Data Processing Agreement

Last Updated: 15th October 2026

This Data Processing Agreement (DPA) is between RocketPhone.ai Limited, a company incorporated in England and Wales (Company, RocketPhone, we, us or our), and the business identified in the applicable Order Form (Customer, you or your).

This DPA forms part of the agreement between you and us for the provision of the Services (main agreement). By agreeing to the Terms of Use when signing or accepting the applicable Order Form, you agree to this DPA as part of that agreement. No separate signature or customer-company entry form is required.

This DPA prevails over the main agreement where there is a conflict concerning the processing of personal data. Applicable data protection laws include the UK GDPR, the Data Protection Act 2018 and the EU GDPR, to the extent applicable.

Roles and Scope

We act as a processor (Processor) and you act as a controller (Controller) in relation to personal data processed through the Services on your behalf (Customer Personal Data). Where we independently determine the purposes and means of processing for our own lawful purposes, we act as a controller and our relevant privacy notices apply.

The subject matter is the provision of the Services. Processing lasts for the paid contract term, including renewals, and the limited export, return and deletion periods set out below. Its nature and purpose include collection, recording, transcription, analysis, organisation, storage, retrieval, disclosure on instructions and deletion to provide, maintain and support the Services.

Data subjects include your users, employees, contractors, customers, prospects, suppliers and other people participating in or referred to in conversations. Personal data includes names, contact details, identifiers, conversation and call metadata, voice and video recordings, voicemail, transcripts, notes, summaries and AI-generated insights. Conversations may incidentally contain special-category or criminal-offence data; you are responsible for the applicable lawful basis and additional conditions for such processing. Any additional customer-specific categories or restrictions must be recorded in the Order Form or an agreed processing schedule.

Processing Instructions

We process Customer Personal Data only on documented instructions from you, including regarding international transfers, unless required by applicable law. In that event, we will notify you of the legal requirement before processing unless the law prohibits notification.

The main agreement, this DPA, agreed service settings and lawful written instructions form your processing instructions. You determine the purposes of processing, are responsible for necessary notices and lawful grounds, and warrant that your instructions comply with applicable data protection laws. We will inform you without undue delay if we consider an instruction unlawful.

Confidentiality

We ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations.

Security

We implement appropriate technical and organisational measures considering the state of the art, implementation costs, the nature, scope, context and purposes of processing, and risks to individuals. Measures include, where appropriate, access control, encryption in transit and at rest, secure configuration, logging and monitoring, regular updating and patching, resilience and recovery measures, and regular testing of their effectiveness.

Sub-processors

(a) The Controller generally authorises the Processor to engage the sub-processors listed at https://rocketphone.ai/policies/subprocessors, as updated in accordance with this clause. We shall maintain an up-to-date list of our sub-processors and shall specifically inform you in writing of any intended addition or replacement of a sub-processor at least 30 days in advance, thereby giving you sufficient time to object to such change prior to the engagement of the concerned sub-processor.

Where you reasonably object to the appointment of a new or replacement sub-processor on data protection grounds, you and we shall cooperate in good faith to identify a commercially reasonable alternative. Where no reasonable alternative is available, you may terminate the affected Services without penalty.

Replacement sub-processors will preserve materially equivalent data residency arrangements, including EU/EEA residency where applicable, unless otherwise agreed in writing by you.

We ensure that sub-processors are bound by equivalent data protection obligations and remain responsible for their performance. Return and deletion instructions will also be applied to relevant sub-processors.

International Transfers

Where personal data is transferred outside the United Kingdom or European Economic Area, we ensure that the transfer is lawful under the applicable data protection laws. Where required, this includes an applicable adequacy decision or appropriate safeguards, such as completed EU Standard Contractual Clauses and the UK Addendum or UK International Data Transfer Agreement, together with required transfer assessments and supplementary measures. Required safeguards must be in place before the transfer. This DPA does not itself execute those transfer instruments.

Assistance to You

We assist you, taking into account the nature of processing, with responding to requests from data subjects. Taking into account the nature of processing and information available to us, we also assist with security, personal data breaches, data protection impact assessments and consultations with competent supervisory authorities, to the extent relevant to the Services.

Personal Data Breaches

We notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We will provide available information reasonably needed for your response and regulatory obligations, supplement that information as it becomes available, and cooperate in investigating and mitigating the breach.

Retention Export and Deletion

During the paid contract term, including renewals, we retain customer-accessible conversation data, including metadata, recordings, transcripts, summaries and AI-generated insights, unless a shorter period or earlier deletion is lawfully instructed or expressly agreed. Continued subscription does not override applicable storage-limitation requirements.

On final termination or expiry without renewal, you may choose return or deletion of Customer Personal Data. Unless earlier deletion is instructed, we will provide secure export-only access for 30 calendar days from the effective end date. You should request return or complete retrieval within that period. You and we will agree an appropriate alternative return method if the API cannot fulfil a valid return request.

The API permits retrieval during the subscription and export period. One successful search request consumes one API credit and returns up to 100 conversation records. Recording and transcript files must be downloaded from the returned links; those links expire after 30 minutes. Downloads from those links do not consume further API credits, and requests failing because of a Company service error do not consume credits.

API and export charges apply only where disclosed and agreed in the Order Form or an expressly incorporated pricing schedule and permitted by applicable law. We will provide an estimate of required credits and charges on request. Valid unused credits remain available during the export period, and additional credits may be purchased where required. No charge will be imposed where prohibited by law, including applicable switching or data-egress restrictions. Charges will not be applied so as to unlawfully prevent you exercising your right to return of Customer Personal Data.

At the end of the export period, we will securely delete remaining Customer Personal Data and copies, unless retention is legally required or a valid return request received within the period remains to be fulfilled or lawfully resolved. Data retained for an outstanding request will be protected, restricted to fulfilling that request, and deleted after completion. We will apply deletion to relevant sub-processors and provide confirmation on written request.

Backup copies that cannot reasonably be deleted immediately will be isolated or placed beyond operational use, protected under this DPA and deleted on the normal documented backup-expiry cycle. If restored for recovery, previously applicable deletion instructions will be reapplied. Any lawfully required retained data will be protected and processed only for that legal purpose.

We may separately retain CDRs, SIP signalling and routing records, originating and destination numbers, timestamps, durations, billing information and other telecommunications or operational records for our own operational, billing, security, fraud-prevention, statutory or legal-claims purposes only where necessary and lawful. Such retention is governed by applicable law and our relevant privacy notices and retention policies, does not extend customer access, and ends when no longer lawfully justified. This does not permit retaining conversation content merely by describing it as a telecommunications record.

Data protection, confidentiality, security, assistance, return and deletion obligations survive termination for as long as we or our sub-processors hold Customer Personal Data.

Audit and Information

We make available information reasonably necessary to demonstrate compliance with this DPA and applicable processor obligations, and allow and contribute to audits or inspections by you or your mandated auditor. Reasonable prior notice, normal business hours and proportionate scope apply unless applicable law or a competent authority requires otherwise.

Liability

Each party's liability under this DPA is subject to the limitations in the main agreement, to the extent permitted by applicable law.

Governing Law

This DPA is governed by the law applicable to the main agreement, without prejudice to mandatory data protection law or any applicable international-transfer instrument.