Kelem.ai
Data Processing Agreement (DPA)
Last updated: April 26, 2026 · GDPR — Regulation (EU) 2016/679, article 28
This Data Processing Agreement ("DPA") is an integral part of the Terms of Service concluded between Lifeora SRL and the customer ("Customer"). It takes effect upon account creation or first use of the service.
1. Parties
- Controller : the business Customer using Kelem.ai to process the phone calls of its own customers or prospects.
- Processor : Lifeora SRL (CBE 0843.008.489), Rue Lieutenant Liedel 44, 1070 Anderlecht, Belgium.
2. Subject matter
Lifeora SRL processes personal data on behalf of the Customer for the sole purpose of providing the Kelem.ai service: receiving and handling incoming phone calls through an AI voice agent, transcription, trade-specific qualification, appointment booking, generation of structured summaries, and delivery to the Customer by email and dashboard.
3. Nature, duration and purpose
Processing is continuous for the entire duration of the Customer subscription. It ends upon termination. Processed data is returned to the Customer or deleted within a maximum of 30 days after termination, save for separate statutory retention obligations (e.g. accounting).
4. Categories of data and data subjects
| Category | Data concerned |
|---|---|
| Identification | First name, last name, phone number, email address when provided by the caller. |
| Voice content | Audio recording, AI-generated text transcript, structured summary, metadata (duration, timestamp, reason). |
| Trade-specific | For real estate agents: property reference, mentioned budget, search area, viewing time slots. Varies by sector. |
| Technical | Caller IP address when relevant (fraud handling), technical logs. |
Data subjects : callers to lines configured by the Customer (end customers, prospects, tenants, candidates, etc.).
5. Customer obligations
- Have a valid legal basis (article 6 GDPR) for the processing performed through Kelem.ai and, where necessary, obtain callers’ consent.
- Inform callers under articles 13 and 14 GDPR, in particular through the voice agent's greeting message announcing that the call is recorded and processed.
- Document the instructions given to the processor through the agent's configuration (FAQ, question scope, scripts) and maintain its own register of processing activities.
6. Processor obligations
- Process data only on the Customer's documented instructions (agent settings, FAQ, scope).
- Ensure that persons authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational measures: encryption at rest (AES-256-GCM) and in transit (TLS 1.2+), role-based access control, access logs, encrypted backups, tenant isolation.
- Assist the Customer in responding to data subject requests (articles 15-22 GDPR) and in carrying out data protection impact assessments (DPIA) where relevant.
- Notify any personal data breach to the Customer within a maximum of 72 hours after becoming aware of it, providing the information needed for the Customer to fulfil its obligations toward its supervisory authority.
- Upon termination of processing, return or delete the data in accordance with article 3 above.
7. Sub-processors
The Customer authorises Lifeora SRL to engage the sub-processors listed in the Privacy Policy. Any change to this list is notified to the Customer by email with a reasonable advance notice allowing it to object; if the objection is not resolved, the Customer may terminate the subscription at no cost.
8. Transfers outside the EU
Data is stored and processed primarily within the European Economic Area. Certain technical sub-processors (in particular for real-time voice processing and LLM) operate from the United States. Those transfers are governed by the standard contractual clauses (SCC) adopted by the European Commission (article 46 GDPR), supplemented by transfer impact assessments (TIA) where relevant.
9. Audits
Lifeora SRL shall make available to the Customer, on reasonable request, the information necessary to demonstrate compliance with this DPA, and shall allow for documentary or on-site audits upon 30 days' notice, under mutually agreed and confidential conditions.
10. Term and termination
This DPA applies from acceptance of the Terms and remains in force as long as there is an active subscription between the Customer and Lifeora SRL. Termination of the Terms entails termination of this DPA, without prejudice to surviving legal obligations.
11. Governing law and jurisdiction
This DPA is governed by Belgian law. Any dispute shall be submitted to the competent courts of Brussels.