Purple Voice

Data Processing Addendum

Last updated October 18, 2026

Effective 18 October 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Purple Rocket ("Processor", "we") and the customer ("Controller", "you"). It applies whenever we process personal data on your behalf in providing Purple Voice, under the EU GDPR, the UK GDPR, the US state privacy laws (including the CCPA/CPRA) and other data-protection laws ("Data Protection Law").

1. Roles and scope

You are the controller (or a processor acting for your controller) of the personal data you put into the Service ("Customer Personal Data"), and we are your processor (and, under the CCPA, your service provider). Annex 1 describes the processing.

2. Our obligations

We will:

  1. process Customer Personal Data only on your documented instructions — these Terms, your configuration of the Service and your written requests — unless the law requires otherwise, in which case we tell you first where we lawfully can;
  2. make sure everyone who processes it is bound by confidentiality;
  3. apply the security measures in Annex 2;
  4. use sub-processors only as section 3 allows;
  5. help you, taking into account the nature of the processing, to answer data-subject requests (the Service lets you export, correct and delete data) and to meet your duties on security, breach notification, impact assessments and consultation with regulators;
  6. tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal-data breach affecting Customer Personal Data, with the information you need to meet your own obligations;
  7. at the end of the Service, delete Customer Personal Data (you can export it first), except where the law requires us to keep it;
  8. make available the information needed to show we comply with this DPA, and allow audits by you or an independent auditor you appoint, on reasonable notice, at most once a year, at your cost, unless a regulator requires otherwise or there has been a breach.

3. Sub-processors

You authorise the sub-processors listed on our Sub-processors page. We will give you at least 30 days' notice of a new sub-processor by updating that page and emailing account owners; you may object on reasonable data-protection grounds, and if we cannot address it you may terminate the affected Service. We impose data-protection terms on each sub-processor at least as protective as this DPA and remain responsible for them.

4. International transfers

Where Customer Personal Data is transferred outside the UK or EEA to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914; Module 2, or Module 3 where you are a processor) and the UK International Data Transfer Addendum are incorporated into this DPA, with this DPA's details filling their annexes, the law of Ireland governing the EU clauses (and of England and Wales the UK Addendum), and clause 7 (docking) and the optional clause in clause 11 not applying.

5. US state privacy laws

As your service provider or processor we will not: sell or share Customer Personal Data; retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Service; or combine it with personal data from other sources except as Data Protection Law allows. We will tell you if we can no longer meet our obligations, and you may take reasonable steps to stop unauthorised use.

6. Your obligations

You confirm you have a lawful basis, the consents and the notices Data Protection Law and telemarketing law require for the processing you instruct, including for calling and messaging the people on your lists.

7. Term and precedence

This DPA lasts as long as we process Customer Personal Data. If it conflicts with the Terms, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.

Annex 1 — Description of the processing

  • Subject matter and duration: providing the Service, for the term of your subscription plus the deletion period in the Privacy Policy.
  • Nature and purpose: storing contact lists; placing and answering phone calls with AI voice agents; real-time speech recognition and synthesis; transcripts, summaries, outcomes and analytics; booking appointments; sending emails or WhatsApp messages your agents are set up to send; webhooks and integrations you configure.
  • Data subjects: your leads, prospects and customers, people who call your numbers, and your users.
  • Personal data: names, phone numbers, email addresses, company details and any other fields you upload; call audio (processed in real time); transcripts, summaries, outcomes and sentiment; appointment details; message content.
  • Special category data: not intended. Do not upload it or instruct agents to collect it unless you have a lawful basis and have agreed this with us in writing.
  • Frequency: continuous while the Service is used.

Annex 2 — Security measures

  • Encryption in transit (TLS 1.2+) and at rest for secrets (AES-256-GCM for carrier credentials, AI keys, OAuth tokens and webhook secrets); passwords hashed with scrypt; API keys stored as hashes.
  • Tenant isolation: every query is scoped to the customer's workspace; staff access to a workspace is explicit and audited.
  • Access control: least privilege, rotating sessions with reuse detection, captcha and rate limits on public forms.
  • Signed callback URLs for telephony providers; SSRF protection for customer-supplied URLs and mail servers.
  • Nightly encrypted backups kept for 14 days; monitoring and audit logs.
  • Secure development: code review, automated tests, dependency updates and incident response procedures.

Contact

Data-protection questions: hello@purplevoice.ai. Data protection officer: .