Annex 1 — Data Processing Addendum

This Annex 1 forms part of the Agreement. It states the terms on which VoxTelAI processes Personal Data on the Customer's behalf, identifies the processing VoxTelAI carries out for its own purposes, sets out the international-transfer mechanisms, and contains the Regional DP Annex (DPA14). Capitalised terms have the meanings given in section 1 of the General Terms.

DPA1. Scope, execution and duration

DPA1.1 Status. This Annex applies wherever VoxTelAI processes Personal Data as a processor on the Customer's behalf in supplying the Services. It is intended to satisfy Article 28(3) of the GDPR and of the UK GDPR and the processor-contract requirements of every other Data Protection Law that applies to that processing, including the laws addressed in the Regional DP Annex (DPA14).

DPA1.2 What it does not cover. This Annex does not apply to processing VoxTelAI carries out as an independent controller, identified in DPA2. That processing is governed by section 16 of the General Terms, by Data Protection Law and by VoxTelAI's privacy notice at rolycall.ai/privacy.

DPA1.3 No reduction of protection; precedence. This Annex adds detail to section 16 of the General Terms and does not reduce it. Precedence — including the priority of the EU SCCs and the UK Addendum on the matters they govern, and the matters on which the Order Form states otherwise — is governed by section 2 of the General Terms. Nothing in this Annex limits a data subject's rights, or a Party's obligations, under Data Protection Law.

DPA1.4 Execution. No separate signature is required. Signature of the Order Form, or acceptance of the Online Terms, executes this Annex, including the EU SCCs and the UK Addendum that DPA11 incorporates. Either Party may request a countersigned copy; its absence does not affect this Annex or any transfer mechanism.

DPA1.5 Duration. This Annex applies for the Term, continues to apply to Personal Data for as long as VoxTelAI holds it as a processor, and survives termination. DPA12 governs deletion and return.

DPA1.6 Changes. This Annex changes as section 19 of the General Terms provides: for a signed account only by signed amendment, and for a self-serve account as the Online Terms (T7) provide. A change that Data Protection Law, a supervisory authority, a court or a change to an approved transfer mechanism requires takes effect on the date required, with notice as soon as practicable. If such a change is materially adverse to the Customer, the Customer may terminate the affected Service without charge by notice given before it takes effect or, if notice is given later, within 30 days after it, and VoxTelAI refunds the unapplied Prepaid Balance attributable to that Service under Schedule B (B7). A security-measure change that does not reduce protection (DPA5.3) and a Sub-processor change notified under DPA6.3 are not amendments of this Annex.

DPA1.7 Modules. Where a Module applies, it supplements this Annex on its subject: Module EU/UK (EU4 to EU6) on roles, representatives and data subject requests in the EEA and the UK; Module US (US5 and US9) on customer network information, lawful intercept, biometric identifiers and US state privacy laws, none of which is addressed here.

DPA2.2 The first row governs content and media while VoxTelAI conveys, stores or otherwise processes them on the Customer's instructions; the third row governs only the records of that conveyance and the copy Applicable Law requires. Where one item exists in both forms, each copy follows its own row: a deletion instruction under DPA12 applies to the processor copy and does not reach a record or copy the third row covers. Where data otherwise falls within more than one row, the row describing the purpose for which it is processed at the time governs.

DPA2.3 Independent-controller processing. For the data in the last three rows the Customer cannot instruct VoxTelAI, and the instruction, deletion and Sub-processor terms of this Annex do not apply. VoxTelAI processes that data for the purposes stated, under its own lawful basis — where the GDPR applies, Article 6(1)(b), (c) or (f) as the purpose requires — and is separately responsible for its own compliance. It retains call detail records, registration records and traceback correspondence for the record-keeping period in section 10 of the General Terms, and longer only where Applicable Law requires; consent, suppression and list records the Customer uploads or generates remain Customer Data under the first row. Its balancing assessment for each legitimate-interest purpose is available on request under DPA10.

DPA2.4 No joint control intended. Supplying the Platform does not make VoxTelAI a joint controller of Customer Data, and VoxTelAI does not obtain consent from, or give privacy notices to, End Users on the Customer's behalf. If an authority or court nonetheless finds the Parties to be joint controllers of an operation, then as between them the Customer answers to the data subjects with whom it or the clients it serves through the Platform have the relationship, VoxTelAI is transparent about the Platform through its privacy notice, and each bears the consequences of its own failure; a data subject's rights against either Party are unaffected.

DPA2.5 Customer's obligations as controller. The Customer must: (a) have and keep a lawful basis under the Data Protection Law of each Destination for all Personal Data it submits to, generates through or instructs VoxTelAI to process through the Services, including cold, purchased or third-party contact lists, which VoxTelAI does not review or approve; (b) give the privacy notices that law requires, including that VoxTelAI — a processor established in the United States and hosting in Germany — is used; (c) obtain and record the consents that law requires for recording, monitoring, transcription, AI processing, automated dialling and marketing; (d) configure the recording, announcement, retention, access and region settings in the Portal to match its obligations; and (e) handle data subject requests, with VoxTelAI's assistance under DPA8. The Customer warrants that its instructions and the Personal Data it submits comply with Data Protection Law and that it has authority to give its instructions.

DPA2.6 Emergency-services data. No Service carries calls to an Emergency Number (General Terms section 8), so VoxTelAI collects, holds and transmits no registered-address, dispatchable-location or other emergency-services data.

DPA3. Instructions and particulars of processing

DPA3.1 Documented instructions. VoxTelAI processes Personal Data as a processor only on the Customer's documented instructions, including as to transfers to a third country, unless Applicable Law to which VoxTelAI is subject requires otherwise. The documented instructions are, and are limited to: this Annex; the Agreement, including each Schedule; each accepted Service Order; the configuration the Customer applies in the Portal or through the API; a support request the Customer submits; and any further written instruction the Parties agree.

DPA3.2 Unlawful instructions. VoxTelAI will inform the Customer without undue delay if, in its opinion, an instruction infringes Data Protection Law, and may suspend performance of that instruction until the Customer withdraws or amends it. Such a suspension is not a breach of the Agreement or of Schedule C. If the Parties cannot agree a lawful instruction within 30 days, either may terminate the affected Service without charge, and DPA1.6 applies to the Prepaid Balance.

DPA3.3 Processing required by law. Where Applicable Law to which VoxTelAI is subject requires it to process Personal Data otherwise than on the Customer's instructions, VoxTelAI will inform the Customer of the requirement before processing, unless that law prohibits it on important grounds of public interest. DPA11.8 states VoxTelAI's commitments on public-authority requests.

DPA3.6 Special categories. No Service requires special categories of Personal Data or data relating to criminal convictions and offences. Such data may appear incidentally in call content, recordings, AI Output, message content or contact lists the Customer chooses to process; where it does, the Customer must hold the condition Data Protection Law requires, configure retention and access accordingly, and not use beta or preview features for it.

DPA3.7 Biometric identifiers. VoxTelAI does not create, store or use a voiceprint or other biometric identifier except where the Customer enables a feature that requires one, such as voice cloning. Where the Customer does, it is the controller of that data and must hold the consent, notice and retention arrangements Data Protection Law requires; VoxTelAI processes it as a processor under this Annex.

DPA3.8 Data the Services are not designed for. The Customer must not knowingly submit, or instruct VoxTelAI to process: payment card data within the scope of the payment card industry data security standard; health records subject to a law that requires a specific processor agreement VoxTelAI has not signed; government-issued identifiers beyond those Schedule A requires for registration; or Personal Data of a person VoxTelAI is told is a child, other than as an incidental caller or called party.

DPA4. Confidentiality and personnel

DPA4.1 VoxTelAI ensures that each person it authorises to process Personal Data: (a) is bound by a written duty of confidentiality that survives the end of their engagement, or by an appropriate statutory duty; (b) is trained in data protection and information security in proportion to their role, on appointment and regularly thereafter; (c) has access only to the Personal Data, and only to the extent, the role requires; and (d) loses that access on the day the engagement or the role ends.

DPA4.2 VoxTelAI carries out background verification of personnel with administrative access to production systems, where lawful and proportionate to the role, before granting that access. It remains responsible for its personnel's acts and omissions in relation to Personal Data as if they were its own.

DPA5.3 Changes. VoxTelAI may update DPA5.2 provided the overall level of protection is not reduced; a change that would reduce it is an amendment of this Annex under DPA1.6.

DPA5.4 Customer's share. Security depends on measures only the Customer can take: keeping credentials secure; setting concurrency, spend and Destination controls; managing its own network, session border controllers, devices and endpoints; assigning and reviewing Portal roles; and choosing retention and access settings. VoxTelAI is not responsible for a compromise caused by the Customer's failure to take those measures, except to the extent VoxTelAI's own breach contributed to it.

Hosting is not a Sub-processor category: production infrastructure runs on hardware VoxTelAI operates in colocated data centres (DPA5.2, TOM-10).

DPA6.3 Notice of change. VoxTelAI gives at least 30 days' notice by email to the Customer's address for Sub-processor change notices under DPA15.2 — a Portal notice may accompany but not replace it — before a new or replacement Sub-processor processes Personal Data, stating the name, the processing performed, the categories of Personal Data, the location and the transfer mechanism. Where a provider gives VoxTelAI shorter notice of a change of entity, VoxTelAI forwards it by email within 1 Business Day; the 30 days then run from VoxTelAI's email, unless the provider's notice as forwarded itself gives the Customer at least 30 days before the new entity processes Personal Data, in which case that period applies. No new entity processes Personal Data before the period ends.

DPA6.4 Objection. The Customer may object on reasonable data-protection grounds by notice to legal@rolycall.com within the notice period. The Parties will discuss the objection in good faith, and VoxTelAI will use reasonable efforts to make available a configuration change or a commercially reasonable alternative that avoids the objected processing.

DPA6.5 Unresolved objection. If the Parties cannot agree a solution before the change takes effect, the Customer may terminate the affected Service without charge, and VoxTelAI refunds the unapplied Prepaid Balance attributable to that Service under Schedule B (B7).

DPA6.6 Terms imposed on Sub-processors. VoxTelAI engages each Sub-processor under a written contract imposing data-protection, confidentiality and security obligations no less protective than this Annex, including the no-training prohibition in DPA7, the security standard in DPA5, breach notification sufficient for VoxTelAI to meet DPA9 and, where the transfer is restricted, a valid mechanism under DPA11. No onward transfer is made except under a mechanism at least as protective as the one under which VoxTelAI received the data.

DPA6.7 VoxTelAI remains fully liable to the Customer for each Sub-processor's performance, and for its acts and omissions in relation to Personal Data, as if they were VoxTelAI's own. On written request it will provide the data-protection terms of a Sub-processor contract, with commercial terms redacted, subject to section 14 of the General Terms.

DPA7. No model training; purpose limitation

DPA7.1 No training. VoxTelAI does not use Customer Data — including call content, recordings, AI Output, prompts, contact data and message content — to train, fine-tune or otherwise develop any machine-learning or artificial-intelligence model, its own or a third party's, generally available or internal, including speaker-identification, fraud-scoring, speech-recognition and intent-classification models. The Customer cannot instruct VoxTelAI to do so except by a separate written addendum signed by both Parties that itself records a lawful basis under the Data Protection Law of each Destination.

DPA7.2 Flow-down and provider settings. VoxTelAI contractually prohibits each model Sub-processor from the uses in DPA7.1, and enables and maintains every provider-side setting that disables training on, or extended retention of, Customer Data. The current list records the setting in force for each model Sub-processor. VoxTelAI will not engage a speech-recognition, speech-synthesis or language-model provider that offers no such setting unless the contractual prohibition alone is sufficient and VoxTelAI has notified the Customer of that fact under DPA6.3.

DPA7.3 De-identified information. VoxTelAI may use aggregated, de-identified statistical information about use of the Services — volumes, error rates, latency and equivalent metrics — to operate, secure, troubleshoot and improve the Services, provided it identifies no Customer, End User or individual and the de-identification is not reversible. VoxTelAI will not attempt to re-identify it and imposes the same prohibition on each recipient.

DPA7.4 VoxTelAI does not use Personal Data processed under this Annex for its own marketing, for profiling, or for any purpose of its own other than those in DPA3.5 and, for independent-controller data, DPA2.3.

DPA8. Assistance: data subject requests, impact assessments, prior consultation

DPA8.1 The Customer is responsible for responding to data subject requests — access, rectification, erasure, restriction, portability, objection (including to direct marketing) and rights concerning automated decision-making.

DPA8.2 Taking into account the nature of the processing, VoxTelAI assists the Customer by appropriate technical and organisational measures, so far as possible, to respond to those requests — principally through Portal and API functionality (search, listen, export, correct, delete, apply a legal hold, configure retention), which the Customer must use first. Where that is not sufficient, VoxTelAI provides reasonable additional assistance on written request within 5 Business Days, or within any shorter period necessary for the Customer to meet a statutory deadline of which it informs VoxTelAI.

DPA8.3 Requests received directly. If VoxTelAI receives a request relating to Personal Data it processes on the Customer's behalf, it will not respond substantively, except to acknowledge receipt and direct the individual to the Customer where it may lawfully do so, and will forward the request to the Customer's data-protection contact without undue delay.

DPA8.4 Costs of assistance. For assistance that materially exceeds the functionality of the Services VoxTelAI may charge only at the rate, and on the basis, the Rate Card or the Order Form states for such assistance, on prior notice of the estimate; if neither states one, the assistance is without charge. It will not charge for the first request in any 12-month period.

DPA8.5 Security, breach, impact assessments and prior consultation. Taking into account the nature of the processing and the information available to it, VoxTelAI assists the Customer in meeting its obligations under Articles 32 to 36 of the GDPR and their equivalents. On written request it will provide, within 15 Business Days, the information reasonably available to it that the Customer needs for an impact assessment relating to the Services — the particulars in DPA3.5, the measures in DPA5.2, the Sub-processor list, the transfer mechanisms in DPA11 and a description of the AI processing — and will answer a supervisory authority within the period the authority sets. Large-scale automated calling combined with AI profiling of natural persons is a candidate for an impact assessment, which is the Customer's to make.

DPA8.6 Records and data protection contact. VoxTelAI maintains the record of categories of processing that Article 30(2) of the GDPR requires and makes the part relating to the Customer available under DPA10. It has a person responsible for data protection compliance, contactable at legal@rolycall.com, and will notify the Customer of the identity and contact details of a data protection officer if it becomes required to appoint one.

DPA9. Personal Data breach

DPA9.1 Notice. VoxTelAI will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting Customer Data, to the Customer's data-protection and security contacts under DPA15 and by notice in the Portal — and in time for the Customer to meet the period Data Protection Law gives it to notify its supervisory authority, so far as the information available to VoxTelAI allows.

DPA9.2 Content. The notification describes, so far as then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the categories of Personal Data, the Services and the tenants affected; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; when the breach began and was discovered; whether Sub-processors are involved and which; and a contact point for further information.

DPA9.3 Staged information and cooperation. Where information is not all available at first notice, VoxTelAI provides it in stages as it becomes available and without undue further delay, and cooperates with the Customer in investigation, containment, remediation and in the Customer's own notifications to supervisory authorities and data subjects. It will not represent the Customer's position to an authority or a data subject without the Customer's written agreement.

DPA9.4 What is not a breach. Unsuccessful attempts to gain unauthorised access — pings, port scans, failed log-in attempts and denial-of-service attempts that do not compromise Customer Data — are not Personal Data breaches under this clause.

DPA9.5 Customer's duty. The Customer must notify VoxTelAI without undue delay of any breach affecting registration records, consent records or credentials, and must give VoxTelAI the information it reasonably requires to assess and contain the incident.

DPA9.6 Regulatory notifications. Each Party makes the notifications to authorities and data subjects that its own role and status require; for Customer Data the Customer notifies as controller and VoxTelAI assists. The Customer provides promptly the registration, contact and account data VoxTelAI reasonably requires to discharge a notification duty of its own. Notification by either Party is not an admission of fault or liability.

DPA10. Audits and information rights

DPA10.1 Information. VoxTelAI makes available the information necessary to demonstrate compliance with Article 28 of the GDPR, its equivalents and this Annex. On written request, no more than once in any 12-month period, it will provide its then-current security and compliance summary or third-party audit report, where held; the part of its Article 30(2) record relating to the Customer; the Sub-processor list; and a summary of the testing in DPA5.2. VoxTelAI holds no third-party certification or audit report unless one is identified in the Portal, and claims none it does not hold. That material is Confidential Information.

DPA10.2 Questionnaires. VoxTelAI will answer a reasonable written security or privacy questionnaire, or the follow-up questions of the Customer's regulator or auditor, within 20 Business Days, where the material provided under DPA10.1 does not already answer them.

DPA10.3 Audit. The Customer, or an independent auditor it mandates, may audit VoxTelAI's compliance with this Annex once in any 12-month period, by remote and documentary means: a written questionnaire, the reports, records and summaries provided under DPA10.1 and DPA10.2, and a screen-shared walkthrough of the relevant systems and controls with VoxTelAI's personnel. An on-site inspection of the facilities, systems and records used to process Personal Data on the Customer's behalf takes place only where a supervisory authority requires it or following a Personal Data breach affecting Customer Data.

DPA10.4 Conduct. An audit or inspection takes place on 20 Business Days' written notice, during business hours, with minimum disruption to VoxTelAI and other customers, by an auditor who is not a competitor of VoxTelAI and has signed a confidentiality undertaking, subject to VoxTelAI's reasonable security requirements. VoxTelAI need not give access to another customer's data, to privileged material or to information whose disclosure would breach a duty of confidentiality or Applicable Law, and provides equivalent evidence in another form where it withholds access on that ground.

DPA10.5 Costs. The Customer bears the cost of an audit or inspection unless it reveals material non-compliance with this Annex, in which case VoxTelAI bears its own and the Customer's reasonable costs and remediates at its own cost within a period the Parties agree in writing.

DPA10.6 Supervisory authorities. VoxTelAI will submit to an audit or inspection by a competent supervisory authority to the extent Data Protection Law requires, and will notify the Customer of an authority's enquiry concerning the Customer's Personal Data unless prohibited. This clause, with DPA10.1 to DPA10.5, gives effect to the audit provisions of the EU SCCs and of the UK Addendum.

DPA11. International transfers

DPA11.1 Principle. Where Data Protection Law restricts a transfer of Personal Data processed under this Annex to a country or recipient outside the territory of that law, the transfer is made only under a mechanism that law recognises. VoxTelAI makes no such transfer without a valid mechanism in place. In this DPA11, references to modules, clauses and annexes of the EU SCCs are references to that instrument and not to the Modules of the Agreement.

DPA11.6 UK Addendum. For a transfer subject to the UK GDPR, the EU SCCs apply as amended by the UK Addendum, whose tables are completed as follows: Table 1 (parties) by Annex I.A as populated in DPA11.5; Table 2 (selected SCCs, modules and selected clauses) by DPA11.5; Table 3 (appendix information) by DPA3.5, DPA5.2 and the current list under DPA6.2; and Table 4 (ending the UK Addendum when the approved addendum changes) by selecting both importer and exporter. References in the EU SCCs are read as the UK Addendum requires, and the UK data protection authority is the competent supervisory authority.

DPA11.7 Swiss adaptations. For a transfer subject to Swiss data protection law, the EU SCCs apply with these adaptations: the Swiss federal data protection authority is the competent supervisory authority; references to the GDPR are read as references to Swiss data protection law so far as it governs the transfer; and references to a member state do not prevent a data subject in Switzerland from bringing proceedings in Switzerland under Clause 18(c).

DPA11.8 Government access requests. VoxTelAI gives the commitments in Clause 15 of the EU SCCs for all Personal Data processed under this Annex, whether or not the EU SCCs apply to a particular transfer: it will notify the Customer of a legally binding public-authority request for, or direct access to, Personal Data processed on the Customer's behalf unless prohibited (and, where prohibited, seek a waiver and document the effort); challenge a request that is unlawful under the law of the requesting authority or applicable international law, including by seeking interim measures; disclose only the minimum permissible; and keep a record of requests, available to the Customer and to a supervisory authority so far as law permits.

DPA11.9 Transfer assessment and change of mechanism. On written request VoxTelAI will provide the information reasonably available to it about the laws and practices of a destination country relevant to a transfer assessment under Clause 14 of the EU SCCs or an equivalent requirement, including the Sub-processor's location and the supplementary measures applied. The assessment is the Customer's to make as exporter. If a mechanism relied on is invalidated, suspended or replaced, VoxTelAI will, without undue delay and at its own cost, implement an alternative valid mechanism or an available derogation, or cease the affected transfer; if it cannot within 30 days, either Party may terminate the affected Service without charge, and DPA1.6 applies to the Prepaid Balance.

DPA11.10 Communications in transit. Signalling and media passed to a carrier or interconnect solely to convey a call or message to its Destination are not processed by a Sub-processor (DPA6.1). That hand-off is made under the transfer mechanism the carrier has put in place or, where none is available for the traffic concerned, on the basis Data Protection Law provides for the carriage of that communication; this clause is the only provision of this Annex that governs it. Where such a hand-off is a restricted transfer for which the Customer is the exporter, the Customer determines and documents that basis.

DPA12. Deletion and return

DPA12.1 During the Term. The Customer may delete Personal Data at any time through the Portal or the API and may configure automatic deletion. Deletion takes effect on active systems immediately and on backups within the backup cycle in DPA5.2 (TOM-8). Deleting a recording does not of itself delete AI Output generated from it, and the reverse; to delete both together the Customer configures the same period for both or deletes both.

DPA12.2 Export window. On expiry or termination the Customer may export Customer Data through the Portal or the API during the period section 4 of the General Terms provides or, if none is stated, for 30 days after the end of the Term. VoxTelAI does not delete Personal Data processed as a processor during that window except on the Customer's instruction.

DPA12.5 Personal Data retained under DPA12.4 remains subject to this Annex and to DPA5.2 while retained. This clause does not require VoxTelAI to delete data it processes as an independent controller under DPA2; section 16 of the General Terms governs that data.

DPA13. Liability

DPA13.1 Liability for breach of this Annex is governed by section 12 of the General Terms, including the separate limit it states for data-protection claims. This clause records that position and does not vary it. Nothing in this Annex limits liability that Data Protection Law does not permit to be limited, or affects a data subject's right to compensation under Data Protection Law or under Clause 12 of the EU SCCs.

DPA13.2 Governing law and forum. This Annex is governed by the law and the dispute mechanism in section 20 of the General Terms and the Order Form, except that the EU SCCs are governed by the law and courts elected in DPA11.5 and the UK Addendum by the law and courts it specifies. An election of arbitration does not apply to a claim a data subject brings under the EU SCCs or affect a data subject's choice of forum under them. No provision of either instrument may be modified or severed except as it permits.

DPA14. Regional DP Annex

This Regional DP Annex applies to the extent the Data Protection Law of the country or zone named applies to the Customer's processing through the Services, on the facts. It states principle-level commitments. It does not restate that law, does not displace a mandatory requirement of it, and does not reduce any other commitment in this Annex; where two commitments address the same matter, the stricter applies.

DPA14.1 United Arab Emirates (including the DIFC and the ADGM)

Where UAE, DIFC or ADGM data protection law applies: VoxTelAI processes Personal Data as processor on the Customer's documented instructions, and this Annex serves as the processor contract that law requires. The Customer, as controller, holds the lawful basis, notices and consents that law requires and honours objections to direct marketing. Before a transfer out of the UAE or the relevant zone, the Parties put in place a transfer mechanism that law recognises. Each Party appoints any representative or officer that law requires of it and records it as DPA15 provides. VoxTelAI notifies the Customer of a Personal Data breach without undue delay, and each Party makes the notifications that law imposes on its own role.

DPA14.2 Thailand

Where Thai data protection law applies: VoxTelAI acts as processor on the Customer's documented instructions and keeps the records and security measures that law requires of a processor. The Customer, as controller, holds the lawful basis, gives the notices that law requires and stops direct marketing on objection. Before a transfer out of Thailand, the Parties put in place a transfer mechanism that law recognises. Each Party appoints any local representative that law requires of it and records it as DPA15 provides. VoxTelAI notifies the Customer of a Personal Data breach without undue delay, and each Party makes the notifications that law imposes on its own role.

DPA14.3 Indonesia

Where Indonesian data protection law applies: VoxTelAI acts as processor on the Customer's documented instructions. The Customer, as controller, holds the lawful basis that law requires, records it, and gives the notices that law requires. Before a transfer out of Indonesia, the Parties put in place a transfer mechanism that law recognises. Each Party appoints any representative that law requires of it and records it as DPA15 provides. VoxTelAI notifies the Customer of a Personal Data breach without undue delay, and each Party makes the notifications that law imposes on its own role.

DPA14.4 Other countries

Where the Data Protection Law of another country or zone applies and requires terms not stated in this Annex: VoxTelAI processes Personal Data as processor on the Customer's documented instructions, and this Annex operates as the processor contract that law requires, read with the additions that law makes mandatory; before a transfer that law restricts, the Parties put in place a transfer mechanism that law recognises; each Party appoints any local representative that law requires of it and records it as DPA15 provides; VoxTelAI notifies the Customer of a Personal Data breach without undue delay; and each Party makes the notifications that law imposes on its own role. Where that law requires a further written addendum, the Parties sign one on request.

DPA15. Contacts and representatives

DPA15.1 VoxTelAI's contacts. Data-protection notices, instructions, objections and requests go to legal@rolycall.com. Personal Data breach notices to VoxTelAI go to abuse@rolycall.com, monitored 24×7.

DPA15.2 Customer's contacts. The Customer records in the Appendix to the Order Form or, for a self-serve account, in the Portal account record its data-protection contact, its 24×7 breach contact, its data protection officer where appointed, and the address for Sub-processor change notices. The data-protection contact is the responsible person for this Annex unless the Customer names a data protection officer. Each Party must keep its details current; notice to a contact a Party failed to update is still valid. Where the Customer records none, notices go to its notice contact under section 19 of the General Terms or, for a self-serve account, to the registered account contacts.

DPA15.5 Consequences of an incomplete field. The Customer is responsible, as exporter and controller, for any consequence of an incomplete or inaccurate entry in a field only it can complete, and VoxTelAI is not in breach of this Annex or of the EU SCCs because such a field is blank. Where the omission means a valid transfer mechanism cannot be demonstrated, VoxTelAI will notify the Customer, allow 30 days to complete the entry, and may then suspend the affected transfer or Service until it is completed; the suspension is not a service-level failure under Schedule C, and VoxTelAI restores the Service promptly on completion.