Part A

Service Agreement

1. The parties

This agreement is between CallRescue Ltd, a company registered in England and Wales with company number 17339092, whose registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ ("we", "us", "CallRescue"), and you, the business subscribing to the Service ("you", "the Client"), identified by the account and business details you provide at signup.

You confirm you are entering this agreement wholly or mainly for the purposes of your trade or business, and not as a consumer.

2. What CallRescue does

We provide an automated, software-based receptionist service for your business. When a call to your business is missed, the Service texts the caller back, holds an automated SMS conversation to understand the job, books suitable appointments into your calendar, and alerts you to each new lead. The Service uses artificial intelligence to hold these conversations.

You understand the Service is software and automation, not a human receptionist and not an emergency service (see clause 7).

3. Trial, term and cancellation

• Free trial: your first 14 days are free, starting from the day we switch your service live.
• Term: after the trial the agreement continues on a rolling monthly basis. No fixed minimum term, no long-term lock-in.
• Your cancellation: you can cancel at any time by telling us before your next monthly billing date, and you will not be charged for the following month.
• Either party may end this agreement on written notice if the other materially breaches it and (where the breach can be put right) fails to do so within 14 days of being asked. We may end it or suspend the Service immediately if you do not pay.
• On cancellation we stop the Service and handle your data as set out in the DPA (Schedule 1). Reverting your call forwarding remains your responsibility (clause 8).

4. Fees and payment

• Monthly fee: £99 per month, charged monthly in advance after your free trial.
• Setup fee: none. There is no setup charge.
• Fees are collected monthly in advance by recurring card payment, starting at the end of your free trial.
• If a payment fails, we may suspend the Service after telling you, and restart it once payment is up to date. Suspension does not change your own obligations (including call forwarding).
• Fees are exclusive of VAT (we are not currently VAT registered; if that changes we will tell you before adding VAT).

5. What we do for you

• We will provide the Service with reasonable skill and care.
• We will make reasonable efforts to keep the Service available, but we do not guarantee it will be uninterrupted or error-free (see clause 6).
• We do not warrant that the Service will capture every call or lead, correctly qualify every job, or book every appointment without error. AI outputs can contain mistakes, and you should apply your own judgement before acting on them. Except as expressly stated in this agreement, all warranties implied by law are excluded to the fullest extent permitted.
• We will keep your data secure and process it only as set out in the DPA.

6. Availability, and things outside our control

The Service depends on third-party providers (for example telephone, messaging, calendar and AI providers). We are not liable for interruptions, delays or failures caused by events genuinely outside our reasonable control, including third-party provider outages, network problems, and events such as strikes, fire or acts of government, and we may suspend the Service while such an event continues. This does not exclude our obligation under clause 5 to provide the Service with reasonable skill and care, including in how we select and manage those providers. We do not offer a guaranteed uptime level at this stage.

7. Important: the Service is not an emergency service

The Service is an automated assistant to help you catch and book jobs. It is not an emergency service and must not be relied on as one.

• The Service uses automated detection to identify possible emergencies and, where it does, signposts the official National Gas Emergency Service (0800 111 999) or otherwise directs the caller to appropriate emergency help. This automated detection is provided on a reasonable-endeavours basis and may not identify every emergency or every caller.
• The Service does not attend, dispatch or resolve emergencies.
• You remain solely responsible for handling genuine emergencies and for your own professional and safety obligations (including your Gas Safe obligations) to your customers. Nothing in the Service replaces your judgement or the emergency services.
• You will not describe or market the Service to your customers as an emergency, out-of-hours, or gas-safety line, and you will indemnify us against third-party claims arising from your breach of this clause or from your own failure to handle an emergency.

8. Your responsibilities

You agree to: set up and maintain call forwarding from your business number to the number we give you; keep your calendar, availability and job information accurate; respond to the leads and bookings the Service produces; use the Service only for your legitimate business and lawfully; and ensure you are entitled to pass us your customers' details for us to process on your behalf (covered by the DPA, you are the "controller", we are the "processor").

9. Data protection

Each party will comply with UK data protection law. The Data Processing Agreement at Schedule 1 governs how we process personal data on your behalf and forms part of this agreement. You are the data controller; we are your data processor. Where Schedule 1 allocates responsibility or indemnities between us for data-protection matters, Schedule 1 prevails over clause 12 to that extent.

10. Intellectual property

We own the CallRescue system, software and all intellectual property in it; you get a non-exclusive right to use the Service for your business during the term. You own your own business and customer data; we claim no ownership of it.

11. Confidentiality

Each party will keep the other's confidential information private and use it only to perform this agreement.

12. Liability

• Nothing in this agreement limits or excludes our liability for death or personal injury caused by our negligence, for fraud, or for anything else that cannot lawfully be limited, these are never capped.
• We are not liable for indirect or consequential losses, loss of profit, loss of business, or loss of goodwill.
• Subject to the first bullet, our total liability to you in any 12-month period, for all claims you bring, including any arising from a data breach, is capped at the greater of (a) the total fees you paid us in the 12 months before the claim, or (b) £5,000.
• The parties agree this allocation of risk is fair and reasonable given the monthly fee, the nature of the Service, and that we maintain professional-indemnity and cyber insurance of £250,000.

13. General

• This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
• Assignment: neither party may transfer or assign this agreement without the other's consent, except that we may assign or transfer it (and Schedule 1), on written notice to you and on the same terms, to a successor of the CallRescue business (for example on a sale, merger or group reorganisation).
• Notices may be given by email to the address each party has last notified to the other.
• No reliance: each party confirms it has not relied on any statement not set out in this agreement (this does not exclude liability for fraud).
• No third-party rights: no one other than a party has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce this agreement.
• This agreement, with Schedule 1 (the DPA), is the entire agreement between us on its subject.

Part B · Schedule 1

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of, and is governed by, the Service Agreement above ("the Main Agreement"). If this DPA and the Main Agreement conflict on data protection matters, this DPA prevails.

The Controller: you, the business subscribing to the Service.
The Processor: CallRescue Ltd, a company registered in England and Wales with company number 17339092, whose registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, ICO registration ZC193634.

1. Definitions

"UK GDPR", "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK General Data Protection Regulation and the Data Protection Act 2018 (together, "Data Protection Law").

2. Roles and scope

1. The Client is the controller of personal data relating to its customers and prospective customers. CallRescue is the processor, handling that data only to provide the missed-call receptionist service described in the Main Agreement and Annex A.
2. CallRescue remains an independent controller of its own business records (for example billing and account correspondence with the Client). Those are outside this DPA.

3. CallRescue's obligations as processor

CallRescue shall:

1. process the personal data only on the Client's documented instructions (the Main Agreement, this DPA and the agreed service configuration constitute those instructions), unless required to do otherwise by law, in which case CallRescue will inform the Client unless the law prevents it;
2. ensure that every person authorised to process the data (currently the founder only) is bound by a duty of confidentiality;
3. implement and maintain appropriate technical and organisational security measures, as described in Annex C;
4. engage sub-processors only as set out in clause 4;
5. taking into account the nature of the processing, assist the Client with appropriate measures to respond to data subjects exercising their rights (access, rectification, erasure, restriction, objection, portability), forwarding any request received directly within 3 working days;
6. assist the Client with its obligations concerning security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the information available to CallRescue;
7. notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Client's data, providing sufficient information for the Client to meet its own notification obligations;
8. at the Client's choice, delete or return all personal data within 30 days of the end of the service, including deletion of message records held by sub-processors, except where law requires retention (in which case the data is isolated and protected until deletion is possible);
9. make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits conducted by the Client or its appointed auditor, limited to once in any 12-month period, on 14 days' written notice, during business hours, at the Client's cost;
10. immediately inform the Client if, in its opinion, an instruction infringes Data Protection Law.

4. Sub-processors

1. The Client gives general written authorisation for the sub-processors listed in Annex B.
2. CallRescue will give at least 14 days' notice of any intended addition or replacement, during which the Client may object on reasonable data protection grounds. If an objection cannot be resolved, either party may terminate the affected service without penalty.
3. CallRescue imposes data protection obligations on each sub-processor equivalent to those in this DPA (via each provider's data processing terms) and remains fully liable to the Client for their performance.

5. International transfers

Some sub-processors are based in, or route data through, the United States (Annex B). Transfers are protected by recognised safeguards under Data Protection Law: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses otherwise. CallRescue will not transfer the Client's personal data outside the UK by any other route without safeguards recognised under Data Protection Law.

6. The Client's obligations

1. The Client warrants it has a lawful basis for the processing and will make fair processing information available to its customers (CallRescue provides a suggested privacy notice paragraph on request, and maintains its own public privacy policy at callrescue.co.uk/privacy.html).
2. The Client's instructions will comply with Data Protection Law.

7. Liability, term and law

1. Each party's liability under this DPA is subject to the limitations and exclusions in the Main Agreement, except where Data Protection Law does not permit them to apply.
2. This DPA starts on the date of the Main Agreement and lasts as long as CallRescue processes the Client's personal data.
3. This DPA is governed by the law of England and Wales, and the parties submit to the exclusive jurisdiction of its courts.

Annex A. Details of the processing

Item	Description
Subject matter	Responding to the Client's missed calls: a voice greeting for missed callers, an automatic text-back, an SMS conversation that qualifies the enquiry, and booking of appointments into the Client's calendar.
Duration	The term of the Main Agreement, plus the wind-down period in clause 3.8.
Nature and purpose	Receiving and sending SMS messages; generating conversational replies using an AI language model; extracting structured job details; recording enquiries and bookings in a lead log; creating calendar bookings; alerting the Client. AI output is generated per conversation and is not used to train models.
Categories of data	Name; mobile number; the enquiry in the caller's own words (job type, symptoms of the fault); postcode or area; requested and booked appointment times; the message thread itself; call metadata (time, number, missed-call status).
Data subjects	The Client's customers and prospective customers who call or text the Client's number.
Special category data	Not requested and not required. If a caller volunteers such information within a message, it is processed only as part of the message thread and never used for any other purpose.

Annex B. Authorised sub-processors

Provider	Role	Location	Transfer safeguard
Twilio	Telephony: SMS send/receive, missed-call detection, voice greeting	US	UK Extension to EU-US Data Privacy Framework / SCCs with UK Addendum
Make.com	Workflow automation connecting the services	EU (EU region hosting)	UK adequacy (EU)
OpenAI	AI reply generation via API (API data not used for model training)	US	UK Extension to EU-US Data Privacy Framework / SCCs with UK Addendum
Google Workspace (Sheets), account josh@callrescue.co.uk	Data-at-rest processor for lead data (organisation-owned Workspace Shared Drive); service email	US / EU	UK Extension to EU-US Data Privacy Framework, under the Google Workspace / Cloud data processing terms
Cal.com	Appointment booking	EU instance (cal.eu)	UK adequacy (EU)

Annex C. Technical and organisational measures

• All data in transit is encrypted (TLS); sub-processors encrypt data at rest.
• Service endpoints are authenticated: webhook API-key authentication and signature validation on inbound telephony functions; no open endpoints.
• Access is limited to the founder; accounts use strong unique credentials; API keys are rotated on a documented runbook, and immediately on suspicion of exposure.
• Every conversation is logged, giving a complete audit trail of what was sent and when.
• Hard-coded safety handling for gas emergency indicators (official National Gas Emergency Service guidance plus immediate Client alert).
• Deletion on offboarding follows a documented runbook covering the lead log, calendar and sub-processor message records, within the 30-day window in clause 3.8.
• The Lead Log and all customer-data writes are stored in an organisation-owned Google Workspace Shared Drive owned by the CallRescue business account (josh@callrescue.co.uk), which Make accesses through a Workspace-authenticated connection, so Google's Workspace / Cloud data processing terms govern both the data at rest and the connection to it.

By starting your subscription you accept the Service Agreement and this Data Processing Agreement. Questions: hello@callrescue.co.uk.