Legal
Data Processing Addendum Summary
A summary of the terms under which WoneAssistant processes personal data on behalf of customers: roles, instructions, security, sub-processors, breach notice, deletion, audits and transfers.
- Version:
- 2.0
- Effective:
- 11 November 2026
- Last updated:
- 11 November 2026
1. Status of this summary
Notice
Full addendum on request
This page summarises our Data Processing Addendum (“DPA”). It is not itself a signed agreement. To receive the full DPA, including the standard contractual clauses and annexes, for signature or incorporation, use the contact form and choose the legal topic. Where a DPA is in force, it prevails over this summary and, for personal data, over the Terms of Service.
- “Customer Personal Data”
- Personal data contained in Customer Content that we process on the Customer’s behalf, for example call recordings, transcripts, messages, contact records and call detail records relating to the Customer’s End Users and staff.
- “Data Protection Laws”
- Laws that apply to that processing, including the EU GDPR, UK GDPR, the California Consumer Privacy Act as amended, PIPEDA and Quebec Law 25, Nigeria’s NDPA 2023, Ghana’s Data Protection Act 2012, Kenya’s Data Protection Act 2019 and South Africa’s POPIA.
- “Sub-processor”
- A third party we engage to process Customer Personal Data.
2. Roles and scope
The Customer is the controller (or a processor for its own customers) and WoneAssistant is the processor (or sub-processor). The subject matter is provision of the Service. The duration is the term of the agreement plus the deletion period. The nature and purposes are hosting, transmitting, storing, transcribing, summarising, routing and otherwise processing communications as the Customer configures. The categories of data subjects are the Customer’s End Users and staff. The types of data are those set out in the Privacy Policy for Customer Content.
For data we process as a controller, such as account administrators’ details, security logs and billing, the Privacy Policy applies and this addendum does not.
3. Instructions and confidentiality
We process Customer Personal Data only on the Customer’s documented instructions: the agreement, the Customer’s configuration and use of the Service, and further written instructions that are consistent with the agreement. If we think an instruction breaks Data Protection Laws we will tell the Customer. We do not sell Customer Personal Data, share it for cross-context behavioural advertising, or use it outside the direct business relationship, except as the law allows.
People who access Customer Personal Data are bound by confidentiality and have access only where their role requires it.
4. Security measures
| Area | Measure |
|---|---|
| Tenant separation | Row level security at the database layer, so a request for one tenant cannot read another’s rows. |
| Encryption | A data encryption key for each tenant; call audio sealed at rest with AES-256-GCM; key destruction on erasure. |
| Identity and access | Hashed credentials, authenticator-app multi-factor sign-in with single-use recovery codes, OIDC and SAML sign-in with SCIM provisioning, role-based permissions and workspaces. |
| Oversight | Tamper-evident audit trail of significant actions; action-level permissions and human approval for assistants. |
| Operational | Least-privilege access to production systems, security monitoring, and an incident process for investigating and containing events. |
| Compliance tooling | A configurable compliance engine for consent, calling hours, AI disclosure and retention. |
We review these measures as risks change and will not materially reduce the overall protection of Customer Personal Data. We do not claim SOC 2, ISO 27001, HIPAA or PCI certification.
5. Sub-processors
The Customer gives general authorisation for the sub-processors on the Sub-processors page. We bind each by written terms that provide materially the same data protection obligations as this addendum, and we remain responsible for them.
We give notice of a new or replacement sub-processor at least 30 days before it processes Customer Personal Data, by updating that page and notifying account administrators who have asked to be notified. A Customer may object on reasonable data protection grounds within that period. We then work in good faith to resolve the objection, and if we cannot, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remainder of the term.
6. Assistance with data subject rights and compliance
Taking into account the nature of processing, we help the Customer respond to requests to access, correct, delete, restrict, port or object, using the export and erasure tooling in the product. If a data subject contacts us directly about Customer Personal Data, we will refer them to the Customer unless the law prohibits it.
We provide information and reasonable help for data protection impact assessments, prior consultation with authorities, and, for AI features, for the Customer’s assessment of automated processing and disclosure duties.
7. Personal data breach
We notify the Customer without undue delay and in any event within 72 hours after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as known, the nature of the breach, the categories and approximate numbers of data subjects and records, likely consequences, and the measures taken or proposed. We provide further information as it becomes available, and we take steps to contain and remedy the breach. The Customer decides whether and how to notify authorities and data subjects, unless the law requires us to.
8. Return and deletion
On termination, or earlier on the Customer’s request, Customer Personal Data is available for export for at least 30 days and is then deleted. Erasure removes the data and destroys the tenant key so sealed content cannot be read. Deleted data can remain in encrypted backups for a limited rotation period of no more than 90 days, and we keep only what the law requires us to keep, protected under this addendum.
9. Audits and information
We make available the information needed to show compliance with this addendum, including answers to reasonable security questionnaires and, where we hold them, summaries of independent assessments. If that is not enough, or a regulator requires, a Customer may audit us, or appoint an independent auditor bound by confidentiality, no more than once a year, on reasonable notice, during business hours, in a way that does not harm other customers or security, and at the Customer’s cost. Nothing requires us to give access to other customers’ data.
10. International transfers
We transfer Customer Personal Data only under a valid mechanism. For GDPR, this is an adequacy decision or the Standard Contractual Clauses (module two, controller to processor, and module three where the Customer is a processor). For UK GDPR it is the UK International Data Transfer Agreement or the UK Addendum to the Clauses, or UK adequacy regulations. Transfers by our sub-processors are covered by equivalent safeguards. Where other laws restrict transfers, we apply the mechanism they require.
11. Other terms
- California: we act as a service provider, use Customer Personal Data only for the business purposes in the agreement, and will tell the Customer if we can no longer meet our obligations under the CCPA.
- Liability under this addendum is subject to the limitations in the Terms of Service, except where the law or the standard contractual clauses require otherwise.
- Conflicts: the standard contractual clauses prevail, then this addendum, then the Terms.
12. Request the full DPA
Request the full Data Processing Addendum. Privacy questions go to the privacy topic. See the Legal hub.
Version history
Version 2.011 November 2026
First publication of the summary.