Acceptable Use Policy

Callspace is operated by Crossmedia Software SL, a company registered in Spain with tax ID (CIF) B72817661 and registered address at Avenida Finisterre 275, 2º IZ, 15008 A Coruña, Spain ("Callspace", "we").

This Acceptable Use Policy ("Policy") forms part of the Callspace Terms of Service. It applies to every customer account ("workspace"), to every person who accesses a workspace, including agents and workspace members, and to every use of the Callspace API, webhooks and embeddable components.

Callspace is a business communications platform. This Policy covers all of its modules:

• Voice: cloud call center, virtual PBX, call queues, IVR, inbound and outbound calls, call recording and phone numbers provided through telecommunications carriers.
• Messaging: WhatsApp Business conversations and message templates sent through the Meta WhatsApp Business Platform.
• AI agents: automated voice agents that answer or place calls on behalf of the customer.
• Email marketing: contact lists, newsletters and email campaigns sent from domains that the customer owns and has verified in Callspace.
• Integrations: API, webhooks and embeddable components.

Callspace is a tool. The customer decides whom to contact, what to send and when, and is the party responsible for those communications.

Callspace may be used for lawful business communications with people who have a relationship with the customer, for example:

• Customer service, support and sales calls, and the related queues, recordings and reporting.
• Transactional and service messages: appointment reminders, order or account updates and replies to enquiries.
• Newsletters and marketing emails to people who have given consent, or with whom another valid legal basis exists, such as an existing customer relationship where the law allows it.
• Outbound calls and AI-agent calls to people who have agreed to be contacted or where another valid legal basis exists.

Before contacting anyone through Callspace, the customer must have valid consent or another legal basis that applies to that communication under the law of the recipient. Depending on the recipient, this includes the General Data Protection Regulation (GDPR), the ePrivacy Directive, Spanish Law 34/2002 on Information Society Services (LSSI), Spanish Law 11/2022 on Telecommunications and, for recipients in the United States, the CAN-SPAM Act and the Telephone Consumer Protection Act.

• Commercial email requires the recipient's prior consent, unless the law provides an exception, such as the existing-customer exception for similar products or services in Article 21.2 of the LSSI.
• Consent must be specific, informed and freely given. Pre-ticked boxes, consent bundled with unrelated terms and consent obtained for a different organisation do not qualify.
• The customer must keep records showing how, when and for what purpose each contact was collected, and provide them to Callspace on request.
• When a recipient withdraws consent or objects, the customer must stop contacting them for that purpose.

Callspace does not verify every individual consent automatically. Before importing a contact list, the customer must declare where the contacts come from and confirm that it has a valid legal basis to contact them. Callspace records that declaration, reviews it, and may ask for evidence at any time.

The following contacts must not be uploaded to or contacted through Callspace:

• Purchased, rented, traded or shared lists, including lists sold as "opt-in" or "GDPR compliant".
• Addresses or phone numbers collected by scraping or harvesting websites, social networks, directories or public registers.
• Contacts generated by guessing or combining addresses (dictionary attacks), or obtained from data breaches or any other unlawful source.
• Contacts collected by a third party, such as a partner or a co-registration form, unless the person consented to receive communications from the customer by name.
• Contacts who have unsubscribed, objected or complained, or whose address has bounced permanently.
• Lists that the customer has not contacted for more than 24 months, unless the customer first confirms that the recipients still want to hear from it.

• Unsolicited bulk communications (spam) by email, phone, SMS or WhatsApp.
• Phishing, or any attempt to obtain passwords, payment details or other personal data by deception.
• Malware, ransomware, malicious links or attachments, and links to sites that distribute them.
• Impersonating any person, brand, company or public authority, or misrepresenting the sender's identity or affiliation.
• Fraudulent, deceptive or misleading content, including false or misleading subject lines and "get rich quick", pyramid or advance-fee schemes.
• Content that is illegal, or that promotes illegal goods or services, in the country of the sender or the recipient.
• Content that infringes intellectual property, privacy or other rights of third parties.
• Harassment, threats, hate speech, or content that incites violence or discrimination.
• Sexually explicit content, and any content that sexualises or exploits minors.

The customer must not try to bypass the protections of Callspace, of its infrastructure providers, or of mailbox providers and telephone networks. In particular, it is prohibited to:

• Spread sending across several domains, sender addresses, workspaces or phone numbers to avoid filtering, limits or reputation tracking ("snowshoeing").
• Obfuscate content or links, use URL shorteners to hide destinations, or use hidden text or images to evade spam filters.
• Use Callspace to test or probe spam filters.
• Re-import, re-create or otherwise reactivate contacts that are on a suppression list.
• Open additional accounts to avoid sending limits, a restriction or a suspension.
• Present a calling number that is not assigned to the customer, or alter caller ID to mislead the person called.

• Emails must be sent from a domain that the customer owns and has verified in Callspace through DNS. Free mailbox domains, such as gmail.com or outlook.com, cannot be used as sender domains.
• The sender name, sender address and reply-to address must identify the customer accurately.
• Commercial communications must be clearly identifiable as such and must identify the business on whose behalf they are sent, as required by Article 20 of the LSSI and by the law of the recipient.
• Every marketing email must include the name and a valid postal address of the sender.
• Outbound calls must present a number that is assigned to the customer, and the caller or AI agent must identify the business at the start of the call.

• Callspace adds an unsubscribe link and one-click unsubscribe headers to every marketing email. The customer must not remove, hide or disable them.
• Unsubscribes made through Callspace take effect immediately. Opt-out requests that the customer receives through other channels, such as a reply, a phone call or a support ticket, must be recorded in Callspace without undue delay.
• Unsubscribing must be free, must not require a login, and must not ask for more information than the email address.
• People who ask not to be called, or who send an opt-out request on WhatsApp, must not be contacted again for that purpose.

Contacts may only be used for the purposes for which they were collected and for which a legal basis exists. For example, a phone number obtained to handle a support request may not be used for marketing unless the customer has a separate legal basis to do so. Contact data stored in Callspace must not be sold, rented or disclosed to third parties for their own marketing.

• Automated or AI-agent calls may only be placed to people who have agreed to be contacted or where another legal basis exists, and must respect time restrictions and do-not-call rights under applicable law.
• When calls are recorded, the customer must inform the people on the call as required by applicable law.
• People must be told when they are talking to an AI agent, as required by applicable law, including Article 50 of the EU Artificial Intelligence Act.
• WhatsApp messages must also comply with the WhatsApp Business policies of Meta, including its opt-in requirements.

Each customer is responsible for its contact lists, the content of its communications, the legal basis for each communication, and the actions of everyone who uses its workspace. As data controller of its contacts' personal data, the customer must meet the transparency and data-subject-rights obligations of the GDPR. Callspace processes that data on the customer's behalf, as a processor.

Callspace may investigate any use of the service that may breach this Policy, including when it receives an abuse report, a complaint from a recipient or a mailbox provider, a notice from an infrastructure provider, or when sending metrics show unusual bounce rates, complaint rates or volumes. During an investigation Callspace may:

• Review sending metadata, the declared source of the contact lists, and the content of the campaigns concerned.
• Ask the customer for evidence of consent or of another legal basis, and for information about how the contacts were collected.
• Pause the campaigns concerned while the investigation is ongoing.

Where there are signs of abuse, or a risk to recipients, to other customers or to the reputation of the platform, Callspace may, without prior notice:

• Pause or cancel individual campaigns or scheduled sends.
• Restrict an account, for example by lowering its sending limits or requiring a review before each campaign.
• Suspend email sending, outbound calling or the whole account as a preventive measure.

Callspace will tell the customer the reason for the measure, unless the law or an ongoing investigation prevents it, and will give the customer an opportunity to respond. Callspace may terminate accounts that seriously or repeatedly breach this Policy, as set out in the Terms of Service.

If you received spam, phishing or unwanted calls or messages sent through Callspace, or you believe someone is misusing your domain or your personal data through Callspace, please tell us:

Abuse and legal reports: legal@callspace.io

• How to report abuse
• Email compliance at Callspace

We may update this Policy to reflect changes in the law, in the requirements of our infrastructure providers or in the service. We will notify customers of material changes as described in the Terms of Service.