This Data Processing Addendum ("DPA") forms part of the Terms and Conditions between Tradevoice Ltd ("Tradevoice", "Processor") and the customer ("Customer", "Controller") and applies whenever Tradevoice processes Personal Data on the Customer's behalf in connection with the Tradevoice service (the "Service").
This DPA is written to comply with Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Terms used in this DPA have the meanings given to them in UK GDPR, including "Personal Data", "Processing", "Data Subject", "Controller", "Processor", "Sub-processor", "Personal Data Breach" and "Supervisory Authority".
In addition:
2.1 With respect to Caller Data and Calendar Data, the Customer is the Controller and Tradevoice is the Processor.
2.2 With respect to the Customer's own account information (name, business details, billing data and the information supplied to build the assistant), Tradevoice is an independent Controller and processes that data in accordance with the Privacy Policy. That processing is outside the scope of this DPA.
2.3 The Customer must have a lawful basis under UK GDPR for the Processing it instructs Tradevoice to carry out, must inform Callers as required by Articles 13 and 14 UK GDPR, and is responsible for the legitimacy of its own processing operations.
2.4 Follow-up messages and review requests. Where the Customer's plan includes them and the Customer has instructed Tradevoice to send them, such messages are electronic marketing under the Privacy and Electronic Communications Regulations. The Customer is the sender for regulatory purposes and is responsible for the lawful basis, for any consent or soft opt-in relied upon, and for honouring objections. Tradevoice will act on any objection notified to it and will cease sending on the Customer's instruction at any time.
3.1 Subject matter: answering, screening, recording, transcribing and structuring inbound business calls; answering Callers' questions from information supplied by the Customer; producing call summaries and structured job records; booking appointments; where enabled, checking a connected calendar for conflicts and writing bookings into it; and where enabled, sending follow-up messages and review requests to Callers on the Customer's instruction.
3.2 Duration: for the term of the Customer's subscription plus any retention period set out in the Privacy Policy.
3.3 Nature and purpose of processing: providing the Service to the Customer.
3.4 Categories of Data Subjects:
3.5 Categories of Personal Data:
Tradevoice will:
4.1 Process Caller Data and Calendar Data only on the Customer's documented instructions, given in writing, by email, or by telephone and confirmed in writing, or set out in this DPA. There is no customer dashboard through which instructions are given. If Tradevoice believes an instruction infringes UK GDPR, it will notify the Customer and may decline to act on it.
4.2 Ensure that staff with access to Caller Data are bound by appropriate confidentiality obligations.
4.3 Implement appropriate technical and organisational security measures, described in Annex A, to protect Caller Data against unauthorised access, disclosure, alteration or destruction.
4.4 Engage Sub-processors only as set out in clause 5.
4.5 Assist the Customer, taking into account the nature of the Processing and the information available, in fulfilling the Customer's obligations to respond to Data Subject rights requests.
4.6 Assist the Customer in complying with its obligations under Articles 32–36 UK GDPR.
4.7 At the Customer's choice, delete or return all Caller Data at the end of the Service, and delete existing copies, subject to any legal retention obligation.
4.8 Calendar credentials. Where the Customer provides a credential enabling calendar access, Tradevoice will store it securely, use it only for the purposes in clause 3.1, and delete it when the subscription ends. The Customer may revoke the credential directly with its calendar provider at any time, and Tradevoice will remind the Customer to do so on termination, since only the Customer can revoke it at source.
4.9 Make available to the Customer information necessary to demonstrate compliance with Article 28 UK GDPR and allow for and contribute to audits, subject to clause 11.
5.1 The Customer authorises Tradevoice to engage Sub-processors to support delivery of the Service. Sub-processors are engaged for application hosting and storage, telephony, call transcription, natural-language understanding and voice generation, message and email delivery, payment processing, and service monitoring.
5.2 The current list of Sub-processors, including their identity and the categories of data each processes, is available to any Customer on request by emailing [email protected]. We will provide it within 5 working days. We do not publish the list, but we will not withhold it from a Customer or a Customer's professional adviser who asks.
5.3 Tradevoice will give at least 14 days' notice by email of any new Sub-processor or replacement. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer's sole remedy is to terminate the Service for the affected feature with a pro-rata refund of prepaid fees.
5.4 Tradevoice will impose data protection terms on each Sub-processor that are no less protective than those in this DPA, and remains liable to the Customer for the acts and omissions of its Sub-processors.
6.1 Caller Data is held on infrastructure operated by Tradevoice's Sub-processors. Some of that infrastructure is located outside the United Kingdom.
6.2 Where Personal Data is transferred outside the UK, Tradevoice ensures an appropriate transfer mechanism is in place, being the UK IDTA, the UK Addendum to the EU Standard Contractual Clauses, or another mechanism recognised under UK GDPR, supported by a transfer risk assessment.
6.3 The specific locations engaged for a Customer's data are provided on request under clause 5.2, so that a Customer carrying out its own risk assessment can rely on accurate information rather than a general statement.
6.4 By subscribing to the Service, the Customer authorises Tradevoice to make these transfers and, where applicable, to enter into Standard Contractual Clauses with Sub-processors on the Customer's behalf.
7.1 Tradevoice's technical and organisational measures, and those it requires of its Sub-processors, are described in Annex A. They are reviewed periodically and may be updated provided the overall level of security is not reduced.
8.1 Tradevoice will notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting Caller Data or Calendar Data.
8.2 The notification will include, to the extent then known: the nature of the breach; the categories and approximate number of Data Subjects and records affected; the likely consequences; and the measures taken or proposed.
8.3 Tradevoice will reasonably cooperate with the Customer's investigation and any obligation to notify the Supervisory Authority or affected Data Subjects.
8.4 Notification does not constitute an admission of fault or liability.
9.1 Tradevoice will assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests by Data Subjects under Chapter III of UK GDPR.
9.2 If a Data Subject contacts Tradevoice directly with a request relating to Caller Data, Tradevoice will refer them to the Customer and notify the Customer where possible. Where the request is an objection to receiving further messages, Tradevoice will act on it immediately as well as notifying the Customer.
10.1 Tradevoice will provide reasonable assistance in carrying out Data Protection Impact Assessments and prior consultations with the Supervisory Authority, where required by Articles 35 and 36 UK GDPR.
11.1 Tradevoice will provide reasonable evidence of compliance with this DPA, including, on request, the Sub-processor list, relevant certifications held by its Sub-processors, and completed security questionnaires.
11.2 Where the above is not sufficient, the Customer, or an independent auditor mandated by the Customer and reasonably acceptable to Tradevoice, may on at least 30 days' written notice audit Tradevoice's compliance. Audits must take place during normal business hours, not unreasonably interfere with operations, be limited to once per 12-month period unless investigating a confirmed breach, be subject to confidentiality, and be at the Customer's cost unless the audit reveals material non-compliance.
12.1 On termination, the Customer may instruct Tradevoice in writing to return or delete Caller Data within 30 days.
12.2 If no such instruction is given, Tradevoice will delete Caller Data in accordance with the retention periods in the Privacy Policy.
12.3 Any calendar connection and stored credential is deleted on termination. The Customer should also revoke the credential with its calendar provider.
12.4 Tradevoice may retain data to the extent required by applicable law, securely isolated from active processing.
13.1 The liability of each party under this DPA is subject to the limitations set out in the Terms and Conditions, except where UK GDPR expressly provides otherwise.
13.2 Each party is responsible for paying the share of any administrative fine or compensation award that reflects its part of the responsibility for the infringement.
14.1 In the event of conflict between this DPA and the Terms and Conditions, this DPA prevails on data protection matters.
14.2 In the event of conflict between this DPA and the Standard Contractual Clauses, where they apply, the Standard Contractual Clauses prevail.
15.1 Tradevoice may update this DPA to reflect changes in the law, in Sub-processors, or in the Service. For material changes affecting Customer rights, Tradevoice will give at least 30 days' notice.
16.1 This DPA is governed by the laws of England and Wales and is subject to the exclusive jurisdiction of the courts of England and Wales.
The Service is delivered on infrastructure operated by Tradevoice's Sub-processors. The measures below describe the controls Tradevoice applies to its own access and administration, and the controls it requires of, and has verified with, its Sub-processors. Tradevoice will describe the position for any specific control on request.
The current Sub-processor list is available on request under clause 5.2. Changes are notified under clause 5.3.
Email: [email protected]
Phone: 0800 088 4336
Post: Tradevoice Ltd, 87 Heeley Bank Road, Sheffield, South Yorkshire, S2 3GL, England