Agent
Parties and scope
This Data Processing Agreement (“DPA”) forms part of the agreement between Solvexa AI, a company registered in Pakistan (“Processor”) and the client using our Services (“Controller”). It applies whenever we process personal data on the Controller’s behalf, for example when our AI receptionist handles calls from the Controller’s customers.
It is designed to meet Article 28 of the UK GDPR and EU GDPR, and applies alongside any other data protection laws that cover the processing. If you need a countersigned copy, email info@solvexa.io.
Details of processing
- Subject matter and duration: providing the Services, for as long as the agreement lasts.
- Nature and purpose: answering calls and messages, booking appointments, following up leads, managing CRM records, automating workflows and reporting.
- Data subjects: the Controller’s customers, prospects, callers and staff.
- Personal data: names, contact details, appointment details, call recordings and transcripts, messages, and other information callers choose to share.
- Special category data: only where the Controller’s use case requires it (for example health information mentioned when booking at a clinic), and only as the Controller instructs.
Our obligations
- Process personal data only on the Controller’s documented instructions, including these terms and the configuration the Controller approves.
- Make sure everyone with access is bound by confidentiality.
- Apply appropriate technical and organisational security measures, as described on our Security & Data Protection page.
- Help the Controller respond to data subject requests and meet its obligations on security, breach notification and data protection impact assessments.
- Notify the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting its data.
- At the end of the Services, delete or return the personal data at the Controller’s choice, unless the law requires us to keep it.
- Make available the information needed to show compliance, and allow reasonable audits with advance notice.
Sub-processors
The Controller authorises us to use the sub-processors below. We have written contracts with each that give at least the same level of protection as this DPA. We will notify clients of new sub-processors at least 14 days in advance, and the Controller may object on reasonable grounds.
| Provider | Purpose |
|---|---|
| HighLevel / LeadConnector (via Guaranteed CRM) | CRM, calendars, SMS, email and call handling |
| Hostinger | Website hosting, CDN and business email |
| Cloudflare | Media storage and content delivery |
| Google (Analytics, Tag Manager, Workspace, Gemini) | Website analytics, tag management, productivity and AI models |
| OpenAI | AI language and voice models |
| Anthropic | AI language models |
| Microsoft Azure | Cloud infrastructure and AI services |
| Twilio | Telephony and messaging |
International transfers
Where personal data is transferred outside the UK or EEA, including to our team in Pakistan or to providers in the United States, we rely on adequacy decisions or appropriate safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
AI model providers
We use AI providers’ business and API services, which their published terms say do not use customer data to train their models by default. We do not use the Controller’s data to train models for other clients.
Controller obligations
The Controller is responsible for having a lawful basis to process the data, giving callers and customers the notices required by law (including that calls may be recorded and handled by AI), and ensuring its instructions comply with the law.
Liability and precedence
Liability under this DPA is subject to the limits in our Terms of Service. If this DPA conflicts with those terms on data protection matters, this DPA takes precedence.