Data Processing Agreement

1. Parties 
1.1 Data Controller: The Customer identified in the Principal Agreement (“Controller”). 
1.2 Data Processor: VoxFlo AI Ltd, 7 Bell Yard, London, WC2A 2JR, United Kingdom. 
 
2. Purpose and Scope 
This DPA governs VoxFlo’s processing of personal data on behalf of the Controller as required to provide cloud call recording, speech-to-text, CRM sync integrations, audit logs, telephony metadata processing, platform analytics, and AI-assisted call analysis. 
 
3. Definitions 
Terms such as personal data, processing, data subject, controller, processor, and supervisory authority have meanings defined in applicable data-protection laws. 
 
4. Nature and Categories of Data 
4.1 Types of personal data: caller/callee names, numbers, company details, emails, CRM identifiers, IPs, audio recordings, transcripts, metadata, logs. 
4.2 Data subjects: employees, customers, prospects, call participants. 
4.3 Duration: For the agreement term + 30 days unless otherwise instructed. 
 
5. Processor Obligations 
– Process only on documented instructions. 
– Maintain confidentiality. 
– Implement security measures including 256-bit encryption, MFA, backups, segmentation. 
– Manage sub-processors with equivalent obligations. 
– Assist with Data Subject Rights. 
– Notify Controller of breaches without undue delay (target 48 hours). 
– Delete/return data after termination. 
 
6. Controller Obligations 
Controller must manage consent, ensure lawful basis, configure retention, and provide only necessary personal data. 
 
7. International Data Transfers 
Standard Contractual Clauses, UK Addendum, and Data Privacy Framework apply. 
 
8. Audit Rights 
Controller may audit once per 12 months with 30 days’ notice. 
 
9. Sub-Processing 
Sub-processors may include hosting, AI engines, analytics, CRM integrators. Full list available via privacy@VoxFlo.co.uk. 
 
10. Liability 
As defined in Principal Agreement; nothing limits unlawful processing liabilities. 
 
11. Governing Law 
England & Wales. 
 
12. Order of Precedence 
DPA overrides Principal Agreement; SCCs override DPA; Privacy Policy supplements but does not override.