Data Processing Addendum

1. Parties and precedence

This Data Processing Addendum ("DPA") is entered into between the customer identified in the account ("Controller") and [LEGAL ENTITY], registered in [JURISDICTION] at [ADDRESS], trading as RevVane ("Processor"). It supplements the Terms of Service (the "Agreement"). If this DPA conflicts with the Agreement on the processing of Personal Data, this DPA prevails.

complete Execution route — click-accept at signup, countersigned PDF, or both: [EXECUTION METHOD].

2. Definitions

• Data Protection Law — the UK GDPR and Data Protection Act 2018, the EU GDPR, and any other law applicable to the processing, including US state privacy laws where relevant. complete confirm the final list at [APPLICABLE LAWS].
• Personal Data — personal data within Customer Data processed by the Processor under the Agreement.
• Customer Data — data the Controller connects, uploads or generates in the service, including call metadata, recordings, transcripts and derived labels.
• Processing, Controller, Processor, Data Subject, Personal Data Breach, Supervisory Authority — as defined in Data Protection Law.
• Subprocessor — a third party engaged by the Processor to process Personal Data.
• SCCs — the European Commission's Standard Contractual Clauses; the UK International Data Transfer Addendum where the UK GDPR applies.

3. Roles of the parties

The Controller is the controller of Personal Data contained in Customer Data. The Processor processes that Personal Data on the Controller's behalf. This is the important consequence: the caller on a recording is the Controller's data subject, not ours, and the Controller determines the purpose, the lawful basis and the retention.

The Processor is an independent controller for account, billing and security data relating to the Controller's own personnel, which is governed by the Privacy Policy rather than this DPA.

The Controller warrants that it has a lawful basis and, where required, consent and notice for recording calls and for disclosing those recordings to the Processor, in every jurisdiction concerned.

4. Scope, duration, nature and purpose

• Subject matter — provision of the RevVane call intelligence service.
• Duration — from acceptance of the Agreement until the Agreement ends and deletion under clause 12 completes.
• Nature of processing — collection from connected sources, storage, transcription of audio to text, automated labelling and scoring, aggregation, display, export, backup, deletion.
• Purpose — analysing inbound calls to produce revenue, quality and dispute analysis for the Controller; providing API and MCP access to that analysis; support and security of the service.
• Frequency — continuous, for as long as sources are connected.

5. Categories of data subjects and Personal Data

Special categories. The service is not designed for special-category data. A caller may nonetheless disclose health, financial or similar details on a call. The Controller must not connect sources whose recordings it is not entitled to process, and must tell the Processor before connecting a source in a vertical where special-category data is expected: [ADDITIONAL SAFEGUARDS, IF ANY].

6. Processor obligations

• Documented instructions. The Processor processes Personal Data only on the Controller's documented instructions, which comprise the Agreement, this DPA, the configuration the Controller sets in the product, and any further written instruction the parties agree. The Processor will tell the Controller if an instruction appears to infringe Data Protection Law.
• No training. The Processor will not use Personal Data — including recordings, transcripts and derived labels — to train, fine-tune or evaluate any machine learning model, and will require the same of its Subprocessors. This is an instruction the Controller may not waive by configuration.
• No secondary use. No sale of Personal Data, no sharing for cross-context behavioural advertising, no use outside the direct business relationship.
• Confidentiality. Personnel with access are bound by confidentiality obligations and access is limited to those who need it to provide or support the service.
• Security. The measures in Annex II, appropriate to the risk under Article 32.
• Assistance with data-subject requests. The service provides search, export, correction and deletion so the Controller can answer most requests itself. Where it cannot, the Processor will assist within [ASSISTANCE SLA] and will not respond to a data subject directly except to direct them to the Controller, unless legally required.
• Assistance with DPIAs and prior consultation under Articles 35 and 36, taking into account the information available to the Processor.
• Breach notification. The Processor will notify the Controller without undue delay and in any event within [BREACH NOTIFICATION WINDOW — e.g. 72 HOURS] of becoming aware of a Personal Data Breach affecting Customer Data, with the nature of the breach, the categories and approximate volume affected, likely consequences, and the measures taken. Initial notice will not be delayed to complete the investigation.
• Records. The Processor maintains records of processing carried out on behalf of the Controller under Article 30(2).
• Government access. The Processor will notify the Controller of any binding request for Customer Data from a public authority unless legally prohibited, and will challenge requests that appear unlawful.

7. Controller obligations

• Establish and document a lawful basis for the processing, including for call recording and for disclosure to the Processor and its Subprocessors.
• Provide the notices and obtain the consents its jurisdictions require — including all-party consent where applicable — and honour objections.
• Give instructions that comply with Data Protection Law.
• Manage its own users, roles and API keys, and revoke access promptly when someone leaves.
• Not upload Personal Data that is outside the scope described in clause 5 without agreeing it in writing first.

8. Subprocessors

• The Controller gives general written authorisation for the Processor to engage Subprocessors. The current list is published at /subprocessors and forms Annex III.
• Each Subprocessor is engaged under a written contract imposing data protection obligations no less protective than this DPA, including the no-training instruction.
• The Processor remains fully liable to the Controller for its Subprocessors' performance.
• Change notice and objection. The Processor will give at least [SUBPROCESSOR NOTICE PERIOD — e.g. 30 DAYS] notice before adding or replacing a Subprocessor, by email to the notification address on file and by updating the published list. The Controller may object on reasonable data protection grounds within [OBJECTION WINDOW]. The parties will work in good faith to find an alternative; if none is available, the Controller may terminate the affected service without penalty and receive a pro-rated refund of prepaid fees.

9. International transfers

• Hosting and processing locations are listed in Annex III and at /subprocessors. Primary region: [PRIMARY HOSTING REGION].
• Where Personal Data is transferred out of the UK or EEA to a country without an adequacy decision, the transfer is made under the SCCs, which are incorporated by reference: complete [MODULE 2 (CONTROLLER-TO-PROCESSOR) / MODULE 3 (PROCESSOR-TO-PROCESSOR) — SELECT AND ATTACH], with the UK International Data Transfer Addendum where the UK GDPR applies.
• SCC operative choices to be completed before signature: docking clause [YES/NO]; Clause 9 option [OPTION 1 / OPTION 2]; Clause 11 independent redress option [INCLUDE/OMIT]; Clause 17 governing law [MEMBER STATE]; Clause 18 forum [MEMBER STATE].
• A transfer risk assessment is maintained and available on request.

10. Audit

• The Processor will make available the information reasonably necessary to demonstrate compliance with Article 28, including this DPA, Annex II, the Subprocessor list and answers to a written security questionnaire.
• The Controller may audit no more than once in any twelve months, on [AUDIT NOTICE PERIOD] written notice, during business hours, under confidentiality, and without access to other customers' data or to systems where access would breach the Processor's obligations to others. Additional audits may follow a Personal Data Breach or a Supervisory Authority instruction.
• Costs: complete [WHO BEARS AUDIT COSTS].
• The Processor does not currently hold a SOC 2 report or an ISO 27001 certificate and does not claim one. If that changes, a current report may be offered in place of an on-site audit.

11. Liability

Liability under this DPA is subject to the limitations and exclusions in the Agreement, except where Data Protection Law prevents it — in particular a data subject's rights under Article 82 and under the SCCs.

12. Deletion and return on termination

• On termination, the Controller may export Customer Data in a structured, machine-readable format for [EXPORT WINDOW — e.g. 30 DAYS]. Export is self-service on every plan.
• After that window the Processor will delete Personal Data within [DELETION SLA], unless retention is required by law, and will confirm deletion in writing on request.
• Backups containing Personal Data are overwritten on their normal cycle, currently [BACKUP CYCLE]; during that period the data remains protected by this DPA and is not restored into the live service except for disaster recovery.
• The Controller may request earlier deletion of specific recordings, transcripts or calls at any time during the term.

13. Order of annexes

Annex I (details of processing), Annex II (technical and organisational measures) and Annex III (Subprocessors) form part of this DPA.

14. Signature

complete Signature blocks, effective date and the notification address for Subprocessor changes: [SIGNATURE BLOCK]. Request a copy for review through /contact before you sign up, not after.