Legal
Data processing agreement
How Stream Networks Ltd, trading as VoiceLogic, processes personal data for business customers under UK GDPR. This agreement forms part of every customer’s agreement with us.
This data processing agreement (“DPA”) sets out what we do with personal data we process for you when you use VoiceLogic, as Article 28 of the UK GDPR requires. It forms part of the agreement between you and us described in our terms and conditions. If you have a question about it, call us on +44 (0)20 3340 9230 or email hello@voicelogic.co.uk.
1. Who this agreement is between
This DPA is between Stream Networks Ltd, trading as VoiceLogic, company number 06229310, of Unit 8 Kingfisher Court, Hambridge Road, Newbury, RG14 5SJ (“we”, “us”, “our”), and the business that has signed an order form for VoiceLogic services (“you”).
It forms part of the agreement made up of your signed order form, our terms and conditions and this DPA. If they conflict, this DPA takes priority for data protection.
2. Definitions
Words such as controller, processor, personal data, personal data breach, data subject and processing have the meanings given in the UK GDPR. Words defined in our terms and conditions, such as agreement, order form, portal, services and call data, have the same meaning here. In addition:
- UK GDPR: the UK General Data Protection Regulation, as it applies in the United Kingdom, together with the Data Protection Act 2018.
- Data protection law: the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any other law about personal data that applies to the processing.
- Customer personal data: the personal data described in section 4 that we process for you in providing the services.
- Sub-processor: another company we engage to process customer personal data for us.
- ICO: the Information Commissioner’s Office, the UK’s data protection regulator.
3. Our roles
For customer personal data, you are the controller and we are the processor. You decide why the data is processed and we process it only for you.
For your account, billing and contact information, and for the sign-in history and security records of the people who use the portal, we are the controller. That information is covered by our privacy policy, not by this DPA.
4. Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing the VoiceLogic phone system, AI agents, website chat, text messages and related services to you |
| Duration | For as long as we provide the services, and then until the customer personal data is deleted or returned under section 13 |
| Nature of the processing | Receiving, connecting and routing calls and messages; recording, transcribing and summarising calls when you turn this on; storing, displaying and sending information to you; running AI agents and website chat; sending text messages; registering 999 addresses with carriers; and deleting data at the end of its retention period |
| Purpose | To provide the services to you as set out in the agreement |
| Types of personal data | Call records (numbers, times, durations and routes); call recordings; transcripts and summaries; voicemail; AI agent conversations and the messages agents take; website chat conversations; phonebook contacts; your users’ portal accounts; the emergency (999) address for each extension, which may be a home address; and text messages |
| Categories of data subjects | Your staff and other users; people who call, text or are called by you; visitors who use the chat on your website; and the contacts in your phonebook |
| Special category data | We do not ask for it, but callers may say things that include it, such as health information. You decide whether to record or transcribe calls and how your AI agents are set up |
5. Processing only on your instructions
We process customer personal data only on your documented instructions. Your instructions are the agreement, your order form and the settings you choose in the portal, such as call routing, recording, transcription, retention periods and which integrations you connect. Any other instruction must be agreed in writing.
We do not use customer personal data for our own purposes, and we do not use it, or allow our sub-processors to use it, to train or improve AI models.
If the law requires us to process customer personal data in another way, we will tell you before we do so, unless the law forbids it. If we think an instruction breaks data protection law, we will tell you straight away, and we need not follow it until it is resolved.
6. Confidentiality of our staff
We make sure that everyone we authorise to process customer personal data is bound by a duty of confidentiality, whether by contract or by law, and has access only to what they need for their work.
7. Security
We take appropriate technical and organisational measures to protect customer personal data, as Article 32 of the UK GDPR requires. They include:
- hosting the VoiceLogic platform in the UK, in Stream Networks’ own secure data centres, which are compliant with PCI DSS and ISO 27001;
- encrypting stored credentials;
- two-step sign-in for the portal;
- user and administrator roles, so people see only what their role allows;
- an allow-list of internet addresses the portal can be used from;
- masking card numbers in transcripts;
- security logs; and
- keeping and deleting recordings and other call data according to the retention periods set in the portal.
We review these measures and may change them over time, but we will not reduce the overall level of protection. You are responsible for the security settings you control, such as your users’ passwords, two-step sign-in and the address allow-list.
8. Sub-processors
You give us general written authorisation to use the sub-processors below. We have a written contract with each one that protects customer personal data at least as well as this DPA does, and we remain responsible to you for what they do.
| Sub-processor | What for | When | Where |
|---|---|---|---|
| OpenAI | AI agents on the Basic and Standard plans, transcription, call summaries and website chat | When those features are used | United States |
| ElevenLabs | Voices for Premium AI agents | When a Premium agent is used | United States |
| Telnyx | Sending text messages | Only when text messages are used | United States |
| Microsoft | Checking Outlook calendars and booking meetings | Only when you connect Microsoft 365 | Where your Microsoft 365 is hosted |
| BT and Gamma | Carrying calls, providing numbers and registering 999 addresses | For all calls | United Kingdom |
| GoCardless | Collecting Direct Debit payments (billing only; it receives no call data) | For billing | United Kingdom and European Union |
| Your chosen CRM | Showing callers’ names and logging calls | Only when you connect one | Depends on the CRM you choose |
Your CRM is chosen by you and works under your own contract with its provider; we send it data only because you connect it.
We will tell you by email at least 30 days before we add or replace a sub-processor. You may object on reasonable data protection grounds within that time. If you do, we will work with you in good faith to find a solution. If we cannot, you may end the services affected without early cancellation charges by telling us in writing before the change takes effect.
9. International transfers
OpenAI, ElevenLabs and Telnyx are based in the United States, so customer personal data they process leaves the UK. Where the provider is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge), we rely on that; otherwise we rely on the UK International Data Transfer Addendum to the standard contractual clauses in our contract with the provider. GoCardless may process data in the European Union, which the UK recognises as giving personal data adequate protection.
We will not transfer customer personal data outside the UK in any other way unless the transfer is protected as the UK GDPR requires. You can ask us for details of these safeguards.
10. Helping with data subjects’ requests
If a person asks us to see, correct, delete or otherwise exercise their rights over customer personal data, we will pass the request to you promptly and will not answer it ourselves unless you ask us to.
The portal lets you find, download and delete call data yourself. Where you need more help to answer a request, we will give you reasonable assistance. If that help goes beyond the tools in the portal, we may charge for our reasonable time, and will tell you before we do.
11. Personal data breaches
If we become aware of a personal data breach affecting customer personal data, we will tell you without undue delay, and we aim to do so within 48 hours of becoming aware of it. We will tell you what we know about the breach, the data and people likely to be affected, its likely consequences and what we are doing about it, and we will update you as we learn more.
We will take reasonable steps to contain the breach and limit its effects, and help you meet your own duties to report it to the ICO and tell the people affected. We will not report a breach of customer personal data to the ICO or to the people affected on your behalf without your agreement, unless the law requires us to.
12. Impact assessments and the ICO
Taking into account the nature of the processing and the information available to us, we will give you reasonable assistance with any data protection impact assessment you carry out about the services, and with any consultation with the ICO that follows from it.
13. Deletion or return at the end
When the agreement ends, we keep recordings and other call data for 30 days so that you can ask us for a copy. You can also download recordings and transcripts through the API before the agreement ends. After those 30 days we delete the customer personal data permanently, unless the law requires us to keep it.
14. Audits and information
We will make available to you the information you reasonably need to show that we are meeting this DPA and Article 28 of the UK GDPR. We may first answer with written information, such as a description of our security measures.
Where that is not enough, we will allow an audit or inspection by you or an independent auditor you appoint, who must agree to keep our information confidential. You must give us reasonable notice, and an audit must take place during business hours and avoid disrupting our services to other customers. Audits are limited to once a year, unless there has been a personal data breach affecting your data or the ICO or another regulator requires one. You pay your own costs of an audit.
15. Your obligations
As the controller, you must:
- have a lawful basis for the processing you ask us to carry out, and give the people concerned the information the law requires, such as your own privacy notice;
- make sure your instructions comply with data protection law;
- decide whether to record and transcribe calls and how long to keep recordings, and set this up in the portal;
- keep each extension’s 999 address accurate; and
- set up your AI agents and integrations so they handle only the personal data they need.
16. Liability
The liability of each of us under or in connection with this DPA is subject to the limits and exclusions in the liability section of our terms and conditions (section 21). This DPA does not create a separate or additional limit.
17. Duration and changes
This DPA applies for as long as we process customer personal data for you, including after the agreement ends until the data is deleted or returned. We may change it in the same way as our terms and conditions (section 23), or sooner where a change is required by law or a regulator. The current version is always on this page, with the date it was last updated.
18. Governing law
This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute about it.