Data Processing Agreement

In this DPA, "you" and "Customer" means the person or entity that has an account with us, and "we", "us", and "Voice Outreach" means the entity identified in section 19 of our Privacy Policy. "Customer Personal Data" means personal data contained in the data you or your users submit to the Service, including lead records, message content, and voice samples.

For Customer Personal Data, you act as the controller and we act as your processor. We process Customer Personal Data only on your documented instructions, which consist of this DPA, the Terms of Service, the configuration choices you make in the Service, and any further written instruction you give us.

Separately, we act as a controller for our own account, authentication, billing, support, and service-security data. That processing is described in our Privacy Policy and is not governed by this DPA.

Subject matter: provision of the Voice Outreach platform, which generates and sends outreach messages and voice notes across connected third-party communication platforms.

Duration: the term of your subscription, plus the retention and deletion periods described in section 9.

Nature of processing: collection, storage, organization, retrieval, generation of derived content, transmission, and deletion, carried out by automated means.

Purpose: operating the Service for you, including message and voice generation, campaign scheduling and delivery, reply tracking, and lead management.

Data subjects: your authorized users, and the individuals you choose to contact through the Service (your leads and recipients).

Categories of personal data:

• Identification and contact data: name, job title, employer, profile URL, email address.
• Communication data: message drafts, sent message content, replies, delivery and acceptance status, and connected-account identifiers.
• Audio data: voice samples you upload for authorized voice profiles, and generated voice notes.
• Any further data you choose to add to lead records, including free-text notes.

The Service is not designed for special categories of personal data under Article 9 of the GDPR, and you agree not to submit such data to the Service.

We will:

• Process Customer Personal Data only on your instructions, and tell you if we believe an instruction infringes applicable data-protection law.
• Not sell Customer Personal Data, and not use it to train our own or any third party's generalized AI models.
• Ensure that personnel with access to Customer Personal Data are bound by confidentiality and are granted access only as needed to operate or support the Service.
• Maintain the technical and organizational measures described in section 11.
• Assist you, at your cost where the effort is substantial, with data protection impact assessments and prior consultations with a supervisory authority, to the extent they relate to our processing.

You give us general authorization to engage subprocessors. Our current subprocessors, what each one processes, and where processing takes place are listed on our Subprocessors page.

We impose data-protection obligations on each subprocessor that are no less protective than those in this DPA, and we remain responsible to you for a subprocessor's performance. Before a new subprocessor begins processing Customer Personal Data, we will give at least 30 days' notice, and you may object on reasonable data-protection grounds under the process described on that page.

Customer Personal Data may be processed outside the European Economic Area or the United Kingdom, including in the United States. Where we or a subprocessor transfer Customer Personal Data out of the EEA or the UK to a country without an adequacy decision, that transfer is made under the European Commission's Standard Contractual Clauses, in the module appropriate to the parties, together with the UK International Data Transfer Addendum where UK data is involved.

You instruct us to carry out those transfers as necessary to provide the Service. Copies of the transfer mechanisms we rely on for a given subprocessor are available on request.

The Service gives you direct access to Customer Personal Data so that you can retrieve, correct, export, and delete records in order to answer requests from data subjects yourself.

If a data subject contacts us directly about Customer Personal Data, we will not respond on the substance, except to confirm that we process the data on behalf of a customer and to refer the request onward. We will notify you of the request without undue delay and give reasonable assistance in responding, taking the nature of the processing into account.

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. Our notice will describe the nature of the breach, the categories and approximate volume of data and data subjects affected so far as known, the likely consequences, and the measures taken or proposed.

We will provide further information as the investigation develops, and reasonable assistance with any notification you must make to a supervisory authority or to affected data subjects. Notices will be sent to the account owner's email address, so please keep it current.

You may delete Customer Personal Data from within the Service at any time. On termination or expiry of your subscription, we will delete Customer Personal Data within 30 days, except where we are required by law to retain it, or where it persists in routine encrypted backups. Backups are rotated out within 90 days.

Before termination you can export your data from within the Service. If you need an export afterwards, contact us within 30 days of termination and we will provide it in a structured, commonly used format.

On reasonable written request, and no more than once in any 12-month period unless a supervisory authority or a personal data breach requires otherwise, we will provide the information reasonably necessary to demonstrate our compliance with this DPA. Where a subprocessor holds an independent audit report or certification, we will provide or point you to it in place of an on-site audit where that reasonably satisfies your obligation under Article 28(3)(h).

Audit information is confidential, and we may charge for effort that goes beyond a reasonable response.

We maintain measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and unauthorized access. These currently include:

• Encryption of data in transit using TLS, and encryption at rest for stored data and backups.
• Role-based access control, least-privilege access, and multi-factor authentication on administrative accounts.
• Tenant isolation, so that each account can access only its own data.
• Application and error logging, with monitoring and alerting on failures.
• Regular automated backups, with restore capability.
• Managed infrastructure providers responsible for physical and network security of the hosting environment.
• Dependency and patch management for the application and its libraries.
• A documented process for triaging and responding to security incidents.
• Credential and secret management separated from application source code.

We may update these measures over time, provided the level of protection is not reduced.

You are the controller of Customer Personal Data, and you are responsible for:

• Having a lawful basis to process the personal data you submit, and to contact the individuals you contact through the Service.
• Providing any notice and honoring any objection or opt-out that applicable law requires, as also described in our Anti-Spam & Outreach Compliance Policy.
• Holding the rights and consents needed for any voice sample you upload, as described in our AI Voice Consent Policy.
• The accuracy and legality of your instructions, and the security of your account credentials and connected accounts.

This DPA forms part of the Terms of Service. If there is a conflict between this DPA and the Terms of Service on the processing of Customer Personal Data, this DPA prevails. If there is a conflict between this DPA and the Standard Contractual Clauses, the Clauses prevail.

We may update this DPA to reflect changes in law, regulatory guidance, or our processing, provided we do not materially reduce the protections it gives you. Material changes will be posted here and the "Effective" date above will be adjusted.

If you need a countersigned copy, or need us to review your own DPA template, email privacy@voiceoutreach.ai with your legal entity name and registered address. We aim to respond within 1 business day.

Data-protection questions and requests under this DPA should go to privacy@voiceoutreach.ai. Our legal identity and postal address are in section 19 of the Privacy Policy.