Data Processing Addendum

This DPA governs Processor's processing of Personal Data on Controller's behalf in connection with the Service described in the Agreement. Capitalised terms not defined here have the meaning given to them in the Agreement.

• "Applicable Data Protection Laws": the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection (FADP), and any other data-protection law applicable to the processing.
• "Controller", "Processor", "Sub-processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing": as defined in Article 4 GDPR.
• "Customer Personal Data": Personal Data processed by Processor on Controller's behalf as described in Annex 1.
• "SCCs": the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, as amended.
• "UK Addendum": the International Data Transfer Addendum to the SCCs issued by the UK ICO.
• "Restricted Transfer": a transfer of Personal Data from the EU/EEA, UK, or Switzerland to a country not recognised as adequate by the European Commission, the UK ICO, or the Swiss FDPIC respectively.
• "Sub-processors List": the list of approved Sub-processors maintained at /sub-processors.
• "TOMs": the technical and organisational measures described in Annex 4.

The parties acknowledge and agree that, with respect to the Processing of Customer Personal Data:

• Controller is the data controller within the meaning of Article 4(7) GDPR;
• Processor is the data processor within the meaning of Article 4(8) GDPR;
• Each Party is responsible for compliance with the Applicable Data Protection Laws applicable to its role.

For the avoidance of doubt: Customer is the controller of the End-Customer Personal Data processed during Calls. Processor is also a separate, independent controller for limited categories of data described in the Privacy Policy (e.g., Customer's billing and account data); that controller-level processing is outside the scope of this DPA.

The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects are described in Annex 1. Processor will process Customer Personal Data only:

1. on documented instructions from Controller, including with regard to Restricted Transfers, unless required to do otherwise by EU or Member State law (in which case Processor will inform Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest);
2. for the purpose of providing the Service, performing the Agreement, and complying with Controller's documented instructions;
3. in accordance with the TOMs in Annex 4.

The Agreement, this DPA, the Sub-processors List, and Controller's configuration of the Service (e.g., script approval, recording on/off, retention period) constitute Controller's complete documented instructions. Any additional instructions must be agreed in writing.

If Processor in its reasonable opinion considers that an instruction infringes Applicable Data Protection Laws, it will inform Controller without delay and may pause the processing pending resolution.

The categories of Personal Data and Data Subjects are described in Annex 1. Special categories of Personal Data within the meaning of Article 9 GDPR are not requested by the Service by design. Processor's PII redaction layer detects and replaces sensitive identifiers (e.g., card numbers, national IDs, e-mail addresses) in transcripts before write to long-term storage. If Controller's configuration nonetheless results in special-category data being processed, Controller is solely responsible for the lawful basis under Article 9 GDPR and must notify Processor in writing.

4.1 Voice audio is processed for communication purposes only — not for biometric identification

The Service involves the processing of voice audio (raw audio files and transcripts) for the purpose of conducting, transcribing, and summarising voice conversations on Controller's behalf. Processor does not apply, and shall not apply, any technical processing or analysis of voice audio for the purpose of uniquely identifying a natural person within the meaning of Article 4(14) GDPR (Biometric Data) or for any other purpose that would result in the processing of biometric data within the meaning of Article 9(1) GDPR. Processing of voice data is limited to communication, speech-to-text transcription, intent classification, sentiment indicators (where Controller enables them), and other content-based analytics required to deliver the Service. Voiceprint generation, speaker-recognition, voice-based authentication, and similar identification techniques are not features of the Service. Accordingly, voice audio processed by the Service does not, by itself or as configured under this DPA, constitute special-category data under Article 9 GDPR.

Where Controller wishes to deploy any feature, configuration, or integration that would cause the Service to process voice audio for the purpose of uniquely identifying a natural person, Controller must (a) obtain explicit consent from each Data Subject under Article 9(2)(a) GDPR or rely on another lawful basis under Article 9(2), (b) issue a written instruction to Processor in advance, and (c) execute any additional technical and organisational safeguards that Processor reasonably requires.

Processor will:

1. Confidentiality: ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality;
2. Security: implement and maintain the TOMs in Annex 4, including, in accordance with Article 32 GDPR, encryption of Personal Data, ongoing confidentiality, integrity, availability, and resilience of the processing systems, the ability to restore availability and access in a timely manner after an incident, and a process for regularly testing the effectiveness of the TOMs;
3. Sub-processing: only engage Sub-processors in accordance with Section 6;
4. Assistance with Data Subject requests: taking into account the nature of the processing, assist Controller by appropriate technical and organisational measures, in so far as possible, in fulfilling Controller's obligation to respond to requests for exercising Data Subject rights under Articles 12-22 GDPR;
5. Assistance with security, breach, DPIA, and prior consultation: assist Controller in ensuring compliance with Articles 32-36 GDPR, taking into account the nature of the processing and the information available to Processor;
6. Return or deletion: at Controller's option, delete or return all Customer Personal Data to Controller after the end of the provision of services as described in Section 11;
7. Audit: make available to Controller all information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits as described in Section 8.

6.1 General authorisation

Controller grants Processor general authorisation to engage Sub-processors for the processing of Customer Personal Data, subject to compliance with this Section 6.

6.2 Current list

The current list of Sub-processors is published at /sub-processors and reproduced in Annex 2. Controller acknowledges and approves the Sub-processors listed there as of the Effective Date.

6.3 Notification of changes

Processor will give Controller at least 30 days' prior notice of the addition, replacement, or removal of any Sub-processor by updating the Sub-processors List and either (i) emailing the Customer's primary contact on file or (ii) posting an in-app notice. Processor maintains an opt-in subscription channel for Customers that wish to receive Sub-processor changes by email regardless of materiality.

6.4 Right to object

Controller may object to a proposed Sub-processor change on documented data-protection grounds within 30 days of receiving notice. The Parties will discuss in good faith. If they cannot resolve the objection within a further 30 days, Controller may, as its sole and exclusive remedy, terminate the affected portion of the Service for material breach in accordance with the Agreement and receive a pro-rata refund of any pre-paid fees attributable to the unused period.

6.5 Sub-processor agreements

Processor will enter into a written agreement with each Sub-processor that imposes data-protection obligations no less protective than those in this DPA, including obligations as to security, confidentiality, sub-processing, return/deletion, audit, and assistance with Data Subject rights. Processor remains liable to Controller for the performance of each Sub-processor's data-protection obligations as if Processor performed those obligations itself.

6.6 Zero-retention chain

Sub-processors that act in the AI orchestration, LLM, and TTS layers operate under contractual zero-retention restrictions: they do not store, log, or use Customer Personal Data after the conclusion of each request beyond the minimum necessary to provide the requested response, and they do not use Customer Personal Data to train or fine-tune any model.

Processor will only Process Customer Personal Data in a third country if it has implemented appropriate safeguards in accordance with Articles 44-49 GDPR. Where Processor or any Sub-processor processes Customer Personal Data in a country that is not subject to a Commission adequacy decision (or, for UK transfers, an ICO adequacy regulation; for Swiss transfers, an FDPIC adequacy decision), the SCCs (and, where applicable, the UK Addendum and Swiss adaptations) apply as described in Annex 3.

The Parties agree that:

• The SCCs Module 2 (controller-to-processor) applies as between Controller (data exporter) and Processor (data importer) for Restricted Transfers from Controller to Processor;
• The SCCs Module 3 (processor-to-sub-processor) applies as between Processor (data exporter) and any Sub-processor (data importer) for Restricted Transfers further down the chain;
• Annex 3 sets out Annexes I, II, and III to the SCCs;
• The Parties accept the SCCs without modification.

Processor has performed a Transfer Impact Assessment ("TIA") for each Restricted Transfer covered by this DPA, taking into account the laws and practices of the destination country and the supplementary measures in Annex 4. The TIA summary is maintained as an internal compliance record that informs the Processor's safeguard design.

8.1 Documentation

Processor will provide Controller with all information necessary to demonstrate compliance with Article 28 GDPR, including the TOMs, Sub-processors List, breach-response runbook summary, and the most recent third-party security report (where available).

8.2 Audit

If the documentation in Section 8.1 is insufficient, Controller (or an independent auditor mandated by Controller and reasonably acceptable to Processor) may audit Processor's compliance once per twelve-month period (or more frequently following a Personal Data Breach affecting Controller, or as required by a competent supervisory authority), subject to the following:

• at least 30 days' prior written notice;
• during normal business hours and without disrupting Processor's operations;
• under a confidentiality agreement reasonably acceptable to Processor;
• limited to information and personnel relevant to Processor's compliance with this DPA and the SCCs;
• at Controller's expense (Processor will charge reasonable time-and-materials for personnel hours required to support the audit beyond a 1-day default allowance);
• excluding access to other customers' data, Processor's commercially-sensitive information unrelated to compliance, and any system that would expose Sub-processors' confidential information.

Where Processor obtains a SOC 2 Type II report or equivalent third-party certification, Controller agrees that the audit obligation may be satisfied by reference to that certification through the documentation channels described in Section 8.1, except where the supervisory authority requires otherwise.

9.1 Notification

Processor will notify Controller without undue delay, and in any event within 24 hours of becoming aware, of any Personal Data Breach affecting Customer Personal Data. The initial notification will include the information then available; subsequent updates will follow as more information becomes known. Final detail will be provided within 72 hours where feasible.

9.2 Information provided

The notification will include, to the extent known: the nature of the breach (including, where possible, the categories and approximate number of Data Subjects and personal-data records concerned); the likely consequences; the measures taken or proposed to be taken to address the breach and mitigate possible adverse effects; and the name and contact details of the Processor's contact point.

9.3 No supervisory notification by Processor

Processor will not notify the supervisory authority on Controller's behalf and will not disclose the breach publicly until Controller has had a reasonable opportunity to coordinate communications, except as legally required.

Processor will, taking into account the nature of the processing, assist Controller by appropriate technical and organisational measures, in so far as possible, to fulfil Controller's obligation to respond to requests by Data Subjects to exercise their rights under Articles 12-22 GDPR. Where Processor receives a request directly from a Data Subject relating to Customer Personal Data, Processor will (a) not respond on the merits unless authorised by Controller; (b) forward the request to Controller without undue delay; and (c) acknowledge receipt to the Data Subject indicating that Controller is the responsible party.

On termination or expiry of the Agreement, Processor will, at Controller's option:

• Return Customer Personal Data to Controller in a structured, commonly-used, machine-readable format (CSV / JSON / WAV for recordings) within 30 days; or
• Delete the Customer Personal Data, subject to legal-retention obligations applicable to the Operator and its merchant of record (e.g., bookkeeping or tax laws that require retention of invoice metadata for several years after the end of the fiscal year).

If Controller does not specify a choice within 30 days of termination, Processor will provide a final 30-day grace period during which Controller may export, after which Processor will delete or anonymise.

Backups containing residual Customer Personal Data are retained in encrypted form for up to 90 days for disaster-recovery and rolled into the deletion cycle automatically.

12.1 Cap inherits from Agreement

12.2 Direct claims by Data Subjects

Notwithstanding Section 12.1, where a Data Subject has a third-party-beneficiary right under the SCCs to bring a direct claim against the Processor or a Sub-processor, the limits of liability in the Agreement do not apply to that claim to the extent prohibited by the SCCs.

12.3 Indemnity for unlawful instructions

Controller indemnifies Processor against any claim, liability, fine, or cost arising out of (a) Controller's failure to provide Processor with documented instructions that are sufficient and lawful under Applicable Data Protection Laws; (b) Controller's processing of Personal Data in violation of Applicable Data Protection Laws; or (c) Controller's failure to obtain consents or provide notices required under Applicable Data Protection Laws.

In the event of conflict between the Agreement, this DPA, and the SCCs:

1. The SCCs prevail in respect of Restricted Transfers;
2. This DPA prevails over the Agreement on data-protection matters;
3. The Agreement governs all other matters.

For all questions and notices under this DPA contact [email protected] (Processor) and/or [email protected] (the Operator's designated EU representative — full identity in our Legal Notice).