Data Processing Addendum

Version 2026-11-06 · Effective 2026-11-06

1. Scope and incorporation

1.1 This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other written agreement (the “Agreement”) between Voxgrid Inc (“sip.io”) and the customer that has accepted it (“Customer”). It applies whenever sip.io processes Customer Personal Data in providing the Services.

1.2 This DPA is effective from the date the Customer accepts the Agreement and requires no signature. Customers that need a countersigned copy can request one from legal@sip.io.

1.3 Capitalised terms not defined here have the meaning given in the Agreement or in Data Protection Law.

2. Definitions

“Data Protection Law” means all laws applicable to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”); the GDPR as incorporated into UK law and the UK Data Protection Act 2018 (“UK GDPR”); the Swiss Federal Act on Data Protection (“FADP”); the Israeli Privacy Protection Law, 5741-1981 and its regulations (“PPL”); the California Consumer Privacy Act as amended (“CCPA”) and other US state privacy laws; and any laws implementing the ePrivacy Directive 2002/58/EC.
“Customer Personal Data” means personal data contained in Customer Content or otherwise processed by sip.io on behalf of Customer under the Agreement, as described in Annex I.
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by sip.io or its Subprocessors.
“Subprocessor” means any third party engaged by sip.io that processes Customer Personal Data.
“SCCs” means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914.
“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
“Controller”, “processor”, “data subject”, “personal data”, “processing” and “supervisory authority” have the meanings given in the GDPR; “business”, “service provider”, “sell” and “share” have the meanings given in the CCPA.

3. Roles of the parties

3.1 Customer as controller or processor. Customer is the controller of Customer Personal Data, or, where Customer acts on behalf of its own customers (for example as a reseller), a processor acting for a third-party controller. sip.io is Customer’s processor, or sub-processor where Customer is itself a processor.

3.2 sip.io as independent controller. sip.io acts as an independent controller for account, billing, KYC and website data, and for traffic data to the extent sip.io uses it for its own legitimate purposes: billing, fraud and abuse prevention, network security, emergency calling, regulatory reporting, lawful requests and legal compliance. That processing is governed by the Privacy Policy, not this DPA.

3.3 Resellers. Where Customer is a reseller or white-label partner, Customer is responsible for entering into a data processing agreement with each of its end customers that is no less protective than this DPA, and for relaying their instructions to sip.io. sip.io may treat instructions given by Customer as given on behalf of the end customer.

3.4 Customer responsibilities. Customer is responsible for the lawfulness of its instructions and of the personal data it provides, including obtaining any consents and giving any notices required for call recording, transcription, AI summaries, automated dialling and messaging. See Call Recording, Messaging Policy and AI Services Terms.

4. Details of processing

4.1 The subject matter, duration, nature and purpose of processing, the types of Customer Personal Data and the categories of data subjects are set out in Annex I.

4.2 sip.io will process Customer Personal Data only for the purpose of providing, securing, supporting and improving the Services as described in the Agreement, and in accordance with Customer’s documented instructions. The Agreement, this DPA, Customer’s configuration of the Services (including through the console, API and MCP server) and support requests are Customer’s complete instructions. Additional instructions require written agreement.

4.3 sip.io will inform Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend the affected processing until the instruction is confirmed or modified.

4.4 If sip.io is required by law to process Customer Personal Data other than on Customer’s instructions, it will inform Customer before processing unless the law prohibits this on important grounds of public interest.

5. Processor obligations

sip.io will:

(a) process Customer Personal Data only as set out in section 4;

(b) not use Customer Personal Data, including recordings, transcripts and message content, to train general-purpose machine-learning models, and require its AI Subprocessors not to do so;

(d) engage Subprocessors only in accordance with section 8;

(e) assist Customer with data subject requests (section 9), security, breach notification, data protection impact assessments and prior consultation (sections 10 and 11), taking into account the nature of processing and the information available to sip.io;

(f) delete or return Customer Personal Data at the end of the Services (section 14); and

(g) make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR and allow for audits (section 12).

6. Confidentiality

sip.io will ensure that persons authorised to process Customer Personal Data, including employees and contractors, are bound by written confidentiality obligations or are under an appropriate statutory obligation of confidentiality, receive appropriate privacy and security training, and access Customer Personal Data only to the extent necessary to perform the Services.

7. Security

7.1 sip.io will implement appropriate technical and organisational measures to protect Customer Personal Data, as described in Annex II and the Security Overview. sip.io may update these measures from time to time provided the overall level of protection is not materially reduced.

7.2 Customer is responsible for its own security, including protecting account credentials and API keys, configuring IP allowlists and strong SIP credentials, securing its devices and PBXs, and choosing appropriate recording and retention settings. See Toll Fraud.

8. Subprocessors

8.1 General authorisation. Customer gives sip.io general written authorisation to engage Subprocessors. The Subprocessors in use at the effective date are listed at Subprocessors and are approved.

8.2 Subprocessor terms. sip.io will enter into a written agreement with each Subprocessor imposing data protection obligations no less protective than this DPA, to the extent applicable to the nature of the service provided. sip.io remains liable to Customer for the performance of each Subprocessor’s obligations.

8.3 Carriers. Upstream carriers, interconnect partners and emergency service providers that carry or terminate communications act as independent providers of electronic communications services under their own legal obligations. sip.io will select them with appropriate care and, where they process Customer Personal Data as subprocessors, will apply section 8.2 to the extent practicable in the telecommunications industry.

8.4 Notice of changes. sip.io will give at least 30 days prior notice of a new Subprocessor by updating the Subprocessors page and notifying Customers that have subscribed to updates as described there. In an emergency (for example to maintain service continuity or security) sip.io may engage a Subprocessor on shorter notice and will notify Customer as soon as practicable.

8.5 Objection. Customer may object to a new Subprocessor on reasonable data protection grounds by writing to privacy@sip.io within the notice period. The parties will discuss the concern in good faith. If sip.io cannot offer a reasonable alternative (for example, not using the Subprocessor for Customer’s data or a change in configuration), Customer may terminate the affected Services by written notice and receive a refund of any prepaid, unused wallet balance attributable to the terminated Services. This is Customer’s sole remedy for an objection.

9. Data subject requests

9.1 sip.io provides self-service tools in the console and API that let Customer access, export, correct and delete Customer Personal Data, including recordings, transcripts, messages and CDRs within the hot window.

9.2 If sip.io receives a request from a data subject relating to Customer Personal Data, it will, where it can identify Customer, promptly forward the request to Customer and will not respond directly except to direct the data subject to Customer or as required by law.

9.3 Where self-service tools are insufficient, sip.io will provide reasonable assistance on request. sip.io may charge reasonable costs for assistance that goes beyond what the self-service tools provide.

10. Security Incidents

10.1 sip.io will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data.

10.2 The notice will be sent to the account’s designated security or owner contact and will describe, to the extent known: the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Where information is not available at once, sip.io will provide it in phases as it becomes available.

10.3 sip.io will take reasonable steps to contain, investigate and mitigate the Security Incident and will cooperate with Customer to meet Customer’s notification obligations.

10.4 Notification is not an acknowledgement of fault or liability. Unsuccessful attempts that do not compromise the security of Customer Personal Data, such as blocked SIP scans, failed authentication attempts or denial-of-service attacks that do not lead to unauthorised access, are not Security Incidents.

11. Data protection impact assessments

sip.io will provide reasonable information and assistance to help Customer carry out data protection impact assessments and prior consultations with supervisory authorities relating to the Services, for example in relation to call recording, AI transcription or large-scale automated dialling. sip.io may first refer Customer to its published documentation, this DPA and the Security Overview.

12. Audits

12.1 Reports first. On written request, and no more than once in any 12-month period, sip.io will provide a completed security questionnaire and copies of relevant third-party certifications or audit reports (including those of its infrastructure Subprocessors, where sip.io is permitted to share them), subject to confidentiality.

12.2 On-site or remote audit. If the information in section 12.1 is not reasonably sufficient to demonstrate compliance, or if a supervisory authority requires it, or after a Security Incident affecting Customer, Customer may conduct an audit (itself or through an independent auditor bound by confidentiality and not a competitor of sip.io) on at least 30 days’ written notice, during business hours, for no more than two business days, and in a manner that does not disrupt the Services or compromise the confidentiality or security of other customers’ data.

12.3 Costs. Each party bears its own costs of an audit, except that Customer will reimburse sip.io’s reasonable costs for audits beyond one per 12-month period or that require more than two business days of sip.io staff time, unless the audit reveals a material breach of this DPA by sip.io.

12.4 Audits of Subprocessors’ facilities (such as cloud datacentres) are carried out through the Subprocessors’ own certifications and reports.

12.5 Where the SCCs apply, nothing in this section varies Customer’s audit rights under Clause 8.9 of the SCCs; this section describes how those rights will be exercised.

13. International transfers

13.1 sip.io and its Subprocessors may process Customer Personal Data in the countries listed in the Subprocessors page. Telecommunications are inherently international, and processing in the destination country of a call or message is necessary to perform the Services.

13.2 EU SCCs. To the extent Customer Personal Data subject to the GDPR is transferred to sip.io in a country that does not benefit from an adequacy decision, the SCCs are incorporated into this DPA as follows:

Module 2 (controller to processor) applies where Customer is a controller, and Module 3 (processor to processor) applies where Customer is a processor;
Clause 7 (docking clause) applies;
Clause 9: Option 2 (general written authorisation) applies, with the notice period set out in section 8.4;
Clause 11: the optional language does not apply;
Clause 13: the competent supervisory authority is the one determined in accordance with Clause 13 based on Customer’s establishment or, where Customer is not established in the EU, its EU representative;
Clause 17: Option 1 applies; the SCCs are governed by the law of Ireland;
Clause 18: disputes are resolved before the courts of Ireland;
Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

13.3 UK. For transfers subject to the UK GDPR, the UK Addendum is incorporated. Table 1 is completed with the parties’ details in Annex I; Table 2 refers to the Modules and options selected in section 13.2; Table 3 is completed by the Annexes to this DPA; and in Table 4 either party may end the UK Addendum as permitted by its Section 19.

13.4 Switzerland. For transfers subject to the FADP, the SCCs apply with the following amendments: references to the GDPR are read as references to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; “Member State” in Clause 18(c) includes Switzerland so that data subjects in Switzerland may bring claims there; and the SCCs protect the data of legal entities to the extent the FADP did so before its revision.

13.5 Israel. Transfers of Customer Personal Data subject to the PPL out of Israel will be made in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001. Israel benefits from a European Commission adequacy decision, so transfers from the EEA to sip.io’s infrastructure in Israel do not require the SCCs.

13.6 Alternative mechanisms. If sip.io adopts an alternative lawful transfer mechanism (such as certification under the EU-U.S. Data Privacy Framework), that mechanism will apply in place of or in addition to the SCCs to the extent it covers the relevant transfer.

13.7 Government access. sip.io will handle requests from public authorities for Customer Personal Data as described in its Law Enforcement Guide, including challenging requests it considers unlawful and notifying Customer unless legally prohibited.

14. Deletion and return

14.1 During the term, Customer may export or delete Customer Personal Data using the console and API, and retention settings for recordings and messages apply automatically.

14.2 On termination or expiry of the Agreement, Customer may export Customer Personal Data for 30 days after the account is closed. After that period sip.io will delete Customer Personal Data from active systems within 30 days, and from backups within a further 90 days as backups are overwritten, unless retention is required by law.

14.3 sip.io may retain Customer Personal Data where required by law (for example CDRs required for tax, billing or telecommunications retention obligations), in which case this DPA continues to apply to the retained data, and sip.io will process it only for the purpose requiring its retention.

14.4 On request, sip.io will confirm deletion in writing.

15. CCPA service-provider terms

To the extent Customer Personal Data includes personal information subject to the CCPA, sip.io acts as Customer’s service provider and:

(a) will not sell or share Customer Personal Data;

(b) will not retain, use or disclose Customer Personal Data for any purpose (including any commercial purpose) other than the business purposes specified in the Agreement and this DPA, or as otherwise permitted by the CCPA;

(d) will not combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted by the CCPA regulations;

(e) will comply with applicable CCPA obligations and provide the same level of privacy protection required by the CCPA;

(f) will notify Customer if it determines it can no longer meet its obligations under the CCPA; and

(g) grants Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Data, and to take reasonable steps to ensure sip.io uses the data consistently with Customer’s CCPA obligations.

sip.io certifies that it understands and will comply with these restrictions.

16. Israeli Privacy Protection Law

Where the PPL applies, sip.io will process Customer Personal Data as a holder (“machzik”) of Customer’s database, will comply with the Privacy Protection (Data Security) Regulations, 5777-2017 applicable to the security level of the database as notified by Customer, and will report Security Incidents to Customer so that Customer can meet any obligation to report to the Privacy Protection Authority. Customer, as database owner, is responsible for any registration or notification obligations and for determining the database’s security level.

17. Liability

Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent such limitations are prohibited by Data Protection Law or the SCCs.

18. Order of precedence

In the event of conflict, the following order applies: (1) the SCCs, the UK Addendum or other transfer mechanism, where applicable; (2) this DPA; (3) the Agreement. Nothing in the Agreement limits the rights of data subjects under the SCCs.

19. Changes

sip.io may update this DPA to reflect changes in Data Protection Law, guidance from supervisory authorities, or the Services, provided that changes do not materially reduce the protection of Customer Personal Data. Updates are published on this page and recorded in the Legal Changelog, with at least 30 days notice for material changes.

Annex I: Details of processing

A. List of parties

Data exporter: the Customer identified in the Agreement and account records. Contact: the account owner and any privacy contact designated in the console. Activities: use of the Services described in the Agreement. Role: controller (Module 2) or processor (Module 3).

Data importer: Voxgrid Inc, 1646 W Snow Ave, Ste 169, Tampa, FL 33606, USA. A Delaware corporation. Contact: privacy@sip.io. Activities: provision of cloud communications services. Role: processor.

B. Description of processing and transfer

Categories of data subjects:

Customer’s authorised users, employees, agents and contractors;
Customer’s end users and sub-account holders (for resellers);
people who place calls to, or receive calls or messages from, Customer through the Services;
people whose details appear in contact lists, dialler campaigns, IVR inputs, recordings, voicemail or message content.

Categories of personal data:

telephone numbers, SIP URIs, caller ID and display names;
call detail records and message metadata (timestamps, duration, direction, status, route, cost);
call recordings and voicemail audio;
AI-generated transcripts and summaries;
SMS, MMS and WhatsApp message content and media;
IVR and DTMF inputs, queue and agent data;
SIP signalling data, IP addresses, device and registration information;
contact lists and campaign data uploaded by Customer;
any other personal data Customer chooses to include in Customer Content.

Sensitive data: the Services are not designed to process special category data, but call and message content may contain it at Customer’s discretion. Applicable safeguards: encryption in transit and at rest, access restricted to personnel with a need to know, configurable retention, and the measures in Annex II.

Frequency of transfer: continuous, for the duration of the Agreement.

Nature of processing: collection, transmission, routing, storage, recording, transcription, summarisation, retrieval, display, export and deletion.

Purpose of processing: to provide the Services under the Agreement, including voice, numbers, BYOC trunking, programmable voice, call recording, AI transcription and summaries, messaging, analytics and support, and to keep the Services secure.

Duration and retention: for the term of the Agreement and the period in section 14. Default retention: recordings 30 days, message content 365 days, CDRs 90 days in the primary database then archived, all configurable by Customer where the console allows.

Transfers to Subprocessors: as listed in Annex III, for the purposes and durations stated there.

C. Competent supervisory authority

Determined in accordance with Clause 13 of the SCCs and section 13.2 of this DPA.

Annex II: Technical and organisational measures

The technical and organisational measures are described in the Security Overview, which is incorporated into this DPA by reference.

Annex III: Subprocessors

The authorised Subprocessors are listed at Subprocessors, which is incorporated into this DPA by reference.