Data Processing Agreement

Controller means the entity that determines the purposes and means of processing Personal Data (you, the customer).

Processor means the entity that processes Personal Data on behalf of the Controller (KaiVox AI).

Personal Data means any information relating to an identified or identifiable natural person.

Processing means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, or deletion.

KaiVox AI processes Personal Data on your behalf as follows:

• Call recordings and transcripts — voice data from inbound and outbound calls
• Customer data — names, phone numbers, email addresses, appointment history
• Appointment data — booking details, staff assignments, service records
• Message data — SMS, WhatsApp, and email communication records

KaiVox AI shall process Personal Data only on your documented instructions and for the purposes set out in this DPA. We will not process Personal Data for any other purpose without your prior written consent, unless required by applicable law.

KaiVox AI uses the following sub-processors to provide the service:

KaiVox AI implements the following technical and organisational security measures:

• Encryption in transit using TLS 1.3 for all data transmissions
• Encryption at rest for all database content and backups
• Role-based access controls (RBAC) — principle of least privilege
• Full audit logging of all access, changes, and exports
• Security HTTP headers (HSTS, X-Frame-Options, CSP, X-XSS-Protection)
• Multi-tenant data isolation — no cross-tenant data access possible

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, KaiVox AI will notify you without undue delay and within 72 hours of becoming aware of the breach. The notification will include: the nature of the breach, categories of data affected, approximate number of individuals affected, likely consequences, and measures taken or proposed.

KaiVox AI will provide reasonable assistance to help you fulfill your obligations to respond to data subject requests, including rights of access, rectification, erasure, restriction, portability, and objection. All customer data can be exported in CSV format from Settings → Security. Individual records can be deleted from the customer dashboard at any time.

Upon termination of the agreement, KaiVox AI will, at your choice, delete or return all Personal Data within 30 days, unless retention is required by applicable law. Confirmation of deletion will be provided in writing upon request. Backups are purged on a rolling 30-day schedule after account closure.