Data Processing Agreement

You are the controller of personal data in the systems we build and run for you. We are a processor acting on your documented instructions. Where we choose tools on your behalf, the statement of work records that choice as your instruction.

Processing covers the personal data your systems handle (typically caller and customer contact details, call recordings and transcripts, CRM records) for the duration of the engagement plus the retention period you set.

• Process only on your instructions; tell you if an instruction appears to breach the law.
• Keep everyone with access under a confidentiality obligation.
• Apply appropriate technical and organisational measures: least-privilege access, row-level security, encrypted transport and storage, secrets outside code, audit logs.
• Assist with data-subject requests, impact assessments and breach notifications.
• Notify you of a personal-data breach without undue delay and no later than 48 hours after becoming aware.
• Delete or return all personal data at the end of the engagement, at your choice, and delete copies unless law requires retention.
• Make available the information needed to demonstrate compliance and allow audits on reasonable notice.

We use the sub-processors listed on the sub-processors page. We give at least 14 days' notice of additions by updating that page and emailing engagement contacts; you may object on reasonable grounds and we will work to resolve it.

Where data leaves the EU/EEA (for example to a US-based model provider), transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses. Region selection is documented per engagement.

Voice agents identify themselves as automated and announce recording where consent is required. Recording retention defaults to 90 days and is configurable. Transcripts are stored in your accounts.