Data processing addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Convexa AI Ltd ("Convexa", "processor") and the customer ("controller") for the provision of the Convexa managed AI voice-agent service("the service"). It sets out how Convexa processes personal data on the customer's behalf, in line with UK GDPR and the Data Protection Act 2018. Where it conflicts with the rest of the agreement on data protection matters, this DPA prevails.

1. Scope & roles

For personal data processed in delivering the service, the customer is the controller and Convexa is the processor. Convexa processes personal data only to provide, support, secure, and improve the service for the customer, and only as described here or otherwise instructed in writing.

2. Processing instructions

Convexa processes personal data on the customer's documented instructions, including the configuration agreed during implementation. Convexa will tell the customer if, in its opinion, an instruction breaches applicable data-protection law. Convexa does not use customer call content — audio, transcripts, or knowledge sources — to train its own or third-party models.

3. Details of processing

4. Security measures

Convexa maintains technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, automated redaction of personal and sensitive identifiers from transcripts, tamper-evident audit logging, and tested incident response. These are described in more detail in our trust centre.

5. Sub-processors

The customer authorises Convexa to engage sub-processors to help deliver the service. A current list is maintained in the trust centre. Convexa imposes data-protection terms on each sub-processor no less protective than this DPA, and remains responsible for their performance. We give at least 30 days' notice before adding or replacing a sub-processor, during which the customer may object on reasonable data-protection grounds.

6. Data subject rights

Taking into account the nature of the processing, Convexa assists the customer with appropriate measures to respond to requests from individuals exercising their rights — access, correction, deletion, restriction, portability, and objection. Where a request reaches Convexa directly, we forward it to the customer rather than responding on the customer's behalf.

7. Breach notification

Convexa notifies the customer without undue delay, and within 72 hours of confirming a personal-data breach affecting the customer's data (24 hours for health- and finance-scoped engagements). Notice includes the information the customer reasonably needs to meet its own obligations to regulators and individuals.

8. International transfers

Where personal data is transferred outside the UK or EEA, Convexa relies on an appropriate safeguard — the UK International Data Transfer Addendum or Standard Contractual Clauses, with supplementary measures where needed. Customers can choose a regional deployment (UK, EU, US, and others) during implementation; we keep call data in the chosen region, including for processing.

9. Return & deletion

On termination, or on the customer's written request, Convexa returns or deletes personal data in line with the configured retention period, unless retention is required by law. Deletion covers recordings, transcripts, and derived records, subject to standard backup cycles.

10. Audits

Convexa makes available the information reasonably necessary to demonstrate compliance with this DPA, including our latest third-party audit reports under NDA. Where a customer reasonably requires further audit, the parties agree timing and scope in advance to avoid disruption to the service or to other customers.

To request a signed copy of this DPA for your engagement, contact privacy@convexaai.com.