Data Processing Addendum

1. What our standard DPA covers

• controller and processor roles
• processing instructions and confidentiality obligations
• security measures and sub-processor handling
• data subject rights assistance and breach notification
• return and deletion rules
• transfer-mechanism language for restricted transfers

2. Current production posture

• Voxilo's current production stack is US-first and does not make EU-only residency a default promise.
• Where transfers require a safeguard, the standard form relies on the applicable Standard Contractual Clauses or another valid transfer mechanism.
• If you need EU-only or EEA-only residency, that must be separately reviewed against the actual production vendor path before signature.

3. How to request a signed copy

Email info@voxilo.ai with:

• your legal entity name
• the signatory name and signatory email
• your notice address
• the order form, agreement, or plan reference
• your expected go-live date
• whether you need our standard paper or plan to send redlines
• whether you are asking for GDPR only or also for a residency commitment

4. Sub-processors and trust materials

Current sub-processors and optional customer-directed downstream integrations are disclosed in our Privacy Policy and our Sub-processors page. We keep those surfaces aligned with the current production evidence and contract posture.

5. Redlines and special commitments

Non-standard redlines, unlimited audit rights, bespoke sub-processor approval mechanics, or EU-only residency commitments may require additional review before Voxilo can sign.

6. Standard form availability

Voxilo's standard DPA form is maintained internally as the execution baseline. A signed copy is available on request through the intake path above.