Data Processing Agreement — A1 Voice (A1 Ergotech Limited)

Last updated: 2026-05-11

Parties

This Data Processing Agreement ("DPA") is entered into between:

(1) A1 Ergotech Limited, a company registered in England and Wales (the "Processor"):

(2) The customer practice identified in the order form, Master Services Agreement, or Terms of Service to which this DPA is attached (the "Controller").

The Processor and the Controller are each a "Party" and together the "Parties". This DPA forms part of, and is governed by, the agreement between the Parties for the supply of the A1 Voice service (the "Principal Agreement"). In the event of a conflict between this DPA and the Principal Agreement, this DPA prevails on matters of data protection.

1. Definitions

1.1 In this DPA, the following terms have the meanings given to them:

• "Data Protection Laws" means the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), and any other laws relating to the protection of personal data applicable to the Parties.
• "Personal Data", "Special Category Data", "Data Subject", "Controller", "Processor", "Sub-processor", "Processing" (and "process"), "Personal Data Breach", and "Supervisory Authority" have the meanings given in the UK GDPR and Data Protection Act 2018.
• "Customer Personal Data" means Personal Data that the Processor processes on behalf of the Controller under the Principal Agreement, as further described in Schedule 1.
• "Sub-processor" means any third party engaged by the Processor to process Customer Personal Data on its behalf, as listed in Schedule 3.
• "Services" means the A1 Voice AI receptionist service supplied under the Principal Agreement (call handling, transcription, appointment booking, routing, dashboard, and ancillary functions).
• "Standard Contractual Clauses" or "SCCs" means (a) the UK Information Commissioner's International Data Transfer Agreement (IDTA) and/or the UK Addendum to the EU SCCs, or (b) the European Commission's standard contractual clauses for the transfer of personal data to third countries (Decision 2021/914), as appropriate to the transfer.

1.2 References to articles in this DPA are to articles of the UK GDPR unless otherwise stated.

2. Subject matter, duration, nature, and purpose of processing

2.1 The subject matter, duration, nature, and purpose of the Processor's processing of Customer Personal Data, together with the type of Personal Data and the categories of Data Subject, are as set out in Schedule 1 (Details of Processing).

2.2 The Processor processes Customer Personal Data solely for the purposes set out in Schedule 1 and as documented in the Principal Agreement, this DPA, or further written instructions from the Controller (including reasonable instructions issued through the dashboard, support channels, or the Controller's authorised personnel).

3. Type of personal data and categories of data subjects

3.1 The categories of Personal Data and Data Subjects whose Personal Data is processed under this DPA are set out in Schedule 1, paragraphs 5 and 6.

3.2 The Parties acknowledge that some Customer Personal Data is Special Category Data within the meaning of UK GDPR Article 9 (in particular, health-related details that a patient may disclose in the course of a call). The lawful basis for the Controller's processing of such data is its provision of healthcare under UK GDPR Article 9(2)(h), executed under the Data Protection Act 2018 Schedule 1 Part 1 paragraph 2, or such other Article 9 basis as the Controller determines and notifies to the Processor.

4. Obligations of the Processor

4.1 Processing only on documented instructions

4.1.1 The Processor shall process Customer Personal Data only on documented instructions from the Controller, including with regard to international transfers, unless required to do otherwise by UK or EU Member State law to which the Processor is subject. In that case, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

4.1.2 The Principal Agreement, this DPA, the standard configuration of the Services, and instructions issued by the Controller through the dashboard or other channels agreed between the Parties together constitute the Controller's documented instructions.

4.1.3 The Processor shall promptly inform the Controller if, in its opinion, an instruction infringes Data Protection Laws.

4.2 Confidentiality

4.2.1 The Processor shall ensure that all personnel (employees, contractors, and authorised sub-processor personnel) authorised to process Customer Personal Data are bound by appropriate confidentiality obligations, whether by contract, statute, or professional duty, that survive the termination of their engagement.

4.2.2 The Processor shall ensure that access to Customer Personal Data is limited to personnel who need access in order to perform their duties under the Principal Agreement.

4.3 Security measures

4.3.1 The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to Data Subjects.

4.3.2 The measures in place as at the date of this DPA are set out in Schedule 2 (Technical and Organisational Security Measures). The Processor may update these measures from time to time provided that the level of protection is not materially reduced.

4.4 Sub-processors

4.4.1 The Controller grants the Processor general written authorisation under UK GDPR Article 28(2) to engage Sub-processors for the processing of Customer Personal Data, subject to this clause 4.4.

4.4.2 The Sub-processors authorised at the date of this DPA are listed in Schedule 3.

4.4.3 The Processor shall:

(a) impose on each Sub-processor, by way of a written contract, data-protection obligations that are no less protective than those set out in this DPA;

(b) remain fully liable to the Controller for the performance of each Sub-processor's obligations;

(c) carry out reasonable due diligence on each Sub-processor before engagement and on a periodic basis thereafter.

4.4.4 The Processor shall give the Controller at least 30 days' prior written notice of any intended addition or replacement of a Sub-processor that will process Customer Personal Data. Notice is given by (i) updating the versioned Sub-processor list at https://voice.a1ergo.tech/sub-processors, AND (ii) sending an email to the Controller's nominated technical / data-protection contact on the Order Form. The Controller may object on reasonable data-protection grounds within that 30-day period. If the Controller objects and the Parties cannot agree on a resolution within a further 30 days, the Controller may terminate the affected Services on reasonable notice, and the Controller shall not be charged for those Services after the effective termination date.

4.5 Assistance with data-subject rights

4.5.1 Taking into account the nature of the processing, the Processor shall provide the Controller with reasonable assistance, by appropriate technical and organisational measures, to enable the Controller to fulfil its obligation to respond to requests from Data Subjects exercising their rights under UK GDPR Chapter III (access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making).

4.5.2 If the Processor receives a request directly from a Data Subject, it shall not respond to the request itself (except to acknowledge receipt and direct the Data Subject to the Controller) and shall forward the request to the Controller without undue delay, and in any event within 5 working days of receipt.

4.5.3 The Processor shall provide the assistance referred to in clause 4.5.1 within 10 working days of the Controller's request, or sooner if reasonably required to enable the Controller to meet its statutory deadline.

4.6 Personal Data Breach notification

4.6.1 The Processor shall notify the Controller of a Personal Data Breach affecting Customer Personal Data without undue delay, and in any event within 72 hours of becoming aware of the breach.

4.6.2 The notification shall, to the extent the information is then available, describe:

(a) the nature of the breach, including, where possible, the categories and approximate number of Data Subjects and records concerned;

(b) the likely consequences of the breach;

(c) the measures taken or proposed to address the breach and to mitigate its possible adverse effects;

(d) the name and contact details of a point of contact for further information.

4.6.3 Where the information is not all available within 72 hours, the Processor shall provide it in phases without further undue delay.

4.6.4 The Processor shall reasonably assist the Controller in meeting the Controller's own breach-notification obligations to the Supervisory Authority and to affected Data Subjects under UK GDPR Articles 33 and 34.

4.7 Data Protection Impact Assessments and prior consultation

4.7.1 The Processor shall provide the Controller with reasonable assistance, taking into account the nature of the processing and the information available to the Processor, in carrying out:

(a) Data Protection Impact Assessments under UK GDPR Article 35; and

(b) prior consultation with the Supervisory Authority under UK GDPR Article 36, where applicable.

4.8 Return or deletion of Customer Personal Data

4.8.1 At the choice of the Controller, the Processor shall either return all Customer Personal Data to the Controller or delete it (and existing copies) on termination or expiry of the Services, unless retention is required by UK or EU Member State law.

4.8.2 The Controller shall communicate its choice in writing within 30 days of termination. If no instruction is received within that period, the Processor shall delete the Customer Personal Data, except for any copies held in routine, encrypted backups, which shall be deleted in line with the standard backup-rotation cycle (currently up to 90 days).

4.8.3 The Processor shall certify in writing that deletion has been carried out on the Controller's request.

4.9 Audit rights

4.9.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and Article 28 of the UK GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

4.9.2 The right of audit may be exercised:

(a) at most once per calendar year, on at least 30 days' prior written notice; and

(b) at any time on reasonable notice following a confirmed Personal Data Breach affecting the Controller's data, or where the Supervisory Authority requires it.

4.9.3 Audits shall be conducted during normal business hours, in a manner that does not unreasonably disrupt the Processor's operations, and subject to reasonable confidentiality undertakings. The Controller shall bear its own and the Processor's reasonable costs of any audit, except where the audit reveals material non-compliance by the Processor with this DPA, in which case the Processor shall bear those costs.

4.9.4 The Processor may satisfy its obligations under this clause 4.9 by providing recent third-party audit reports, certifications (e.g. ISO 27001, SOC 2), or written responses to a reasonable security questionnaire, where these are sufficient to demonstrate compliance.

5. International transfers

5.1 The Processor shall store and process the call-handling layer of Customer Personal Data (audio recordings, transcripts, dashboard, database, account records) in the United Kingdom or the European Economic Area (currently AWS region eu-west-2 London for primary infrastructure).

5.2 The AI-inference layer (LLM calls made by the Processor or its Sub-processors to support call handling) is region-pinned to the UK (London, europe-west2) via the Vertex AI EU regional endpoint of the Processor's LLM inference provider, on both the production and staging environments. (europe-west2 is Google Cloud's London region — a UK locality, included within the provider's "Vertex AI EU" product offering.) Speech-to-text transcripts and any prompt context derived from them remain within the UK during inference; no audio is sent to LLM providers. Where, exceptionally, a transfer of Customer Personal Data outside the UK / EEA is required (for example, if the region-pinned endpoint is unavailable and the Processor fails over to a non-UK / non-EEA endpoint to maintain service), the Processor relies on the safeguards in clause 5.3. The Processor maintains a Transfer Impact Assessment evidencing the supplementary safeguards behind those mechanisms (shared with Controllers on request).

5.3 The Processor shall not transfer, or permit any Sub-processor to transfer, Customer Personal Data outside the UK and EEA without:

(a) ensuring that the transfer is to a country, territory, or sector benefiting from a UK adequacy regulation or a European Commission adequacy decision; or

(b) implementing appropriate safeguards under UK GDPR Article 46, including the UK IDTA, the UK Addendum to the EU SCCs, or the EU SCCs, together with any supplementary measures required following a transfer-impact assessment.

5.4 The Sub-processors authorised under this DPA, and the regions in which they process Customer Personal Data, are set out in Schedule 3. Any new Sub-processor that would process Customer Personal Data outside the UK / EEA is subject to clause 4.4.4 (notice and objection) and to clause 5.3 (transfer safeguards). UK / EEA residency for AI inference is the default posture under this DPA (the AI-inference layer is currently pinned specifically to the UK — London europe-west2 — per clause 5.2). For a Controller that requires a tighter posture — for example refusal of the fail-over described in clause 5.2, or a requirement that the AI-inference layer never move out of the UK even on fail-over — the Processor can configure the tenant accordingly; contact privacy@a1ergo.tech.

6. Liability

6.1 Each Party acknowledges that, under UK GDPR Article 82, a Data Subject who has suffered material or non-material damage as a result of an infringement of UK GDPR has a direct statutory right of compensation against the Controller and/or the Processor. Statutory liability of either Party to a Data Subject under Article 82 cannot be limited or excluded by contract, and nothing in this DPA or the Principal Agreement purports to do so.

6.2 As between the Parties, the contractual liability of each Party arising out of or in connection with this DPA shall be subject to the limitations and exclusions of liability set out in the Principal Agreement, save that nothing in this DPA or the Principal Agreement excludes or limits liability that cannot lawfully be excluded or limited (including liability under UK GDPR Article 82, fraud, or death or personal injury caused by negligence).

6.3 Where one Party has paid compensation to a Data Subject under UK GDPR Article 82(4) in respect of damage for which the other Party is wholly or partly responsible, that Party shall be entitled to claim back from the other Party that part of the compensation corresponding to the other Party's share of responsibility, in accordance with UK GDPR Article 82(5).

7. Term

7.1 This DPA comes into effect on the date of the Principal Agreement (or, if signed separately, the date of last signature) and continues for so long as the Processor processes Customer Personal Data on behalf of the Controller.

7.2 Clauses that by their nature should survive termination — including clauses 4.2 (confidentiality), 4.6 (breach notification, in respect of breaches occurring before termination), 4.8 (return or deletion), 4.9 (audit, in respect of the period before termination), 5 (international transfers), and 6 (liability) — survive termination of this DPA and the Principal Agreement.

8. General

8.1 Governing law and jurisdiction. This DPA is governed by the laws of England and Wales. The Parties submit to the exclusive jurisdiction of the courts of England and Wales, save that the Controller may bring proceedings in the courts of its place of establishment where required by law.

8.2 Severability. If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions continue in full force and effect.

8.3 Notices. Notices under this DPA shall be given in writing to the contacts identified in the Principal Agreement, with a copy of any data-protection notice to privacy@a1ergo.tech.

8.4 Variation. The Parties may amend this DPA in writing, signed by authorised representatives of both Parties.

8.5 Entire agreement. This DPA, together with the Principal Agreement, constitutes the entire agreement between the Parties in respect of the processing of Customer Personal Data.

8.6 Order of precedence. In the event of a conflict between (a) this DPA, (b) the Principal Agreement, and (c) the Schedules to this DPA, the order of precedence (highest first) is: (i) the body of this DPA; (ii) the Schedules; (iii) the Principal Agreement; in each case only on matters of data protection.

Schedule 1 — Details of Processing

Schedule 2 — Technical and Organisational Security Measures

The Processor implements the following measures, mirroring § 8 of the A1 Voice Privacy Policy:

1. Encryption in transit. TLS 1.2 or higher for all connections carrying Customer Personal Data, including telephony media (where the upstream carrier supports it), API traffic, and dashboard sessions.
2. Encryption at rest. AES-256 encryption for stored audio recordings, transcripts, and database contents containing Customer Personal Data, using managed-key services (AWS KMS) with key rotation enabled.
3. Data residency. The call-handling infrastructure (WebRTC, audio storage, transcripts, dashboard, database) runs in AWS region eu-west-2 (London) — patient call audio and transcripts are stored in the UK. The AI-inference layer (LLM calls to Google Gemini) is region-pinned to Google's London region (europe-west2) via the Vertex AI EU regional endpoint on both staging and production — so AI-inference also stays in the UK. Where, exceptionally, a transfer outside the UK / EEA is required (e.g. fail-over from the region-pinned endpoint to a non-UK / non-EEA endpoint), the safeguards in clause 5 apply (UK IDTA / SCCs as appropriate). No audio is sent to LLM providers — only speech-to-text transcripts and prompt context derived from them.
4. Access control. Role-based access control with the principle of least privilege. Production access is restricted to named personnel with documented need. Multi-factor authentication is required for all privileged accounts.
5. Audit logging. All access to Customer Personal Data — by personnel, by application code, and by Sub-processors — is logged. Logs are retained for at least 12 months and reviewed on a periodic and on-incident basis.
6. Network security. Production environments are segregated from development and corporate networks. Inbound access is restricted to authorised IP ranges and authenticated endpoints.
7. Secure development. Source code is held in version control with required code review on changes touching Customer Personal Data. Secrets are stored in a managed secret store, never in code.
8. Backup and recovery. Encrypted backups are taken on a regular schedule. Backup-rotation cycles are aligned with the retention defaults in Schedule 1.
9. Vulnerability management. Operating-system and dependency patches are applied on a regular cadence. Critical security updates are prioritised and applied promptly.
10. Incident response. A documented incident-response procedure including triage, containment, and breach-notification within 72 hours of awareness, in line with clause 4.6.
11. Personnel measures. All personnel with access to Customer Personal Data are bound by written confidentiality undertakings and receive role-appropriate data-protection training.
12. Sub-processor management. Written contracts with all Sub-processors imposing data-protection obligations no less protective than this DPA, plus periodic review of each Sub-processor's security posture.
13. No model training without consent. Customer call audio and transcripts are not used to train the Processor's or any third party's machine-learning models without the Controller's explicit, written, practice-level consent.
14. No payment-card storage. The Processor does not store credit-card numbers; payment processing is handled by Stripe under PCI DSS scope.

Schedule 3 — List of Approved Sub-processors

The Sub-processors listed below are authorised at the date of this DPA. Each one processes Customer Personal Data on behalf of the Processor under a written contract imposing data-protection obligations no less protective than this DPA. Updates are made under clause 4.4.

Notes:

• This Schedule lists only the third parties that process Customer Personal Data on the Processor's behalf. Other third-party services that the Processor uses but that do not process Customer Personal Data (Cal.com EU for demo booking on the Processor's marketing pages; Stripe for the Processor's own customer billing; Caddy / Let's Encrypt for TLS; GitHub for source-control) are listed for transparency in Schedule 4 and are not Sub-processors for the purposes of this DPA.
• The Processor's companion Privacy Policy (https://voice.a1ergo.tech/privacy § 4) lists the same Sub-processors. Schedule 3 and the Privacy Policy stay in lock-step — when one moves, the other moves.

Schedule 4 — Other third-party services (transparency only — not Sub-processors under this DPA)

The services listed below are used by the Processor in connection with its business but do not process Customer Personal Data as defined in Schedule 1. They are independent data controllers of any data they collect from the Processor or from individuals interacting with the Processor's marketing pages, or they process operational metadata that does not include Customer Personal Data. They are listed here for transparency so the Controller has a full view of the third-party landscape.

Notes:

• Because the services in Schedule 4 do not process Customer Personal Data, they are not subject to clause 4.4 (sub-processor authorisation, notice, objection, and 30-day window). The Controller does, of course, retain any rights it has against those services in their own capacity (e.g. as an independent controller of the Controller's own billing data with Stripe).
• Cal.com EU appears here, not in Schedule 3, because patient call data does not flow through Cal.com — the booking widget is purely on the Processor's public marketing pages. This mirrors the framing in the companion Privacy Policy at https://voice.a1ergo.tech/privacy § 4.5 ("Independent third-party services we link to").

Signatures

Signed for and on behalf of A1 Ergotech Limited (Processor):

Signed for and on behalf of the Controller: