Parties, scope and priority
This addendum is between Open Voice Agent Ltd, company 17502913, whose registered office is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ (“Open Voice Agent”), and the customer business identified in the service order (“Customer”). It forms part of their agreement for the UK Open Voice Agent service.
It applies to personal data Open Voice Agent processes on the Customer's behalf (“Customer Personal Data”). For the ordinary arrangement, the Customer is controller and Open Voice Agent is processor. If the Customer is itself a processor, it must identify that arrangement, confirm the relevant controller's documented authority and ensure that the order and instructions support the corresponding processing chain.
“Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and PECR to the extent applicable, as amended, including applicable amendments made by the Data (Use and Access) Act 2025. Terms such as controller, processor, personal-data breach and special-category data have their statutory meanings.
Open Voice Agent's separate controller activities are described in its privacy notice. They are not authorised by a general licence to reuse Customer Personal Data. Supplier activities as independent controllers must be separately identified and assessed.
This addendum prevails over inconsistent service terms concerning the processing it governs. Mandatory law and any applicable mandatory transfer clauses prevail over this addendum. A later processing-schedule change must be documented and must not reduce protection below applicable law.
Any agreed limitation of liability in the service agreement applies between Open Voice Agent and the business Customer only to the extent permitted by law. It does not reduce the Article 28 obligations in this addendum, Open Voice Agent's responsibility for its subprocessors, individuals' statutory rights including Article 82, regulator powers or liability provisions in mandatory transfer clauses. No limit on those rights or duties is created by accepting this addendum.
Documented instructions and permitted processing
Open Voice Agent will process Customer Personal Data only on documented Customer instructions, including for international transfers, unless UK law requires otherwise. Where UK law requires processing, Open Voice Agent will inform the Customer of that requirement before processing unless the law prohibits that information.
The order, this addendum, its accepted schedules and authenticated service configuration form the initial instructions. Additional instructions must come from an authorised Customer representative and be recorded. Open Voice Agent will promptly inform the Customer if, in its opinion, an instruction infringes Data Protection Law and suspend the affected instruction while a lawful resolution is sought.
The instructions are limited to the service and purposes in Schedule A. They do not authorise Open Voice Agent or a supplier to use Customer Personal Data for unrelated advertising, independent profiling or general-purpose model training. Any proposed independent use requires a separate role and purpose assessment, lawful authority and appropriate transparency before it occurs.
Customer duties and rights
The Customer determines lawful purposes, applicable Article 6 bases and any necessary Article 9 or Article 10 conditions. It provides required privacy information and obtains consent or other permissions where the law or applicable service-provider terms require them. A contract between the Customer and Open Voice Agent is not automatically a lawful basis for processing every caller's data.
The Customer supplies authorised business content, selects appropriate recipients and settings, keeps access permissions current and limits processing to permitted use cases. A warning against sensitive input does not substitute for a lawful response to sensitive information that is actually received.
Open Voice Agent will provide and maintain the mandatory provider-disclosure layer before access to an ElevenLabs-enabled interactive agent, covering every enabled text/voice mode. It will explain AI identity and processing by ElevenLabs and its affiliates/service providers, including the applicable response, analysis and backup model providers; disclose retained conversation text/transcripts and saved voice audio; and preserve required Model Option identification/hosting disclosures. The Customer supplies its accurate controller-specific information and must not bypass that layer. A notice acknowledgement does not by itself establish reading, consent or contractual acceptance where a separate step is required.
The Customer may give lawful instructions, seek assistance, object to proposed subprocessor changes, obtain compliance information, audit and choose return or deletion as set out below. These duties do not excuse Open Voice Agent's own failure to comply with this addendum or duties imposed directly on processors.
Confidentiality and security
Open Voice Agent will ensure that people authorised to process Customer Personal Data have committed to confidentiality or are under an appropriate statutory duty of confidentiality. Access will be limited to what their authorised role and purpose require.
Open Voice Agent will implement and maintain appropriate technical and organisational measures under Article 32, taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and risks to individuals. Schedule B describes the agreed protection requirements.
Open Voice Agent will assess the effectiveness of its measures and maintain the ability to restore availability and access in a timely manner following an incident. This is not a fixed uptime, recovery-time or certification guarantee. Material changes to agreed measures must preserve the required protection and be documented.
Subprocessors
The Customer gives general written authorisation for the subprocessors identified in the approved version of Schedule C supplied with the order. Only entities and activities identified there as subprocessors of Customer Personal Data are covered. The initial list must be provided before the relevant processing starts.
Open Voice Agent will give written advance notice of an intended addition or replacement, including its identity, function, processing locations and relevant transfer information. Notice will be sufficiently early to give the Customer a meaningful opportunity to object on reasonable data-protection grounds before the proposed subprocessor begins the affected processing.
Open Voice Agent will consider an objection in good faith and seek a lawful resolution, such as an appropriate alternative or limiting the affected processing. It will not treat silence after inadequate notice as authorisation. If the objection cannot be resolved and the affected service cannot lawfully continue, the affected processing will stop and the parties will address ending that service under their agreement, preserving mandatory and accrued rights.
Before engaging a subprocessor, Open Voice Agent will assess sufficient guarantees and bind it by a written agreement imposing the data-protection obligations required by Article 28 for its processing, including appropriate security and assistance. An applicable incorporated electronic agreement can satisfy this requirement; a separate negotiated or signed paper DPA is not required merely because a supplier is used. Open Voice Agent remains fully liable to the Customer for the subprocessor's performance of those obligations.
A supplier's independent-controller purposes do not become subprocessor activities merely because its name is in the register. Open Voice Agent must identify and lawfully address such purposes separately.
Individual rights
Taking account of the nature of the processing, Open Voice Agent will assist the Customer by appropriate technical and organisational measures, insofar as possible, to fulfil obligations concerning individuals' rights.
Where Open Voice Agent receives a request concerning Customer Personal Data, it will notify the Customer without undue delay and provide relevant assistance. It will not answer as the Customer without authority unless law requires it to do so. Assistance will cover locating information, appropriate copies, correction, restriction, erasure, portability and recording or applying relevant objections and withdrawals.
Open Voice Agent will cooperate in time for the Customer to meet its applicable legal deadline. A standard controller rights-request period of one calendar month is not an additional month Open Voice Agent may use before assisting. Necessary identity and authority checks must be proportionate, and disclosures must protect other individuals and customers. A request may be handled through secure administrator-assisted steps; the response must cover the relevant personal data, not just a limited dashboard export. A technical capability gap does not itself extend the legal deadline or justify refusal.
Breaches and security assistance
Open Voice Agent will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. Notice will not wait for a complete investigation or borrow the controller's regulatory deadline.
As information becomes available, notice will describe:
- the nature of the breach, including affected categories and approximate numbers of individuals and records where available;
- a contact for further information;
- likely consequences; and
- measures taken or proposed to address the breach and mitigate adverse effects.
Open Voice Agent will provide material updates in stages where necessary, preserve relevant evidence, contain and investigate the incident, and cooperate with the Customer's assessment, notifications and remediation.
Taking account of the processing and information available to it, Open Voice Agent will assist the Customer with Articles 32–36, including security, breach notification to the regulator and affected people, DPIAs and prior consultation where required.
For UK GDPR controller reporting, the usual rule is notification without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to result in risk to individuals' rights and freedoms. High-risk affected people require notification without undue delay. Where the PECR public electronic communications provider regime applies, all personal-data breaches concerning processing covered by that regime require ICO reporting within 72 hours of awareness without the GDPR unlikely-risk exception. ICO says the same PECR-reported breach does not require a duplicate UK GDPR report; separate controller processing in a mixed incident must still be assessed under its own applicable rules. Ofcom security reporting is assessed separately. Each party remains responsible for its own directly applicable reporting duties. Open Voice Agent will not make a notification in the Customer's name without authority unless legally required.
Impact assessments and sensitive information
Open Voice Agent will provide relevant processing and safeguards information and reasonable assistance for the Customer's DPIA and any required prior consultation, taking account of the processing and information available to it. A shared baseline assessment may support similar uses but does not replace the Customer's assessment of materially different sector, scale, vulnerability or decision-making risks.
Routine reception is the default scope, but ordinary calls can still contain health or other special-category information. Before an intended sensitive use, the Customer must identify its Article 6 basis and applicable Article 9 or Article 10 condition, any required DPA 2018 Schedule 1 condition or appropriate policy document, and the safeguards and supplier permission needed for that use. Open Voice Agent's subscription contract and a general warning against sensitive input do not supply those conditions. Neither health-sector eligibility nor a health/legal-claims condition is assumed merely because a business uses a receptionist.
Unexpected sensitive input will be handled under documented instructions and a containment procedure: minimise access and further use, notify the Customer as appropriate, and establish lawful retention, deletion or escalation. It is not authorised for model training or general service improvement merely because it entered a call or chat.
Biometric identification, significant solely automated decisions, regulated advice and emergency service provision are outside the ordinary processing instructions. They require separate assessment and written agreement before any relevant service is offered.
International transfers
Open Voice Agent will make restricted transfers only under documented instructions and a valid applicable transfer arrangement recorded in Schedule C. The assessment includes foreign recipient entities, remote access and onward transfers, rather than storage region alone.
Where the route is adequacy, Open Voice Agent will verify that the recipient and data fall within its actual scope. Where the route is an appropriate safeguard, the applicable instrument must be binding and supported by the required reasonable and proportionate assessment and any necessary supplementary measures. EU standard clauses alone do not establish a UK transfer safeguard: the applicable UK Addendum or IDTA must be addressed where that is the chosen route.
Open Voice Agent will provide information necessary for the Customer to understand the relevant transfer arrangements and will not introduce an unassessed restricted transfer through a model, support-access or subprocessor change. UK-only service availability is not a promise of UK-only processing.
Return, deletion and retention
At the end of the processing service, Open Voice Agent will, at the Customer's choice, return or delete Customer Personal Data and delete existing copies unless UK law requires storage. The Customer's choice will be documented. Return does not authorise indefinite retention of copies.
Schedule D governs active-service expiry, exit handling and backup stages. An archive flag or access removal is not personal-data erasure. Deletion or irreversible anonymisation must address linked records and relevant subprocessors, including tickets, notes, events, transcripts, any saved audio, messages and knowledge-source copies.
An agreed exit/export window does not postpone an earlier lawful erasure instruction or reset a shorter category expiry. The schedule must define one documented service-closure date for any related export-availability and active-copy-deletion deadlines. A separate subsequent deletion period must not be inferred from an export window. Backup expiry is a distinct disclosed stage with the restrictions below.
Where immediate removal from backups is not feasible, retained copies must be put beyond ordinary use, protected and deleted under the documented recovery cycle. A restoration must reapply deletion and restrictions before the restored information is returned to use.
Where UK law requires Open Voice Agent to retain Customer Personal Data after the instructed processing ends, Open Voice Agent will identify the obligation, limit retention and access to that purpose and delete when the requirement ends. Independent-controller account, billing or legal records are addressed separately; they do not permit retention of the entire customer conversation history.
Open Voice Agent will provide appropriate confirmation of completion and explain any legally required residual retention or backup stage. Provider constraints must be reconciled in the accepted schedule; a supplier's technical inability to delete does not by itself create a lawful exception.
Compliance information and audits
Open Voice Agent will make available all information necessary to demonstrate compliance with Article 28 and this addendum and will allow and contribute to audits, including inspections, conducted by the Customer or its mandated auditor.
The parties will coordinate scope, access, confidentiality and reasonable notice proportionately, protecting other customers and security-sensitive information. Such arrangements must not prevent a necessary audit or urgent investigation, make audit rights ineffective or override a regulator's powers. Existing relevant assurance evidence may reduce duplication but does not automatically replace the statutory audit right.
Open Voice Agent may first respond with relevant existing documentation and evidence of its actual measures. No particular paid certification or routine on-site inspection is required by this clause; further review remains available where needed to exercise the rights above.
Operation of the schedules
Schedules A–D form part of this addendum when their approved versions are supplied with the order. Order-specific identities, configuration and instructions must be sufficiently clear to identify the actual Customer, processing and suppliers. An unapproved internal register or online change is not a binding schedule.
The Open Voice Agent general/privacy contact is team@openvoiceagent.com; financial enquiries use billing@openvoiceagent.com. The Customer's authorised contact comes from its order. The parties will use their agreed secure incident route for sensitive notifications and supply only the information needed. Changes requiring agreement, notice or renewed assessment must follow this addendum before affected processing begins.
Schedule A — processing details
Scroll sideways to read the full table.
| Required field | Agreed scope |
|---|---|
| Subject matter | Provision of the Customer's UK AI receptionist service and enabled website conversation, enquiry and notification functions |
| Nature of processing | Receive and transmit communications; process live audio and text; transcribe and summarise; retrieve authorised business facts; create, store, display, search and update enquiry records; perform permitted routing or messaging actions; export, restrict, anonymise and delete under instructions |
| Purposes | Answer routine business enquiries, take messages, arrange callbacks, support authorised transfers and requested messages, and operate and secure those service functions for the Customer |
| Duration | For the instructed service purposes and only the approved exit, legal-storage and backup stages in Schedule D. Review/remove data when its purpose ends or a lawful instruction requires it, even while the subscription continues |
| Individuals | Callers and website visitors; business contacts and prospective customers; Customer personnel and authorised users; other people whose information is lawfully included in authorised content or enquiries |
| Types of personal data | Names; telephone numbers; email and other supplied contact details; live audio; transcripts and conversation content; enquiry summaries, tickets, notes and linked events; times, outcomes and routing metadata; message content, permission, suppression and delivery records; personal information in authorised FAQs, documents and website extracts; necessary access and security events |
| Saved audio | Only if the applicable order/configuration enables it, with the corresponding purpose, disclosure, permission and retention rule; live audio processing exists independently of saved recording |
| Restricted uses | Intended sensitive/regulated, biometric-identification or consequential automated-decision use requires separate assessment and express agreement within permitted supplier scope. The service is not an emergency service. Unexpected sensitive input follows Impact assessments and sensitive information |
| Customer obligations and rights | Lawful purposes/bases/conditions, notices and permissions; authorised content, settings and recipients; documented instruction and supplier-change objection; assistance, compliance information, audit and choice of return/deletion |
| Processing chain | Customer/controller identity and authorised contacts from the order; a Customer acting as processor must identify its upstream authority and any required additional instructions |
On the Customer’s documented instructions, processing includes AI-assisted setup, extraction and organisation of authorised website/document content, and selected calendar, booking, CRM or automation actions. The agreed scope identifies the source, necessary fields, destination, permissions and actual processors; it does not authorise indiscriminate crawling, unrelated model training or distribution to every potential supplier. Important extracted facts and proposed external actions remain subject to authorised review and the agreed controls.
A destination the Customer instructs Open Voice Agent to use may act under the Customer's own provider agreement. That does not remove Open Voice Agent's responsibilities for its own handling or a hosted intermediary it engages. Revoke connection access when instructed and handle retained source material, tokens, logs and destination copies according to the applicable instructions and agreements; disconnecting a connection is not a promise that all existing records are erased.
Schedule B — technical and organisational protection requirements
Scroll sideways to read the full table.
| Area | Required protection |
|---|---|
| Tenant and access boundaries | Authenticate users and service actors; authorise every relevant data/action path for the correct workspace; prevent cross-customer reads, writes, exports and provider actions; limit privileges and remove access when no longer required |
| Personnel and support | Confidentiality and appropriate handling instructions; controlled and attributable administrative/support access; limit access to the reason for the intervention |
| Communications and storage | Appropriate protection in transit and at rest for the actual data and environments; protect secrets, credentials, endpoints and signing material; verify relevant provider event authenticity |
| Data minimisation | Limit tool context, notifications, logs and imports to necessary information; avoid full call content in payment metadata or ordinary diagnostic logs; separate required disclosure/permission evidence from unnecessary content |
| Change and vulnerability management | Appropriate review and controlled release of material changes; security updates and response to identified weaknesses proportionate to risk; prevent unreviewed provider or purpose changes |
| Availability and recovery | Appropriate resilience and protected backups; ability to restore access in a timely manner; documented recovery procedures and regular effectiveness assessment without invented fixed recovery targets |
| Retention and erasure | Enforce category expiry and lawful instructions across related records and providers; restrict legal holds; put residual backups beyond use and reapply deletion/restriction on restoration |
| Accountability | Retain necessary attributable security/access evidence, instructions, supplier-change records and deletion outcomes; purpose-limit the records and protect them from inappropriate access |
| Incidents and assistance | Detect, triage and escalate incidents; notify Customer breaches without undue delay; support rights, DPIAs and notifications with available information and practical measures |
| Review | Assess effectiveness regularly and after relevant change or incident; preserve appropriate evidence of the actual measures and remediation |
Schedule C — subprocessors and international transfers
The approved initial supplier schedule supplied with the order forms part of this addendum. It identifies each actual legal entity, enabled function, processing and support countries, applicable UK transfer route and relevant onward processing. Only the Customer Personal Data activities described there are authorised.
Only the subprocessors authorised under this addendum process Customer Personal Data. Additions or replacements follow the subprocessor requirements before the affected processing begins, with the required identity, function, countries and transfer information.
The initial service functions are:
Scroll sideways to read the full table.
| Service | Customer Personal Data function |
|---|---|
| Google Cloud | Application/tools hosting, service credentials and necessary operational processing |
| Neon PostgreSQL | Instructed enquiry, transcript/summary, ticket/history, business content and authorised access/configuration records |
| ElevenLabs | AI voice/text, speech, response and analysis models, enabled conversation/audio storage and the identified onward model chain |
| Twilio | Owned-number routing and call metadata; transfers or caller SMS only where enabled and permitted |
| Resend | Customer-authorised notification content, selected recipients and necessary delivery information |
Supplier account/billing and specified independent-controller purposes are assessed separately. Onward processors are mapped through the relevant supplier's agreement and list; Open Voice Agent does not automatically contract directly with every onward hosting or model provider. The approved schedule identifies the actual response, analysis, speech and backup processing/hosting roles. The separate Open Voice Agent Marketing agent is not part of the Customer's receptionist model chain merely because Open Voice Agent uses it.
Better Auth is self-hosted and is not another hosted authentication subprocessor. Open Voice Agent's own marketing, billing, administration and developer tools are outside this caller-data authorisation unless an actual instructed Customer Personal Data flow requires their inclusion. A Customer's chosen mailbox/CRM is its instructed recipient, not automatically Open Voice Agent's subprocessor. The approved schedule and working change/objection route are supplied before the affected processing starts.
Schedule D — duration, retention and exit
The rules below retain the maximum history that remains useful and lawful for the Customer's documented purposes. Usefulness must have an identifiable purpose and ongoing need; it is not permission to keep all content forever. Earlier lawful rights instructions, withdrawn permissions, narrower purposes and legal requirements continue to apply. The approved schedule supplied with the order identifies the Customer's selected criteria and actual supplier stages for the categories below.
Scroll sideways to read the full table.
| Category | Purpose, duration and review criterion |
|---|---|
| RT-01 — audio and provider conversation data | Retain full audio/transcripts for open enquiries, checking what was requested or promised, correcting transcription/summary errors, and a documented continuing service-history or specific complaint/dispute purpose. At enquiry and follow-up closure, review whether the verbatim detail is still needed rather than a structured record alone. Review again when that continuing purpose/relationship ends or changes, a lawful rights instruction arrives or service ends; delete/anonymise when no justified purpose remains. Record audio and transcript criteria separately and match actual supplier stages. An active subscription or possible future usefulness alone does not justify indefinite full-content retention. |
| RT-02 — enquiries and communications | Retain tickets, contacts, summaries, notes, custom fields and events for open enquiries/callbacks and the continuing history needed to handle repeat requests or establish the service provided. Review when enquiries/follow-up close and when the relevant relationship or purpose ends or changes; remove obsolete or irrelevant personal details. Frozen notifications and delivery/provider copies need the same purpose/review assessment. An archive flag is not erasure. Avoid sending unnecessary full conversation content to mail/SMS recipients. |
| RT-03 — business knowledge | Keep instructed business content and necessary personal information while used by the active service. Remove superseded imports/copies when replacement makes them unnecessary, unless a documented continuing purpose applies. At the single service-closure date, apply the Customer's return/delete choice to source uploads, extracts and linked copies; preserve earlier instructions and shorter applicable expiry. |
| RT-04 — account/authentication | Keep Customer-authorised access/configuration records for the active instructed service and necessary security/accountability purpose. Revoke access and sessions when authority ends; remove or minimise obsolete personal records after the purpose ends. Separately assess Open Voice Agent's controller account/contract records. |
| RT-05 — legal/financial records | Open Voice Agent's own accounting/tax/contract records follow its controller schedule and actual statutory requirements, not a licence to keep caller histories. Any law requiring residual Customer Personal Data must be identified by obligation, affected minimum fields, expiry and restricted access. |
| RT-06 — evidence | Retain the minimum instruction, permission, suppression, security or complaint evidence for its specific need, with review on resolution, expiry of the actual obligation or lawful instruction. Where ElevenAgents terms require consent evidence, retain that evidence for the applicable legal minimum or five years, whichever is longer; this is not a five-year rule for all call content. Suppression can require a minimal continuing record to honour withdrawal. |
| RT-07 — backups and holds | Use the actual recovery-cycle expiry and provider deletion stages recorded with the order. Put residual backups beyond ordinary use, protect them and reapply restrictions/deletion before restoration to use. Each hold needs a lawful reason, limited scope, accountable owner and release/expiry trigger; ordinary diagnostic or provider copies are not automatically lawful holds. |
Return and exit: On an authorised Customer instruction under Return, deletion and retention, return the retained structured enquiry/history and instructed business records in the agreed usable machine-readable format, and retained audio in a usable original download format where held. Explain linked metadata and scope so the Customer can use the return. Provide it securely, protecting other people/customers. Export is not permission to retain returned copies. One documented service-closure date controls any agreed limited exit handling; no new numerical export or subsequent deletion window is inferred. Unless UK law requires storage, delete the active copies and address supplier/backup stages under the same instruction.
Each approved category records its meaningful criterion/start event, review or expiry trigger, responsible party, deletion/anonymisation route and any actual exception. The approved order records the applicable return formats and actual supplier/backup stages. The Customer may ask for the information needed to understand the returned data.