Data Processing Agreement (DPA)

1. Roles

Customer is the Controller for personal data uploaded into Silux Call (including call recordings, transcripts, contacts, voicemail). Silux Control UK Ltd (trading as Silux Call) is the Processor.

2. Subject matter and duration

Processing is for the purpose of delivering the Silux Call service for the term of the Customer's subscription, plus a 30-day post-termination wind-down.

3. Categories of data subjects and data

• Data subjects: end-users at the Customer, callers and called parties, voicemail leavers.
• Data categories: identification (name, email), contact (phone), audio (call recording), text (transcripts), traffic (CDR), payment (where the agent-assisted payment feature is enabled and tokenised by Stripe).

4. Sub-processors

Current list, by category. Customer is notified of changes 30 days before they take effect.

5. Technical & organisational measures

• TLS 1.2/1.3 in transit; encryption at rest for stored secrets and backups.
• SRTP+TLS for SIP at tenant request (`encryptionPolicy = require_srtp_tls`).
• Role-based access; the telephony management interface is reachable on loopback only.
• Recording redaction during PCI DTMF capture.
• Annual third-party penetration test; quarterly internal review.
• Audit log retained for 12 months.

6. International transfers

Where transfers occur outside the UK / EEA, we rely on the IDTA and the EU SCCs (Module 2: controller-to-processor) plus encryption.

7. Audit

Customer may audit Silux on 30 days' written notice, no more than once a year, except in the event of a confirmed breach.

8. Breach notification

We notify the Customer's registered admin within 24 hours of confirmed incidents.