Communications and Call Recording Policy

Communications & Call Recording Policy Version: 1.0 Effective Date: July 2026 Applies To: All Sagecom Communications Services

This Communications & Call Recording Policy ("Policy") establishes the rules governing the use of Sagecom Inc.'s ("Sagecom," "we," "our," or "us") communications services, including voice, messaging, artificial intelligence ("AI") communications, call recording, voicemail, and related telecommunications services. This Policy is designed to: promote lawful and responsible use of Sagecom Services; protect Customer and End User privacy; support regulatory compliance; establish responsibilities relating to communications and call recording; describe Sagecom's communications practices; and supplement the Master Terms of Service. This Policy forms part of the Agreement between Sagecom and the Customer .

This Policy applies to all Sagecom communications services, including: Cloud PBX; Unified Communications (UCaaS); Hosted Voice; Virtual Office; SIP Trunking; Business Messaging; SMS and MMS messaging; Voicemail; Communications APIs; AI Receptionists; AI Voice Agents; AI Customer Service Agents; AI Sales Agents; AI Call Routing; AI Call Recording; AI Conversation Intelligence; AI Call Summaries;

AI Transcription Services; Customer Portal communications; and all other communications services provided by Sagecom.

The Customer is solely responsible for ensuring that its use of the Services complies with all applicable: telecommunications laws; privacy laws; consumer protection laws; employment laws; electronic communications laws; marketing laws; call recording laws; AI disclosure laws; and other Applicable Laws. Nothing in this Policy constitutes legal advice. Customers should obtain independent legal advice regarding their communications practices.

Sagecom provides cloud communications services that enable Customers to send and receive voice communications over supported telecommunications networks. Customers are responsible for: configuring call routing; maintaining authorised users; managing voicemail; configuring business hours; maintaining emergency calling information; protecting account credentials; and ensuring lawful use of voice communications. Sagecom does not control the content of Customer communications.

Certain Services permit Customers to record inbound and outbound telephone calls.

Call recording may be initiated: manually; automatically; conditionally; through AI workflows; or by Customer configuration. Customers are solely responsible for determining whether call recording is lawful in each jurisdiction where communications occur .

The Customer shall obtain any notices, disclosures, acknowledgements, or consents required by Applicable Law before recording any communication. This includes compliance with jurisdictions requiring: one-party consent; two-party consent; all-party consent; or other recording authorisations. Sagecom is not responsible for determining whether a particular communication may legally be recorded.

Customers may enable AI-powered communications, including: AI Receptionists; AI Voice Agents; AI Customer Service Agents; AI Sales Agents; AI appointment scheduling; AI call routing; AI workflow automation; AI-generated voice interactions; and conversational AI. Customers remain responsible for complying with all laws governing AI-assisted communications, including any applicable disclosure requirements. Where required by Applicable Law, Customers should notify callers that they are interacting with an AI-powered system.

Where enabled by the Customer , Sagecom may generate: call transcripts; AI summaries; conversation analytics; action items; sentiment analysis; keyword extraction; searchable transcripts; and other AI-generated communications insights. AI-generated content is intended solely to assist Customers. Customers remain responsible for reviewing AI-generated outputs before relying upon them for legal, financial, healthcare, employment, regulatory, emergency response, or other significant business decisions. Sagecom does not guarantee the accuracy, completeness, or suitability of AI-generated content.

Customers may use Sagecom's messaging services to send: SMS; MMS; appointment reminders; authentication codes; service notifications; customer support communications; AI-generated messages; marketing communications; and workflow-generated notifications. Customers remain solely responsible for: obtaining required marketing consent; complying with TCPA; complying with Canada's Anti-Spam Legislation (CASL); complying with applicable messaging regulations; honouring opt-out requests; and maintaining messaging compliance.

To maintain security, quality, reliability, and regulatory compliance, Sagecom may monitor communications metadata and system activity relating to the Services. Monitoring may include: call metadata; signalling information; API activity; authentication events; security logs; messaging statistics; fraud indicators; service quality metrics; platform diagnostics; and operational analytics. Except as required to provide the Services or comply with Applicable Law, Sagecom does not monitor the content of Customer communications.

(CPNI) Where applicable, Sagecom will protect Customer Proprietary Network Information ("CPNI") in accordance with applicable telecommunications laws. CPNI may include: subscribed services; telephone numbers; call detail records; service usage; billing information; and other protected telecommunications information. Sagecom will use, disclose, and protect CPNI only as permitted by Applicable Law and the Enterprise Privacy & Cookies Policy. Customers are responsible for protecting account credentials used to access CPNI.

Sagecom implements commercially reasonable administrative, technical, and organisational safeguards designed to protect communications services, including: encryption in transit where supported; encryption at rest where supported; authentication controls; role-based access controls; audit logging; fraud detection; intrusion monitoring; vulnerability management; backup procedures; and security monitoring. No communications network can be guaranteed to be completely secure.

Call recordings, voicemail, transcripts, messaging records, and communications data are retained in accordance with: the Enterprise Privacy & Cookies Policy; the Data Processing Addendum; Customer account settings; applicable Service configurations; legal obligations; and Sagecom's internal retention schedule. Customers may configure shorter retention periods where supported by the Services.

Sagecom may preserve, access, or disclose communications information where required to: comply with Applicable Law; comply with court orders; respond to lawful governmental requests; protect Sagecom's rights; investigate fraud; investigate abuse; enforce the Agreement; protect Customers; respond to security incidents; or protect public safety.

Where legally permitted, Sagecom will use commercially reasonable efforts to notify the affected Customer before disclosing Customer information.

Customers shall not use the Services to: transmit unlawful communications; conduct fraudulent activity; send spam; engage in robocalling prohibited by law; impersonate another person; transmit malicious software; violate privacy rights; violate intellectual property rights; harass or threaten individuals; interfere with telecommunications networks; or engage in activity prohibited by the Acceptable Use Policy. Violation of this Policy may result in suspension or termination of the Services.

The Customer is responsible for: obtaining all legally required notices and consents; maintaining accurate caller identification where required; configuring emergency calling information; protecting user credentials; securing Customer Equipment; reviewing AI-generated communications; complying with telecommunications regulations; complying with privacy laws; complying with marketing laws; and training Authorised Users regarding lawful communications practices.

This Policy shall be interpreted together with the following incorporated documents: Master Terms of Service; Enterprise Privacy & Cookies Policy; Data Processing Addendum (DPA); AI Services Terms; AI Transparency & Responsible Use Policy;

Acceptable Use Policy; Service Level Agreement (SLA); and any applicable Order Form or Enterprise Agreement. Where a conflict exists regarding the processing of Personal Data, the Data Processing Addendum and Enterprise Privacy & Cookies Policy shall prevail to the extent of that conflict.

Sagecom may modify this Policy from time to time to reflect: changes in Applicable Law; regulatory guidance; telecommunications requirements; AI technologies; industry standards; security practices; or operational improvements. Material changes will become effective upon notice provided in accordance with the Master Terms of Service or as otherwise required by Applicable Law. Continued use of the Services after the effective date of an updated Policy constitutes acceptance of the revised Policy.