Data Processing Agreement

1. 1.1Data controller - the Customer (the veterinary practice) using the service, who determines the purposes and means of processing the data of people calling them.
2. 1.2Data processor - Frominbox, MB, company code 307162506, registered at A. Juozapavičiaus g. 28, LT-09311 Vilnius, Lithuania, who processes that data on the Customer’s behalf and on their instructions.

The Processor is established outside the United Kingdom. Where the Processor is required to designate a representative in the UK under Article 27 of the UK GDPR, it will do so and will notify the Customer of the representative’s details.

This DPA applies only to processing we carry out as processor. For data where we are the controller ourselves, the Privacy Policy applies.

1. 2.1Subject matter: processing callers’ personal data while providing the AI phone-answering service to a veterinary practice.
2. 2.2Purpose: answering calls, taking enquiries and bookings, collecting contact details, recording and transcribing calls, providing summaries, forwarding calls, and escalating urgent calls.
3. 2.3Nature: collection, recording, transcription, storage, structuring, use, disclosure to sub-processors, transfer to integrations the Customer chooses (calendar, practice-management or CRM system) on their instructions, and deletion.
4. 2.4Duration: for as long as the service is provided, for the term of the Terms of Use.
5. 2.5A detailed description is given in the annexes to section 12.

Vetspeaking agrees to:

1. 3.1process personal data only on the Customer’s documented instructions, including this DPA, except where required by law;
2. 3.2inform the Customer without delay if, in our view, an instruction infringes applicable data protection law;
3. 3.3process data only for the purposes set out in this DPA and not use it for our own purposes, including not using it to train AI models;
4. 3.4ensure data is processed only by authorised staff who are bound by confidentiality;
5. 3.5assist the Customer in fulfilling their obligations under applicable data protection law;
6. 3.6while providing technical support, maintaining the service, or, at the Customer’s request, setting up or configuring the agent, allow our authorised staff to access the Customer’s account and manage the data in it; this is treated as processing on the Customer’s documented instructions (this DPA, the Terms of Use, and the Customer’s own support requests);
7. 3.7design and operate the service so that callers are told they are speaking with an AI assistant, and so that calls cannot be recorded without the greeting saying so - see Annex A.

1. 4.1Only authorised staff who need access to perform their duties have it, and they are bound by a written or statutory confidentiality obligation.
2. 4.2We do not disclose data to third parties, except approved sub-processors or where required by law.
3. 4.3Every access by an authorised staff member to the Customer’s account is logged (who accessed which practice, and when), as set out in section 5; we provide these logs to the Customer on request.
4. 4.4The confidentiality obligation continues indefinitely, including after the service ends.

In line with Article 32, we implement appropriate technical and organisational measures, including:

1. 5.1encrypting data in transit (TLS) and at rest;
2. 5.2access control, authentication and the principle of least privilege;
3. 5.3activity logging and monitoring;
4. 5.4backups and the ability to restore data availability;
5. 5.5regular review of how effective these measures are.

A fuller description of these measures is in Annex B (section 12).

1. 6.1The Customer gives general authorisation for us to engage sub-processors to provide the service.
2. 6.2We provide the Customer with the current sub-processor list - including each provider’s role, location and applicable transfer safeguard - within 5 working days of a request to paul@vetspeaking.com. The list forms an integral part of this DPA; it is not published publicly, since it is the Processor’s commercial information, and is provided under confidentiality.
3. 6.3We engage sub-processors who process personal data under their own published data processing terms and apply safeguards meeting the requirements of applicable data protection law; we choose providers offering a level of protection consistent with this DPA.
4. 6.4We notify the Customer, at the email address on their account, of any intended change or new sub-processor at least 30 days before the change. Within that period the Customer may reasonably object; if no resolution is reached, the Customer has the right to terminate the service without further penalty.
5. 6.5We remain responsible to the Customer for a sub-processor’s compliance with data protection obligations to the same extent we are responsible for our own actions.

Taking into account the nature of the processing, we use appropriate technical and organisational measures to help the Customer fulfil their obligation to respond to data subject requests (access, rectification, erasure, restriction, portability, objection). The Customer can view, export and delete calls, transcripts and contacts directly in their account. If a caller contacts us directly, we refer them to the Customer as data controller and let the Customer know.

1. 8.1On becoming aware of a personal data breach, we notify the Customer without undue delay and provide the information available to us that they need to meet their own obligations. This applies to every breach, not only serious ones - the assessment of whether it is reportable is the Customer’s to make, as controller.
2. 8.2The Customer, as controller, decides whether to report to their supervisory authority - the Information Commissioner’s Office in the UK, or the Data Protection Commission in Ireland - and does so within 72 hours of becoming aware where the breach is reportable.
3. 8.3We help the Customer carry out a data protection impact assessment (DPIA) and, where needed, consult the supervisory authority in advance. A pre-filled DPIA template for veterinary practices is available on request.

Our database, call recordings and transcripts are stored in the United Kingdom (London). For a Customer established in the UK, this is domestic processing, not a restricted transfer, so no additional safeguard is required for that storage. Other legs of the processing do involve a transfer, and each has a lawful route:

1. 9.1To the European Economic Area - the Processor is established in Lithuania, and payment and sign-in providers process some data in Ireland. These transfers are covered by the UK adequacy regulations for the EEA, so no additional safeguard is required.
2. 9.2To the United States - covered by the UK Extension to the EU-US Data Privacy Framework where the provider holds an active certification covering the UK Extension. Where a provider is not so certified, we put in place the International Data Transfer Agreement issued by the Information Commissioner, or the UK Addendumto the European Commission’s Standard Contractual Clauses, and complete and record a transfer risk assessment (the “data protection test” under the Data (Use and Access) Act 2025).

Where the Customer is established in Ireland or elsewhere in the EEA, the position is different: because the Processor is established in the EU (Lithuania), it remains subject to the EU GDPR for everything it processes, wherever that happens. Storing the Customer’s data on UK-based infrastructure is therefore an international transfer from the Processor’s own perspective - covered by the European Commission’s adequacy decision for the United Kingdom (renewed December 2025, valid to December 2031), so no further safeguard is needed for that leg either. Transfers to the United States rely on the EU-US Data Privacy Frameworkwhere the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses with supplementary measures.

The route applied to each individual provider is set out in the sub-processor list provided under section 6.

1. 10.1We carry out deletion without undue delay, and in backups through the normal rotation cycle.
2. 10.2Before deletion, the Customer is given the opportunity to take their data.
3. 10.3We may retain only the data we are required to keep under applicable law, and only for the applicable period.
4. 10.4At the Customer’s request, we provide confirmation that deletion has taken place.

We provide the Customer with the information needed to demonstrate compliance with the obligations of Article 28, and allow for audits carried out by the Customer or their authorised auditor, at a reasonable time and scope agreed in advance and subject to confidentiality.