Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of every agreement under which We Are One 1 Limited, trading as SONIQ Labs ("SONIQ", "Processor"), provides services to a customer or partner ("Controller"), including the Partner Master Service Agreement, where it is Schedule G. If this DPA conflicts with that agreement on data protection, this DPA prevails.

1. Definitions

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and the Data (Use and Access) Act 2025, as amended. "Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "special category data" have the meanings in the UK GDPR. Where a partner resells SONIQ, the partner is the Controller towards SONIQ, and passes these terms on to its customers.

2. Roles and instructions

1. The Controller is the controller and SONIQ is the processor of the personal data described in Annex A.
2. SONIQ processes personal data only on the Controller's documented instructions. Those instructions are this DPA, the agreement, and the Controller's configuration of the services. SONIQ will process data otherwise only if the law requires it, and will tell the Controller first unless the law forbids it.
3. SONIQ will tell the Controller promptly if it believes an instruction breaks Data Protection Law.
4. SONIQ will not start a new purpose of processing without the Controller's written instruction.
5. The Controller is responsible for having a lawful basis, giving notices to data subjects, including call recording notices, and obtaining any consents.

3. Confidentiality

Everyone at SONIQ who can access personal data is bound by confidentiality. Staff access a customer account only to provide the service or answer a support request, and that access is logged.

4. Security

SONIQ maintains the technical and organisational measures in Annex B and will not materially reduce them during the term.

5. Sub-processors

1. The Controller authorises the sub-processors listed at soniqlabs.co.uk/legal/sub-processors.
2. SONIQ will give at least 30 days' written notice before adding or replacing a sub-processor, including a change of AI provider. The Controller may object on reasonable grounds within that period. If SONIQ cannot resolve the objection, the Controller may terminate the affected services without penalty.
3. SONIQ imposes terms on each sub-processor that are at least as protective as this DPA, and remains liable for its sub-processors.

6. International transfers

SONIQ will transfer personal data outside the UK only to the locations shown on the sub-processors page and under the UK-US Data Bridge, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

7. AI processing

1. AI features process personal data only to provide those features to the Controller, within the Controller's account.
2. SONIQ does not use the Controller's personal data, including call content, transcripts, summaries and derived data, to train, fine-tune or improve any AI model, and its sub-processors are contractually barred from doing so.
3. SONIQ may use aggregated service metrics, such as call volumes, latency and error rates, that contain no personal data and no call content, to run and improve the platform.
4. The Controller can switch recording, transcription, AI summaries and the AI receptionist on or off.
5. AI outputs support human decisions. SONIQ does not use them to make solely automated decisions with legal or similarly significant effects.

8. Special category and health data

1. SONIQ recognises that calls may contain special category data, including health data where the Controller is a health or care provider. SONIQ processes it only as part of the services, under this DPA.
2. The Controller is responsible for its Article 9 condition and, where it is a health or care body, its Caldicott and clinical safety obligations. SONIQ will provide the information the Controller reasonably needs for them.
3. SONIQ will not move special category data to a new processing location or new sub-processor without the 30-day notice in clause 5.

9. Data subject requests

SONIQ will pass any request it receives from a data subject to the Controller within 2 working days and will not reply itself unless instructed. SONIQ will help the Controller answer requests for access, correction, erasure, restriction, portability and objection, and will supply the relevant data within 7 days of a request.

10. Personal data breaches

1. SONIQ will notify the Controller in writing within 48 hours of becoming aware of a personal data breach affecting the Controller's data, including at weekends.
2. The notice will describe, as far as known: what happened; the categories and approximate numbers of data subjects and records; the likely consequences; the measures taken or proposed; and a named contact. SONIQ will update it as more is known.
3. SONIQ will not notify the Information Commissioner, data subjects or any third party about a breach of the Controller's data without the Controller's consent, unless the law requires it.
4. SONIQ keeps a register of breaches and will share relevant entries with the Controller.
5. Where a breach is caused by SONIQ, SONIQ will help the Controller with the Information Commissioner at its own cost.

11. Impact assessments

SONIQ will give reasonable help with the Controller's data protection impact assessments and any prior consultation with the Information Commissioner.

12. Audit

1. SONIQ will make available the information needed to show compliance with this DPA, including its security measures, sub-processor list and its providers' certificates.
2. The Controller may send one security questionnaire a year, which SONIQ will answer within 30 days.
3. The Controller, or an auditor bound by confidentiality, may audit remotely or on site once a year on 30 days' notice, and at any time after a personal data breach. Audits must not compromise other customers' data. Each party bears its own costs unless the audit shows a material breach by SONIQ.

13. Return and deletion

When the agreement ends, the Controller may export its data for 90 days. SONIQ will then delete it from live systems, and backups expire within a further 30 days. SONIQ will confirm deletion in writing on request. SONIQ may keep only records the law requires it to keep, such as billing records, and will protect them under this DPA.

14. Duration, liability and survival

This DPA applies for as long as SONIQ processes the Controller's personal data, including after the agreement ends, and its obligations survive until all such data is deleted or returned. Liability is as set out in the agreement.

Annex A: Description of processing

• Subject matter and duration: provision of the SONIQ services for the term of the agreement and the exit period.
• Nature and purpose: connecting, routing, recording and transcribing calls; voicemail; messaging; AI summaries, intent and the AI receptionist; contact centre and reporting; integrations the Controller enables; support; security and fraud prevention.
• Data subjects: the Controller's staff and users; its callers, customers, patients, prospects and contacts; others who communicate with the Controller through the services.
• Personal data: names, phone numbers and email addresses; job details; call metadata; call audio, recordings, voicemails and transcripts; message content; AI outputs; device and sign-in data.
• Special category data: may be present in call content and messages, for example health data.
• Locations: database in the United Kingdom (London); voice servers in the United Kingdom; live transcription in the European Union; other locations as shown on the sub-processors page.
• Retention: as set by the Controller for recordings and transcripts; otherwise as in clause 13.

Annex B: Technical and organisational measures

• Encryption: TLS 1.2 or higher for data in transit; SRTP for app calls; encryption at rest on all stores.
• Tenant separation: every customer's data separated by database row-level security and enforced tenancy checks in the API.
• Access control: multi-factor authentication on administrative consoles; least privilege; access reviewed and removed promptly when roles change; logged support access.
• Servers and network: key-only SSH, root login disabled, deny-by-default firewalls, intrusion blocking and automatic blocking of known SIP scanners.
• Secure development: private repositories, versioned database migrations, testing on an isolated environment before production, staged releases with automatic rollback.
• Vulnerability management: dependency and security updates; critical issues fixed within 48 hours and high within 7 days.
• Backups and recovery: database point-in-time recovery; encrypted daily server backups with immutability; restore tests.
• Records: write-once storage for recordings where regulation requires it; tamper evidence by hash.
• Payments: card numbers masked in transcripts and recording paused during payment.
• Monitoring and incidents: service health monitoring, audit logs kept for at least 12 months, a documented incident process and post-incident reviews.
• Providers: core infrastructure providers certified to ISO 27001 and SOC 2 Type II.

Questions about this DPA: [email protected].