Data Processing Addendum

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person processed through the Service
• "Processing" means any operation performed on Personal Data
• "Sub-processor" means any third party engaged by Processor to process Personal Data

2. Scope and Roles

Voxilo acts as a data Processor on behalf of the Client (Controller). We process Personal Data only as instructed by the Controller and as necessary to provide the Service.

3. Data Processing Obligations

Voxilo will:

• Process Personal Data only on documented instructions from the Controller
• Ensure personnel authorized to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to data subject rights requests
• Delete or return all Personal Data upon termination of the Service
• Make available information necessary to demonstrate compliance

4. Sub-processors

Current sub-processors are listed in our Privacy Policy. We will provide 30 days' advance notice before engaging a new sub-processor. The Controller may object to a new sub-processor within 14 days of notice.

5. International Transfers

Where Personal Data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission (Commission Implementing Decision 2021/914).

6. Breach Notification

We will notify the Controller of any Personal Data breach without undue delay (and within 72 hours of becoming aware) and provide information necessary for the Controller to meet its own breach notification obligations.

7. Audit Rights

The Controller may audit Voxilo's compliance with this DPA once per year with 30 days' written notice, during normal business hours, and subject to reasonable confidentiality obligations.

To request a signed DPA, contact legal@voxilo.ai.