Data Processing Agreement

In short

You are the controller. We process personal data only on your documented instructions.
Data is hosted in the EEA, with the UK as failover.
We tell you about a personal-data breach within 72 hours.
On termination we delete or return your data, except where law requires us to keep it.

A plain-English summary. The full text below is what applies.

Effective date: 1 January 2026 · Version: 1.0

1. Roles

For personal data processed under this DPA, the customer is the controller and Callivex is the processor, except where Callivex acts as an independent controller for purposes of network security, fraud prevention, regulator obligations, and operation of the Service generally, in which case Callivex's processing is governed by its Privacy Policy.

2. Processing details (Annex A)

2.1 Subject matter

Provision of wholesale voice services: SIP termination, DID numbers, SIP trunking, reseller portal, billing.

2.2 Duration

For the term of the customer agreement, plus retention periods set out in the Privacy Policy.

2.3 Nature and purpose

Routing of voice traffic.
Generation, storage, and delivery of CDRs to the customer for billing reconciliation.
Anomaly detection and fraud prevention.
Provisioning of DID numbers (where applicable: end-user identity verification per regulator requirement).
Operation of the customer portal (authentication, audit logs).

2.4 Categories of data subjects

Customer personnel and authorised users of the customer portal.
End-users of customer services (callers, called parties).
Sub-account holders and downstream-customer personnel where applicable.

2.5 Categories of personal data

Identifiers: SIP usernames, account identifiers, IP addresses.
Communications metadata: CLI/ANI, called number, date/time, duration, codec, disposition.
Content: SIP signaling captures (limited to fraud-investigation windows). Call audio is not recorded by Callivex in ordinary operation.
Identity data: customer-supplied KYC and end-user-name/address-of-use data for DID compliance.

3. Processor obligations

3.1 Documented instructions

Callivex processes personal data only on the customer's documented instructions, including those set out in the Order, the Terms of Service, and this DPA. Callivex will inform the customer if, in its opinion, an instruction infringes UK GDPR / EU GDPR or applicable law.

3.2 Confidentiality

Personnel authorised to process personal data are bound by appropriate confidentiality obligations.

3.3 Security measures

Callivex implements appropriate technical and organisational measures, including those described in the Privacy Policy section 8 and applicable industry standards. Specifically:

Encryption in transit (TLS 1.2+) and at rest for personal-data stores.
Access controls (role-based, least-privilege, audit-logged).
Network segmentation between customer-facing and back-office systems.
Regular vulnerability scanning and patching.
Backup and disaster-recovery procedures.
Incident-response plan with regulator-notification capability.

3.4 Sub-processors

Callivex may engage sub-processors for hosting, network infrastructure, payments, fraud-detection, and analytics. Current sub-processors are listed at the customer portal and may include:

EU/UK colocation and infrastructure providers.
Upstream voice carriers (necessary for call delivery, recipients of CDR data only as required for traffic).
Payment processors (Stripe or equivalent) for invoicing.
Email-delivery providers for transactional notifications.

Callivex flows down written data-processing terms to sub-processors equivalent to those in this DPA. Notice of sub-processor changes is given at least thirty (30) days in advance to allow the customer to object on reasonable grounds.

3.5 Assistance

Callivex provides reasonable assistance to the customer in: responding to data-subject requests; ensuring compliance with security, breach-notification, and impact-assessment obligations; engaging with the supervisory authority.

3.6 Breach notification

Callivex notifies the customer without undue delay (and in any event within seventy-two (72) hours) on becoming aware of a personal-data breach affecting customer data, with the information required for the customer to meet its own notification obligations.

3.7 Deletion or return

On termination of the Service, Callivex deletes or returns personal data to the customer at the customer's choice, except to the extent retention is required by applicable law (telecommunications retention, audit, regulator obligations).

3.8 Audits

Callivex makes available the information necessary to demonstrate compliance with this DPA. Where the customer requires further verification, audits may be conducted on reasonable advance notice (at least 30 days), during business hours, no more than once per twelve (12) months, and at the customer's expense, save for serious findings of non-compliance.

4. International transfers

Personal data is hosted in the European Economic Area (primary) and the United Kingdom (failover). Where a transfer to a third country is necessary for the Service (e.g. routing to a non-EEA destination), Callivex relies on an applicable safeguard under UK GDPR / EU GDPR (adequacy decision, standard contractual clauses, or other approved mechanism).

5. Liability

Liability under this DPA is governed by, and subject to the limitations and exclusions in, the Terms of Service.

6. Order of precedence

In the event of conflict between this DPA and the Terms of Service in respect of personal-data processing, this DPA prevails.

7. Governing law

This DPA is governed by the laws of England and Wales.

8. Contact

Data-protection enquiries and DPA execution: compliance@callivex.com
Lunatoria Prime LTD, Dept 7139, 196 High Road, Wood Green, London N22 8HH, United Kingdom.