Data Processing Agreement

Last updated: June 2026

1. Parties

This Data Processing Agreement (DPA) forms part of the agreement between Bloomorbit Ltd, a company registered in England and Wales, trading as VoxMate (“Processor”, “we”, “us”) and the customer using the VoxMate service (“Controller”, “you”). Registered address: Office 9766, 321-323 High Road, Chadwell Heath, Essex, RM6 6AX. ICO Registration Number: ZC172884.

2. Subject matter

VoxMate processes caller data on your behalf when VoxMate answers inbound calls to your dedicated UK number. The Processor role is limited to receiving inbound calls, transcribing, generating AI summaries, and delivering the resulting lead information to you via WhatsApp.

3. Duration

This DPA applies for the term of your VoxMate subscription. Processing ceases when your subscription ends. Processor-held data is retained per the retention schedule in Section 8 below.

4. Nature and purpose of processing

Nature: receiving inbound telephone calls, generating voice responses, transcribing conversations, producing AI-generated call summaries and job value estimates, delivering summaries via WhatsApp and email.

Purpose: providing the VoxMate lead notification service so that you can respond to your callers when you are unable to answer directly.

5. Type of personal data

  • Caller name
  • Caller phone number
  • Job description (nature and urgency of the work)
  • Address (captured only if the caller is reporting an emergency)
  • Call recording and transcript
  • Call metadata (timestamp, duration, answer time, outcome classification)
  • AI-generated call summary and estimated job value

6. Categories of data subjects

Members of the public who call the phone number associated with your VoxMate account.

7. Obligations of VoxMate as Processor

  • Process personal data only on your documented instructions, including instructions regarding international transfers.
  • Ensure that persons authorised to process the data are subject to a duty of confidentiality.
  • Implement appropriate technical and organisational measures to ensure the security of processing (see Security below).
  • Not engage sub-processors without your general written authorisation (that authorisation is granted by the list in Section 9 below).
  • Assist you in responding to requests from data subjects exercising their rights under UK GDPR.
  • Assist you in complying with your obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments).
  • On termination, either delete or return all caller personal data to you, unless retention is required by law.
  • Make available all information necessary to demonstrate compliance with these obligations and allow for audits.

8. Retention and deletion

  • Call recordings and transcripts: deleted 30 days after the call.
  • Structured lead data (name, phone number, job type, urgency): deleted 12 months after the call.
  • AI-generated summaries and job value estimates: deleted with the associated call record.
  • On termination of the subscription, all remaining caller data is deleted within 30 days.

9. Sub-processors

We use the following sub-processors to deliver the VoxMate service. By accepting this DPA, you provide general authorisation for their use. We will notify you of any intended additions or replacements at least 30 days in advance and give you the opportunity to object.

  • Twilio — telephony and WhatsApp delivery
  • Vapi.ai — AI voice agent orchestration
  • ElevenLabs — voice generation
  • OpenAI — call transcript analysis and summary generation
  • Supabase — database and file storage
  • Resend — transactional email delivery
  • Vercel — website hosting

10. Data transfers

Caller data is stored in Supabase infrastructure located within the European Union during Phases 1 and 2 of the VoxMate rollout. In Phase 3 we will migrate to AWS eu-west-2 (London) for UK data residency. Where sub-processors process data outside the UK/EEA, transfers are covered by UK IDTA or the EU Standard Contractual Clauses as appropriate.

11. Security

We implement appropriate technical and organisational measures including TLS encryption in transit, encryption at rest, row-level security on our database, principle of least privilege for access controls, and audit logging for security-relevant events. We test our controls periodically.

12. Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting caller data processed on your behalf. Notification will include, so far as possible: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address the breach.

13. Data subject rights

Where a caller exercises their rights under UK GDPR (access, rectification, erasure, restriction, portability, objection) against you as controller, we will provide reasonable assistance to enable you to respond within statutory time limits.

14. Contact

Data protection queries about this DPA should be sent to hello@voxmate.co.uk with “DPA” in the subject line.