Data Processing Agreement (DPA) – Voice Logica I.K.E.

This Data Processing Agreement (“DPA”) forms an integral part of the Voice AI Agent Services provided by Voice Logica I.K.E. (“Voice Logica”, “Company”) and applies to the use of the Platform by both End Customers (“Controller”) who access the Platform through authorized Partners (“Processor”), and those who access the Platform directly.

1. Roles of the Parties

End Customer (“Controller”): Determines the purposes and means of personal data processing carried out through the Platform, either via Partner or directly with Voice Logica.

Partner (“Processor”): Acts as the Processor on behalf of the End Customer when access is via an authorized partner.

Voice Logica (“Sub-processor” or “Processor”): Acts as a Sub-processor when Services are provided through a Partner, and as a Processor when Services are provided directly to the End Customer.

2. Subject Matter of Processing

Voice Logica processes personal data on behalf of the Partner and the End Customer in the context of providing its Services.

Categories of Data: voice recordings, transcriptions, usage logs, contact details (where input by the End Customer).

Data Subjects: employees, customers, or partners of the End Customer.

3. Duration

Processing is carried out for as long as the End Customer uses the Services, or until data is deleted/anonymized in accordance with this DPA.

4. Obligations of Voice Logica

Voice Logica shall:

• Process data only based on documented instructions from the Partner or End Customer.
• Implement appropriate technical and organizational security measures (e.g., encryption, access control, monitoring).
• Retain data for a maximum of 12 months from creation, unless otherwise required by the Controller or by law.
• Ensure confidentiality through staff and partner commitments.
• Promptly notify the Partner or End Customer of any data breach incidents.

5. Obligations of the Partner

The Partner shall:

• Inform the End Customer of the existence and terms of this DPA.
• Forward any data subject request (e.g., access, rectification, deletion) to Voice Logica within 24 hours.
• Ensure that the End Customer complies with the GDPR and the AI Act (Artificial Intelligence Regulation).

6. Obligations of the End Customer

The End Customer shall:

• Ensure that data collection and usage are lawful.
• Provide necessary notices and obtain valid consents where required.

7. Sub-processors

Voice Logica may engage further subcontractors (sub-processors) to provide the Services, provided that such sub-processors are bound by obligations equivalent to those in this DPA.

The list of sub-processors will be made available on the Voice Logica website.

8. International Data Transfers

Where data transfer outside the EEA is required, Voice Logica shall apply appropriate legal safeguards (Standard Contractual Clauses or equivalent mechanisms).

9. Audit Rights

The End Customer and/or the Partner may request information or conduct audits regarding the processing. Voice Logica will cooperate reasonably with such requests.

10. Termination – Data Deletion

Upon termination of the Services and after the 12-month retention period, Voice Logica shall delete or anonymize all personal data, unless otherwise required by law. Additionally, the Platform offers functionality allowing the End Customer to delete their data at any time.

11. Governing Law

This DPA is governed by Greek Law. Any dispute shall be submitted to the courts of Athens, Greece.

12. Special Terms for Health Data

• Enhanced Security Measures: For health-related data, Voice Logica implements stricter safeguards: end-to-end encryption, multi-factor authentication, strict role-based access, audit logs, and penetration testing.
• Data Minimization: The Partner and End Customer shall limit the processing of health data to what is strictly necessary.
• Data Retention: Health data shall not be retained beyond 12 months unless required by law or explicitly instructed by the End Customer.
• DPIA: Before using the Services in a healthcare environment, the End Customer and the Partner must carry out a Data Protection Impact Assessment (DPIA). Voice Logica will provide support.
• Data Subject Notification: The End Customer shall inform patients/subjects about the processing of their health data via the Platform and about the role of Voice Logica.

Last updated: 26/8/2025