Data Processing Agreement (DPA)

1. Subject matter and scope

1.1 This DPA governs the processing of personal data that Ringroxy carries out on behalf of the Customer in connection with the provision of its AI-based receptionist and voice handling service.

1.2 Ringroxy processes personal data only in accordance with the Customer's documented instructions and applicable data protection legislation, including the GDPR.

2. Categories of data subjects and personal data

Data subjects: Callers, the Customer's own employees and contacts.

Categories of personal data:

• Voice recordings and transcriptions
• Phone numbers and caller metadata
• AI-generated summaries and action items
• Booking details (name, time, contact information)
• Account information (name, email, company data)

3. Processing purposes

Personal data is processed solely to deliver the Ringroxy service: receiving and handling calls, streaming audio for transcription and speech generation, generating responses and summaries, making bookings, sending notifications, and providing analytics to the Customer.

The Customer determines the purpose and lawful basis, provides transparent caller notices, and must not instruct Ringroxy to process unlawful content. Ringroxy will promptly inform the Customer if, in its opinion, an instruction infringes data-protection law, unless prohibited by law.

4. Retention and deletion

Default retention periods:

• Voice recordings: 30 days
• Raw transcriptions: 7 days
• Redacted transcriptions: 90 days
• AI summaries and call metadata: 12 months

The Customer may request shorter periods. On termination, Ringroxy will, at the Customer's choice, return or delete Customer personal data and existing copies within 90 days and normal backup cycles, unless law requires retention. Provider-side transient caches and security logs follow the applicable provider contract and are not treated as Customer-accessible platform storage.

5. Security measures

Ringroxy implements appropriate technical and organisational measures under Article 32, including encryption in transit and at rest where supported, least-privilege access control, authentication, audit logging, tenant isolation, secure development, backup, incident response, and periodic security testing. Personnel authorised to process personal data are bound by confidentiality.

6. Sub-processors

Ringroxy engages the sub-processors below to deliver the service. The Customer grants general authorisation for changes. Ringroxy will give at least 30 days' prior notice of a new or replacement material sub-processor. The Customer may object on reasonable data-protection grounds during that period. Ringroxy remains responsible for each sub-processor's performance of equivalent data-protection obligations.

7. Data breach notification

Ringroxy will notify the Customer of a personal data breach without undue delay and provide available information needed for the Customer's assessment and notifications. Taking account of the nature of processing and information available, Ringroxy will also reasonably assist with data-subject requests, security obligations, breach notifications, data-protection impact assessments, and prior consultation under Articles 32–36 GDPR.

8. Audits

Ringroxy will make available information necessary to demonstrate compliance with Article 28 and this DPA and contribute to audits, including inspections, by the Customer or an independent auditor mandated by the Customer. Audits require reasonable notice, must protect other customers and confidential information, and must not unreasonably disrupt the service.

9. International transfers

Primary application and database storage is configured in the EU/EEA. Some sub-processors or service features may process personal data outside the EU/EEA or through global infrastructure. In particular, when enabled, Gemini Live transcription sends live audio to Google Cloud's global Vertex AI endpoint; a global endpoint does not provide regional isolation.

Ringroxy will use a lawful transfer mechanism for restricted transfers, such as an adequacy decision or the EU Standard Contractual Clauses, and supplementary measures where required. The Customer authorises Ringroxy to enter into those mechanisms on its behalf where necessary to provide the service.