# Module EU/UK — EU and UK Addendum

**VoxTelAI, LLC**, a Delaware limited liability company · EIN 36-5176377 · 1111b South Governors Avenue, Suite 55006, Dover, DE 19904, United States · +1 (302) 342-6155 · legal@rolycall.com

Document **VTA-EU-2026.08** · published at `rolycall.ai/eu-addendum`

This Module forms part of the Agreement only when section 21 of the General Terms says it applies. On its subject it supplements and prevails over the General Terms and Schedule D; Annex 1 and the EU SCCs it incorporates prevail on data protection (section 2). Nothing in this Module reduces a protection the General Terms give VoxTelAI or displaces a duty Applicable Law places on a Party directly.

## EU1. Scope and trigger

**EU1.1** Module EU/UK applies whenever the Customer is established in, or any user or any called or messaged party under the Agreement is located in, the European Economic Area or the United Kingdom. Untriggered, it is pinned but has no operative effect; notice of a trigger is given as section 21 of the General Terms provides.

**EU1.2** References in this Module to the GDPR include the UK GDPR where it applies; the ePrivacy Rules are those of the Destination concerned.

**EU1.3** This Module may apply together with Module US; where both apply to one call, the Customer complies with each.

**EU1.4** VoxTelAI may amend this Module as section 19 of the General Terms allows (30 days' notice; termination without charge if materially adverse).

## EU2. AI disclosure (Regulation (EU) 2024/1689 Article 50)

**EU2.1** Where the Customer deploys an AI system that interacts directly with natural persons located in the European Economic Area — the AI Agent, or the Customer's own AI connected under Schedule A (A4.5) — the Customer ensures those persons are informed, at the latest at the start of the first interaction, that they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person in the circumstances. The disclosure must be clear and distinguishable; VoxTelAI additionally requires it in a language the person can be expected to understand.

**EU2.2** A disclosure prompt that tells the called or calling party that an AI system is speaking is available as a feature of the AI Agent and the campaign tools (Schedule A (A5.4, A4.5)). Whether to use it, and the duty to disclose under EU2.1, are the Customer's — met through the prompt, wording of its own that meets EU2.1 or its own AI system. VoxTelAI may require the prompt to be enabled for a campaign, Destination or tenant where a regulator, carrier, Applicable Law or a complaint pattern calls for it; where EU2.1 applies, the Customer must not shorten, conceal or obscure the disclosure given. Where this Module applies to a call, the Platform enables the prompt and the recording announcement (Schedule A (A7.2)) by default; the Customer may substitute its own wording or disable either, confirming by doing so that it meets EU2.1 and its recording-notice duties otherwise.

**EU2.3** The Platform logs when the prompt is used: for each call, that it was played, with the call identifier, the time and the wording version. That log is Customer Data, available through the Portal and the API for the retention period the Customer sets there. The log evidences playback, not legal sufficiency. Where the Customer discloses without the prompt, it keeps its own record.

**EU2.4** As provider of the AI Agent, VoxTelAI makes the prompt and the EU2.3 log available and does not remove a marking it or a Sub-processor applies to synthetic audio; the Customer must not remove or defeat one and, as deployer, remains responsible for EU2.1 and as EU2.6 states.

**EU2.5** Where Applicable Law of the United Kingdom requires a comparable disclosure, EU2.1 to EU2.3 apply in the same way.

**EU2.6** Human escalation and AI Output: General Terms section 15; no training: Annex 1 (DPA7); recording disclosure: Schedule D (D5). The Customer, as deployer, determines whether its use case attracts any further obligation under that Regulation and complies with it; VoxTelAI does not assess its use case.

## EU3. Electronic marketing calls

**EU3.1** Before placing a direct-marketing call — live, automated or AI-driven — to a person in a member state or the United Kingdom, the Customer obtains and records the consent or other lawful basis that the ePrivacy Rules of that Destination and the GDPR require. The ePrivacy Rules require prior consent for calls by automated calling systems without human intervention and leave each member state to choose between consent and a right to object for other marketing calls; the Customer identifies the regime that applies to each campaign.

**EU3.2** The Customer checks its calling lists against each national opt-out register that applies in the Destination, at the frequency that Destination requires, and honours every objection, whether recorded in a register, expressed during a call or notified later. Where the AI Agent or the Customer's own AI system places the call, the Customer ensures it recognises an objection or request to stop, ends the call and records the objection. Schedule D (D4) suppression-list duties apply in addition.

**EU3.3** On marketing calls the Customer presents a CLI that identifies it and on which it can be reached, and does not withhold it where the Destination's rules prohibit that. Schedule D (D3) applies.

**EU3.4** Purchased or cold lists are not prohibited. The Customer warrants a lawful basis for each such list under the law of the Destination (consent, legitimate interest or a business-to-business exemption where available), keeps evidence of it and of its register checks, and produces it on request within the period Schedule D (D8) allows. VoxTelAI does not vet lists or assess a lawful basis; it may limit or suspend a Service on complaints, traceback requests or quality thresholds as Schedule D (D9) states. Purchased lists remain prohibited for messaging (Schedule D, D6).

## EU4. Roles and representatives

**EU4.1** The roles in Annex 1 (DPA2) apply under the GDPR and the UK GDPR: the Customer is controller of Customer Data and VoxTelAI its processor; VoxTelAI is independent controller of call detail records, billing, verification, fraud and traceback data and Portal user accounts (Privacy Notice).

**EU4.2** A Party not established in the European Economic Area or the United Kingdom but subject to the GDPR or the UK GDPR appoints the representative that Article 27 requires. The Customer records its representatives in the representatives row, with contact details, of the Appendix to the Order Form or, for a self-serve account, the Portal account record (O6; Annex 1 (DPA15)); "not required", or a blank, confirms that none is required of it and must be corrected within 2 Business Days of ceasing to be accurate.

**EU4.3** VoxTelAI's representative status is maintained centrally in the Privacy Notice (P1) and Annex 1 (DPA15). At the effective date of this version none is appointed; an appointment is published there and notified to the Customer's data-protection contact.

**EU4.4** The Customer identifies its competent supervisory authority — for an establishment in a member state, the authority of that member state; where it acts through a representative, the authority of the representative's member state; for the United Kingdom, the ICO — in the Appendix to the Order Form or, for a self-serve account, the Portal account record (O6). That entry is used for the EU SCCs under Annex 1 (DPA11, DPA15), and VoxTelAI, as importer, submits to that authority as Clause 13 of the EU SCCs requires.

## EU5. Data subject requests

**EU5.1** VoxTelAI forwards to the Customer, without undue delay, any request received directly from a data subject that concerns Customer Data, and does not answer it on the merits unless Applicable Law requires; it tells the data subject only that the request has been passed on.

**EU5.2** The Portal lets the Customer search, export and delete recordings, transcripts, contact records and consent records itself. For anything the Portal cannot do, VoxTelAI assists as Annex 1 (DPA8) states, in time for the Customer to answer within the period Data Protection Law allows.

**EU5.3** For Personal Data VoxTelAI controls independently (EU4.1), VoxTelAI answers the data subject itself under the Privacy Notice. Data subjects may complain to the supervisory authority of their member state or to the ICO.

## EU6. Transfers

**EU6.1** Customer Data is hosted in Germany, as Annex 1 (DPA11) states. Where Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to VoxTelAI in the United States or to a Sub-processor outside those areas, the EU SCCs, the UK Addendum and the Swiss adaptations apply as Annex 1 (DPA11) incorporates and elects them. VoxTelAI is not certified under the EU–US data privacy framework or its UK extension and does not rely on it.

**EU6.2** The regions in which Sub-processors (including speech-recognition, speech-synthesis and language-model providers) process Personal Data are stated in the Sub-processor list, provided on request as Confidential Information (Annex 1, DPA6). On request VoxTelAI provides the information the Customer reasonably needs for its transfer assessment.

---