EU Standard Contractual Clauses
Last updated: 23 August 2026
Completed Module 2 and Module 3 selections and Appendix information
1. Incorporation and execution
The Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 are incorporated without modification by reference into the Data Processing Agreement under clause 9. Each Party's acceptance of the Terms that incorporate the DPA is agreement to the SCCs, including the Appendix completed below. The Terms acceptance date is the SCC signature date.
At company onboarding, the Customer supplies the data exporter's identity, registered address, contact person and role, its country of establishment and relevant EU Member State, and the acceptance date. The remaining selections are standing terms.
2. Module and option selections
| SCC provision | Selection |
|---|---|
| Module | Module 2 (controller to processor) or Module 3 (processor to processor), whichever matches the Parties' actual roles under DPA clause 3.1. |
| Clause 7 (docking) | Not included. |
| Clause 9(a) | Option 2 — general written authorisation. Minimum notice period: 30 days. |
| Clause 11(a) optional redress body | Not included. |
| Clause 13 / Annex I.C | Determined by Customer's situation under Clause 13(a). See section 5. |
| Clause 17 | Option 1 — the law of Ireland. |
| Clause 18(b) | The courts of Ireland. Data Subjects retain the additional forum provided by Clause 18(c). |
The selections are identical for Module 2 and Module 3. Under Module 3, Customer must have its own controller's instructions covering the Processing and onward transfer, as warranted in DPA clause 3.1. Every remaining SCC clause applies as written.
3. Annex I.A — List of Parties
Data exporter
| Field | Entry |
|---|---|
| Name | Customer legal entity, completed at company onboarding. |
| Address | Customer registered address, completed at company onboarding. |
| Contact | Customer contact person's name, position and contact details, completed at company onboarding. |
| Relevant activities | Operation of lead-generation marketing programmes; capture and valuation of the exporter's inbound enquiries through calls, web forms and inbound email, and of the documents the exporter uploads, using the Inqelo Services; and, where the exporter expressly enables and instructs it, retrieval and analysis of publicly accessible web content relevant to its configured assessment purposes. |
| Signature and date | Acceptance of the Terms that incorporate the Inqelo Customer DPA and the date of acceptance. |
| Role | Controller under Module 2, or Processor acting for its own client under Module 3, determined by its actual role under DPA clause 3.1. |
Data importer
| Field | Entry |
|---|---|
| Name | JoPaJoEm Pty Ltd (ACN 125 834 184) as trustee for the JoPaJoEm Family Trust (ABN 98 473 397 086), trading as Inqelo. |
| Address | 167 Flinders Street, Adelaide SA 5000, Australia. |
| Contact | Inqelo authorised representative — admin@inqelo.com. |
| Relevant activities | Provision of the Inqelo Services: capture of the exporter's enquiries; transcription and AI-assisted extraction; parsing of documents the exporter uploads; where the exporter expressly enables and instructs it, retrieval and analysis of publicly accessible web content relevant to the exporter's configured assessment purposes; lead valuation; delivery of results and configured signals to the exporter's advertising and analytics accounts. |
| Signature and date | Acceptance of the Terms that incorporate the Inqelo Customer DPA and the date of acceptance. |
| Role | Processor under Module 2, or Sub-processor to the exporter under Module 3. |
EU representative: Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria. UK representative: Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom. Data Subjects may contact either through the Prighter portal, quoting ID-19935887204.
4. Annex I.B — Description of Transfer
| Field | Entry |
|---|---|
| Categories of Data Subjects | The exporter's prospects, callers, form-submitters and email enquirers; the exporter's staff where they appear in captured interactions; individuals identified in documents the exporter uploads; individuals appearing in publicly accessible web content retrieved on the exporter's instruction. |
| Categories of Personal Data | Contact and identity data; enquiry and communication content; attribution, campaign and interaction data; device, network and telephony metadata; Customer-provided documents; publicly available information retrieved on Customer instruction; and derived assessment and classification data. |
| Sensitive data | Inqelo does not require or intentionally solicit special-category personal data or personal data relating to criminal convictions and offences. Because the Services process unstructured communications and documents, such data may be included incidentally. The safeguards identified in the DPA and applicable technical and organisational measures apply. |
| Frequency | Continuous for the duration of the Service agreement. |
| Nature of Processing | Collection and capture; storage; call-audio processing and storage for transcription and analysis where enabled; document parsing; AI-assisted extraction and summarisation; retrieval and analysis of publicly accessible web content where instructed; valuation and scoring as configured by the exporter; transmission to exporter-configured destinations; retention under the exporter's election; and erasure on instruction. |
| Purposes | Provision of the Inqelo Services on the exporter's documented instructions, including DPA clause 5.3 testing and monitoring strictly for the exporter's own Service, without model training or cross-customer pooling. |
| Retention | Selected by the exporter per company from the periods offered in the Platform, including an explicit unlimited-retention election; 365 days applies where no election has been made. Ancillary operational records expire under bounded periods: records in stores that support individual erasure (including LLM traces) are deleted on request as described in the DPA and in any event expire within 90 days; records in stores that delete only by expiry — short-lived pre-lead captures, provider-held transcription artifacts, operational logs and managed database backups — expire within 30 days. Erasure receipts are retained for 6 years for legitimate interests in demonstrating compliance and in establishing or defending legal claims. |
| Sub-processor transfers | Each engagement is for the subject matter, nature and location stated in Annex III, and no longer than the Service relationship plus the provider's deletion period. |
5. Annex I.C — Competent Supervisory Authority
Clause 13(a) gives three answers depending on Customer's situation as data exporter, and the one that applies is the one that completes this Annex. Customer's establishment details supplied during company onboarding identify which.
- Customer is established in an EU Member State. The competent supervisory authority is the supervisory authority of that Member State.
- Customer is not established in an EU Member State, falls within the territorial scope of the GDPR under Article 3(2), and has appointed a representative under Article 27(1). The competent supervisory authority is the supervisory authority of the Member State in which that representative is established.
- Customer is not established in an EU Member State, falls within the territorial scope of the GDPR under Article 3(2), and is not required to appoint a representative. The competent supervisory authority is the supervisory authority of a Member State in which the Data Subjects whose personal data is transferred under these Clauses are located.
Where Customer is not established in the EU and does not fall within the territorial scope of the GDPR at all, no restricted transfer under Chapter V arises from Customer's own processing and these Clauses have nothing to operate on, whether or not they have been executed.
6. Annex II — Technical and Organisational Measures
The complete technical and organisational measures are incorporated as DPA Schedule 2 and SCC Annex II. Because the schedule includes detailed security-control and residual-risk information, it is available to authenticated account holders through the Technical and Organisational Measures page.
7. Annex III — List of Sub-processors
Authorised when Customer accepts the Terms that incorporate the DPA under Clause 9(a), Option 2. Inqelo gives every active Platform account at least 30 days' written notice before an intended addition or replacement.
| Sub-processor | Processing | Location |
|---|---|---|
| Requesty Ltd (company no. 15165717) | EU LLM routing and gateway services for extraction, enhancement, formatting, summarisation, setup and valuation. Prompts and outputs are not retained or used for training. | Frankfurt, Germany |
| Model hosting providers authorised under Requesty's DPA: Google LLC (Vertex AI), Microsoft Azure AI, TensorX Ltd., sference, Amazon Web Services (Bedrock), Nebius AI and Inceptron AB | Model inference reached only through Requesty. Inqelo restricts approved routes to EU processing, zero retention and no training. Requesty contracts with and remains responsible for these providers. | European Union regions |
| AssemblyAI Inc. | Call transcription. Final transcription artifacts begin automatic deletion after 30 days, and content submitted through the European servers is not used for model training. | Dublin, Ireland through the EU endpoint |
| LlamaIndex Inc. | Parsing Customer-uploaded documents. | European Union through the EU endpoint |
| ClickHouse, Inc. (Langfuse Cloud) | LLM trace storage. Traces expire after 90 days and can be deleted for an individual. | European Union region |
| Amazon Web Services, Inc. and the AWS Contracting Party for the account country | File storage, retrieval and control-plane storage. | Frankfurt, Germany |
| DigitalOcean, LLC | Primary datastore and application hosting. | Amsterdam, Netherlands |
| VostokInc SAS (ScrapingBee) | Retrieval of publicly accessible webpages on Customer instruction. The request may use a Customer-selected proxy country outside the EEA. | Request-specific |
| Cloudflare, Inc. | Edge delivery, network security and TLS termination for the Platform. | Global edge network |
| Twilio Inc. (SendGrid) | Service and alert email, including alert content containing Lead Data. | European Union residency endpoint |
| CallTrackingMetrics | Tracking number supply, call handling and call recording, where Inqelo supplies the call tracking. Used for customers in the European Union and the Americas. | United States |
| FoneDynamics | Tracking number supply, call handling and call recording, where Inqelo supplies the call tracking. Used only for customers in Australia and New Zealand. | Australia |