deletion tools, and with impact assessments where required.
7. Personal data breaches
We notify the customer without undue delay after becoming aware of a personal data breach affecting customer data, with the information reasonably available.
8. Deletion and return
On termination, or after the configured retention period, we delete customer personal data, except where retention is required by law. Customers may export data before deletion.
9. Audits
We make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits on reasonable notice, no more than once per year, at the customer’s expense.