Data Processing Agreement (DPA)

Parties

• D.O.D.O. OFFICE OUTLET S.R.L., a Romanian limited-liability company, registered office Sat Dudu, Comuna Chiajna, Str. Rezervelor nr. 54, bl. 7, ap. 23, județul Ilfov, CUI 48578743, ONRC J23/4990/2023, represented by administrator Olaru Ciprian Valentin, operating the Vocalyy service (the "Processor" / "Vocalyy"); and
• The Customer in the applicable Order Form / subscription (the "Controller").

Legal framework: GDPR esp. Art. 28; Law 190/2018; Law 506/2004 (call recording); ANSPDCP; SCCs (Decision (EU) 2021/914); eIDAS + Law 214/2024.

Definitions

Caller Data

audio recordings, transcripts, caller phone numbers, call metadata, booking/order details.

Customer Configuration

everything the Customer sets up or trains on its AI agent: the prompts and scripts, the questions the agent asks, the statements it makes, the knowledge base and documents used to train it, and the integrations it connects. Distinct from the training of third-party AI models, which Vocalyy prohibits on Caller Data (§6.5).

Special-category data

data listed in Art. 9(1) GDPR, including health data.

Prohibited data

national ID (CNP), payment-card numbers (PAN), bank-account details (IBAN); see §5.5.

1. Roles and scope

1.1 For Caller Data, the Controller determines purposes and means; Vocalyy processes on its behalf as processor (Art. 28).

1.2 Vocalyy is an independent controller for its own account/billing/support data and aggregated security telemetry (Privacy Policy + Terms, not this DPA). No Art. 26 joint controllership.

1.3 Precedence: mandatory EU/RO law > this DPA > Terms > Order Form.

2. Subject-matter, duration, nature, purpose (Art. 28(3))

Subject-matter

processing Caller Data to operate the AI voice-agent Service (answering, recording, transcribing, booking/order capture, notifications, making data available).

Duration

Term of the Terms + Annex 3 retention + §12.

Nature

receiving call audio via telephony sub-processors; recording/storing; generating/storing transcripts and structured data via AI sub-processors; SMS/messaging confirmations; dashboard/API delivery.

Purpose

solely to provide the Service on documented instructions; never to train third-party AI on Caller Data except §6.5.

2.1 Data types: audio recordings; transcripts and AI-generated summaries/entities; caller phone numbers and call metadata; booking/order details; Controller content (CRM contacts, knowledge base).

2.2 Data subjects: end-callers; Controller users; CRM/KB contacts.

2.3 Special categories (Art. 9). Special-category data is permitted on the Service only where the Controller has signed the Health-Data Addendum (Annex 4), enforced at signup. Health data is not solicited by default.

2.4 Recording is always-on. Call recording is a permanent, integral feature of the Service and cannot be switched off. Callers receive the recording notice and the AI disclosure at the opening of every call (Law 506/2004; AI Act Art. 50).

2.5 Telephone numbers. Where Vocalyy provides a telephone number for the Service, that number is provisioned from a third-party electronic-communications provider in Vocalyy's name and made available for the Controller's use. The Controller is responsible for the lawful use of the line and of all calls answered or placed through it (Law 506/2004; GDPR).

3. Controller instructions and lawfulness

3.1 Only on the Controller's documented instructions; Vocalyy informs the Controller without delay if an instruction infringes GDPR, and may suspend it.

3.2 Controller warranties: (a) valid Art. 6(1) basis; (b) valid basis to record and discharged caller notice/consent (Law 506/2004, Art. 13/14); (c) special-category data only under a signed Annex 4 with a valid Art. 9(2) condition; (d) no outbound commercial AI calls to RO consumers without prior opt-in (Law 506/2004 art. 12), with AI disclosure at call opening (AI Act Art. 50) and human opt-out; (e) employee monitoring per Law 190/2018 art. 5.

3.3 Customer responsibility and indemnity. As between the parties, the Controller is solely responsible for its Customer Configuration and for the lawfulness, under GDPR and applicable law, of (a) the questions the agent asks and the statements it makes, (b) the personal data the agent collects and the lawful basis, caller notice and consent for collecting it, and (c) anything arising from how the Controller trains or configures the agent. The Controller indemnifies and holds Vocalyy harmless against any claim, fine or loss, including from a data subject or ANSPDCP, arising from its Customer Configuration or instructions. Vocalyy remains responsible only for its own obligations as processor. Where Vocalyy supplies default wording (recording and AI disclosure), Vocalyy keeps that default compliant; once the Controller edits it, the Controller owns it. Nothing in this clause limits a data subject's rights or a supervisory authority's powers.

4. Confidentiality

4.1 Authorised persons are bound by written confidentiality undertakings surviving termination; access strictly need-to-know.

4.2 In-platform AI features. Where an in-platform AI assistant processes Caller Data (including transcripts), access by Vocalyy staff to those AI-assistant conversations is restricted to named, role-based personnel on a need-to-know basis and is logged; the feature and the fact of such access are disclosed to the Controller. No secondary use; no model-training (§6.5).

5. Security (Art. 32)

5.1 TOMs (Annex 2): TLS 1.2+ in transit; AES-256 at rest for recordings, transcripts, credentials; role-based access control and least privilege; MFA for admin; hashed and salted credentials; tenant isolation (row-level security); network segmentation; logging/monitoring/alerting; key management; documented incident response (§8); backups/DR proportionate to availability; periodic sub-processor security review; staff DP training. Operational/server logs that may contain conversation excerpts are access-controlled and purged on the Annex 3 schedule.

5.2 Access to call recordings and transcripts is restricted to the Controller's owner/administrator roles (least privilege), and every access is logged.

5.3 No certification (ISO 27001 / SOC 2) and no uptime percentage is claimed here; any uptime commitment lives only in the separate SLA for enterprise plans that incorporate it.

5.4 Assistance with the Controller's Art. 32/33-34/35/36 duties.

5.5 Prohibited data. The Controller must not configure its agent to request CNP, payment-card numbers or bank-account details. Vocalyy applies automated detection and redaction of such values in transcripts and logs and does not store raw values. Vocalyy is not a payment processor and the Service is not PCI-DSS scoped for cardholder data.

6. Sub-processors (Art. 28(2),(4))

6.1 General written authorisation subject to this §6; current list in Annex 5, published on the sub-processors page (authoritative roster).

6.2 At least 30 days' prior notice of any addition or replacement; the Controller may object on reasonable data-protection grounds; if no mitigation within a further 30 days, the Controller may terminate the affected Service with no penalty and a refund of the unused prepaid term.

6.3 Flow-down (Art. 28(4)): each sub-processor bound by written contract to obligations no less protective; Vocalyy remains fully liable.

6.4 International transfers: see §7.

6.5 AI-model-training restriction: the AI sub-processors are contractually barred from using Caller Data to train their general models, per each provider's data-processing terms.

7. International transfers (Chapter V)

7.1 Personal data at rest is hosted in the European Union (Supabase, region Frankfurt, Germany). Where a sub-processor processes Caller Data in the US, the transfer relies on a valid mechanism per §7.2.

7.2 For each US transfer, Vocalyy relies on: (a) EU-US DPF certification where current; and/or (b) SCCs (Decision (EU) 2021/914) + a documented TIA + supplementary measures (encryption in transit and at rest, access controls, data minimisation).

7.3 US sub-processors that receive Caller Data each have their own SCCs + TIA + no-training confirmation, disclosed to the Controller and in the caller notice.

7.4 The Controller may request the SCCs / TIA summary / DPF details from agent@vocalyy.ro.

8. Personal-data breach (Art. 33(2), 34)

8.1 Notice to the Controller without undue delay, and in any event within 48 hours of becoming aware (24 hours for special-category data under Annex 4).

8.2 Content: nature, categories and approximate numbers, likely consequences, measures, contact point, with rolling updates.

8.3 For call content / e-comms metadata, assistance with Law 506/2004.

8.4 Assistance is not an admission of liability.

9. Data-subject rights (Art. 28(3)(e))

Assistance by TOMs for Arts. 15-22, including surfacing/exporting/deleting a caller's recordings and transcripts. A request received directly is forwarded to the Controller within 3 working days; Vocalyy acknowledges and redirects only.

10. Records (Art. 30(2))

Maintained and made available to ANSPDCP on request.

11. Audit (Art. 28(3)(h))

Information on demand; audit once per calendar year (plus for-cause), at least 30 days' notice, business hours, no unreasonable disruption, confidentiality respected.

12. Retention, return and deletion

12.1 Caller Data is retained per Annex 3 and then automatically deleted by the scheduled purge.

12.2 On account end, a 30-day grace period runs, during which the Controller may export its data or reactivate. At the end of the grace period, Vocalyy permanently deletes all Caller Data, contacts and saved bookings/orders, except the billing skeleton in §12.5.

12.3 An account is ended when (a) the subscription is cancelled (grace starts immediately), or (b) it is unpaid and remains so 30 days past due (grace then runs).

12.4 Vocalyy emails the Controller's owner 7 days before deletion, with an export link.

12.5 The date, duration and cost of each call are retained for 5 years (Legea 82/1991). No caller personal data.

12.6 Legal-retention exception for data subject to law or an active legal claim, minimum only, Controller informed. Deletion certified on request.

13. Liability

Each party's total aggregate liability is capped at the fees paid for the affected Service in the 3 months before the event, subject to uncappable carve-outs (Cod civil art. 1355 intentional fault / gross negligence; confidentiality; data-subject Art. 82 claims; mandatory consumer-protection law). The §3.3 customer indemnity is an allocation between the parties and does not limit Vocalyy's own processor liability to data subjects or ANSPDCP.

14. Contacts

Processor contact for all data-protection matters: agent@vocalyy.ro. An external Data Protection Officer is appointed and notified to ANSPDCP (Art. 37); the DPO's contact details are published once the appointment is complete. Controller contact per the Order Form.

15. Governing law and signature

15.1 Romanian law; jurisdiction per the Terms (competent court for the seat in județul Ilfov). Data subjects' Arts. 77-79 rights unaffected.

15.2 Click-through executes this DPA for SMB; up-market customers typically require a hand-signed or qualified e-signature (eIDAS / Law 214/2024) counterpart.

Annexes

• Annex 1: Processing description (the §2 table).
• Annex 2: Technical and organisational measures.
• Annex 3: Retention Schedule (below).
• Annex 4: Health-Data Addendum (special-category pre-onboarding gate).
• Annex 5: Sub-processor list (below).
• Annex 6: SCCs (Decision (EU) 2021/914, Modules 2/3), by reference.

Annex 3: Retention schedule

An automated purge job enforces each period per data type.

Contacts the Controller adds or imports, and saved bookings/orders (the Controller's own CRM records), are retained for the duration of the contract and deleted on termination per §12. A contact created automatically from a call is Caller Data and is deleted with it, 90 days after that caller's most recent call. The Controller may, by written instruction, require a shorter period for any category. A clinic under a signed Annex 4 may instruct a longer period under its own medical-records basis.

Annex 5: Sub-processor list

The authoritative, current roster is published on the sub-processors page and may change on 30 days' notice (§6.2).

We use the following categories of service providers; the specific provider may change and we will give 30 days' notice of any material change.