Data Processing Agreement

BETWEEN: VOICELI LLC (“Processor”), 7224 NW 31st Street, Miami, FL 33122. Email Legal-Privacy@Voiceli.ai. Website https://voiceli.ai.

AND: the Customer entering into the voiceli.ai Terms & Conditions (“Controller”).

01Scope and purpose

This Data Processing Agreement (“DPA”) applies whenever the Processor processes personal data — including call recordings, transcripts, SMS logs and voice biometrics — on behalf of the Controller in connection with the voiceli.ai Service.

This DPA is incorporated into the voiceli.ai Terms & Conditions. By using the Service, the Controller agrees to this DPA.

02Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person (e.g. phone numbers, voice recordings, names).
• “Processing” means any operation performed on personal data (collection, recording, storage, transcription, deletion).
• “Data Subject” means the individual whose personal data is processed (e.g. an End User receiving an SMS or call).
• “Sub-processor” means any third party engaged by the Processor to process personal data.

03Processor’s obligations

The Processor shall:

• 3.1 Process personal data only on documented instructions from the Controller, unless required by law.
• 3.2 Ensure that persons authorised to process personal data have committed to confidentiality.
• 3.3 Implement appropriate technical and organisational security measures (encryption in transit and at rest, access controls, logging).
• 3.4 Retain call recordings and transcripts for no longer than 90 days, unless a longer period is required by law or agreed in writing.
• 3.5 Delete or return all personal data to the Controller after the end of the Service, unless storage is required by law.
• 3.6 Make available to the Controller all information necessary to demonstrate compliance with this DPA.

04Sub-processors

4.1 The Controller authorises the Processor to engage the following Sub-processors:

4.2 The Processor shall notify the Controller of any intended changes to Sub-processors at least 14 days in advance. The Controller may object in writing within 7 days.

4.3 The Processor shall bind each Sub-processor to written obligations at least as protective as this DPA.

05Data Subject rights

• 5.1 The Processor shall assist the Controller in responding to Data Subject requests (access, deletion, rectification, opt-out) within 30 days.
• 5.2 For SMS opt-out requests (e.g. reply “STOP”), the Processor will honour the request automatically within 48 hours.
• 5.3 For call recording deletion requests, contact Legal-Privacy@Voiceli.ai.

06Security breach notification

6.1 The Processor shall notify the Controller without undue delay (within 48 hours) after becoming aware of any accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data.

6.2 Notification shall include:

• Description of the breach (if known).
• Categories and approximate number of records affected.
• Contact point for further information.
• Measures taken to mitigate the breach.

07Audits and compliance

• 7.1 The Processor shall allow the Controller to audit its compliance with this DPA once per year, at the Controller’s expense, with 30 days’ advance notice.
• 7.2 Audits shall be conducted during business hours and shall not unreasonably disrupt the Processor’s operations.

08International transfers

• 8.1 The Processor and Sub-processors are located in the United States. If the Controller is outside the US, the parties agree that the Standard Contractual Clauses (SCCs) approved by the European Commission are incorporated herein.
• 8.2 For transfers from the UK, the UK Addendum to the SCCs applies.

09Return and deletion of data

• 9.1 Upon termination of the Service, the Processor shall delete all call recordings, transcripts and SMS logs within 30 days, except where retention is required by law.
• 9.2 The Controller may request a written certification of deletion.

10Limitation of liability

The Processor’s total liability under this DPA is subject to the Limitation of Liability section in the voiceli.ai Terms & Conditions.

11Governing law

This DPA is governed by the laws of Florida, USA.

12Contact for data protection matters

For formal offline execution, contact Legal-Privacy@Voiceli.ai to request a countersigned copy. Authorised signatory for VOICELI LLC: Qingxia Wang, Manager.