This Addendum ("DPA") forms part of the Terms between you ("Customer", "controller") and audesti ("Processor", "we"). It applies whenever you use audesti to process personal data of people in the EU, the UK, India or any other jurisdiction with comparable law.
You accept this DPA by accepting the Terms. A countersigned copy is available on request to [email protected] for customers whose procurement requires one.
Where this DPA conflicts with the Terms, this DPA governs on data protection.
01Definitions
"GDPR" means Regulation (EU) 2016/679; "UK GDPR" means the GDPR as retained in UK law with the Data Protection Act 2018; "DPDP Act" means India's Digital Personal Data Protection Act 2023. Controller, processor, data subject, personal data, processing and personal data breach carry their GDPR meanings; under the DPDP Act, "controller" reads as Data Fiduciary, "processor" as Data Processor, and "data subject" as Data Principal. "Data Protection Law" means all of the above as applicable, with any other privacy law applying to a party.
02Roles
You are the controller of personal data you process through audesti — in particular, the personal data of guests you invite. We are your processor for it. You are responsible for the lawfulness of the collection, including having a valid basis to contact each guest and a valid basis for the processing we carry out on your behalf.
We are an independent controller for our own account, billing, security and usage data, which is governed by the Privacy Policy rather than this DPA.
03Scope of processing — Annex I in substance
Subject matter. Provision of the audesti voice-testimonial platform.
Duration. For as long as your account is active, plus the short deletion window in clause 11.
Nature and purpose. Collecting voice recordings from guests you invite; storing them; transcribing them; producing an edited transcript and, where requested, translations; producing a cleaned copy of the audio for playback; automated analysis of the transcript; making the results available to you; and publishing approved testimonials through widgets, share pages and your showcase page in line with the permissions described in the Terms.
Types of personal data.
- Guest identity supplied by you: name, and optionally email, company and job title.
- Voice recordings, and the cleaned copy derived from them.
- Verbatim and edited transcripts, detected language, duration, translations.
- Automated analysis of transcripts: topics, sentiment, feature mentions, pain points, quotable phrases, mentions of other companies, stated outcomes.
- Consent records: the consent flag, the version of the wording shown, timestamp, IP address, browser user-agent, session identifier.
- Publication decisions: opt-in or refusal, its source and date, and any later withdrawal.
- Anything a guest chooses to say in their recording, which is within their control and not ours.
Categories of data subjects. Your customers and other guests you invite to record; your team members you add to the account.
Special categories. audesti is not designed for special-category data and you must not solicit it. Voice recordings are not processed to identify anyone — there is no voiceprint, speaker-matching or voice-authentication function — so they are not Article 9 biometric data. If a guest volunteers special-category content in what they say, you remain the controller of it and should remove it.
04Our obligations
We will:
(a) Process only on your instructions. We process personal data only on your documented instructions, which comprise the Terms, this DPA and your use of the platform's features. If we believe an instruction breaches Data Protection Law, we will tell you without undue delay, and may suspend that processing. Where the law requires us to process for another reason, we will tell you first unless the law forbids it.
(b) Keep it confidential. Everyone we authorise to process personal data is bound by confidentiality and trained appropriately. Access is on a least-privilege basis.
(c) Secure it. We maintain the technical and organisational measures in clause 15.8 of the Privacy Policy, appropriate to the risk, and will not materially weaken them during the term.
(d) Not use your data for our own purposes. We do not sell it, use it for advertising, or use it to train AI models — ours or anyone else's.
05Automated and AI processing
Transcription, transcript editing, translation and analysis are performed by the sub-processors named in clause 6, on your instruction, as part of the service you bought. No person at audesti reads or listens as a matter of routine; we access content only for support you request, or where necessary to investigate abuse, secure the platform or comply with law.
Output is probabilistic. The verbatim transcript is retained alongside the edited one so you can verify it. We make no decision about any data subject, and you may not use the platform or its output for decisions producing legal or similarly significant effects.
06Sub-processors
You give general authorisation for us to engage sub-processors. The current list, with role and location, is at Sub-processors and forms part of this DPA.
We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain fully liable to you for their performance.
Disclosures you direct are not sub-processing. Where you connect an AI assistant over our MCP connector, or use the API to send data to your own systems, you are instructing a disclosure to a recipient of your choosing. Those recipients are not our sub-processors, we have no contract with them in respect of your data, and we are not responsible for what they do with it. You are responsible for ensuring that disclosure is lawful, which includes having a basis to disclose guest personal data to that assistant's provider, and for informing guests where your own transparency obligations require it.
07Changes to sub-processors
We will update the sub-processor page before a new sub-processor starts processing personal data, and will notify customers who have registered for notice at [email protected] at least 14 days in advance.
You may object on reasonable data protection grounds within those 14 days. We will work with you in good faith to find an alternative. If we cannot within a reasonable time, you may terminate the affected part of the service without penalty, and we will refund fees prepaid for the unused remainder of the term.
08Assistance with data subject rights
The platform lets you handle most requests yourself: viewing, editing, exporting to CSV and deleting testimonials; deleting all of your team's content; recording a guest's withdrawal of publication consent, which removes the testimonial from our public pages and deletes the share card immediately.
Where a request needs us, we will assist you with appropriate technical and organisational measures, taking into account the nature of the processing. If a data subject contacts us directly about data we process for you, we will not respond on the merits other than to confirm receipt and direct them to you, and we will tell you without undue delay — except where we are deleting a recording at a guest's direct request under the commitment in our Privacy Policy, in which case we will tell you we have done so.
09Personal data breaches
We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting personal data we process for you. The notification will describe, so far as we know it, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point.
We will give you reasonable assistance in meeting your own notification duties to authorities and data subjects. We will not make a public statement identifying you in connection with a breach without consulting you first, unless the law requires it.
Notifying you is not an admission of fault or liability.
10DPIAs and prior consultation
Taking into account the nature of the processing and the information available to us, we will give you reasonable assistance with data protection impact assessments and any prior consultation with a supervisory authority arising from your use of audesti. Our documentation — this DPA, the Privacy Policy, the clause 15 of the Privacy Policy and Sub-processors — is intended to supply most of what an assessment needs.
11Deletion and return
You can delete personal data at any time: individual testimonials, all of your team's content in a single action, or your whole account.
Deletion removes the data from our live database and file storage immediately, and purges cached copies at our edge. Our database provider takes no scheduled backups on the plan we currently use, so no backup copy survives. If we enable backups, a deleted record could persist in one for up to 30 days, and we will update our published policies before that becomes true.
On termination of the Terms, we delete personal data processed on your behalf in the normal course, unless the law requires us to keep it — in which case we keep it only for as long as required and only for that purpose. Before deleting your account you can export testimonials to CSV; after deletion we cannot recover anything.
12Audit
We will make available the information reasonably necessary to demonstrate compliance with this DPA, and will respond to a reasonable written security questionnaire once in any twelve-month period.
Where Data Protection Law gives you an audit right that documentation cannot satisfy, an audit may be conducted on at least 30 days' written notice, during business hours, no more than once in any twelve-month period except following a confirmed breach, under confidentiality, by you or an independent auditor who is not our competitor, and in a way that does not disrupt the service or risk other customers' data. You bear the cost unless the audit uncovers material non-compliance.
13International transfers
Where we transfer personal data out of the EEA or the UK, the European Commission's Standard Contractual Clauses are incorporated into this DPA by reference, with Module Two (controller to processor) applying between you and us, and Module Three where we engage a sub-processor. For the UK, the UK Addendum applies to those clauses, or the UK IDTA where appropriate.
For the purposes of the clauses: the data exporter is you; the data importer is audesti; the Annexes are populated by clause 3 of this DPA (subject matter, duration, nature, purpose, data types, data subjects), the Sub-processors page (sub-processors), and clause 15.8 of the Privacy Policy (technical and organisational measures); the governing law and forum are as stated in the Terms, save where the clauses require an EU or UK member state law and forum, in which case those apply for the clauses alone.
Under the DPDP Act, transfers out of India are permitted except to a country restricted by the Central Government.
A copy of the executed transfer clauses is available on request.
14Your obligations
You will: have and maintain a lawful basis for the processing you instruct; give guests the information your own transparency obligations require; not solicit special-category data; not use audesti for decisions producing legal or similarly significant effects; respect guest withdrawals promptly, including by removing a testimonial from widgets on your own site; keep your credentials, API keys and connector grants secure; and ensure that any disclosure you direct, including to a connected AI assistant, is lawful.
You will indemnify us against claims arising from your breach of this clause, on the terms of clause 15 of the Terms.
15Liability and term
Each party's liability under this DPA is subject to the limitations in clause 14 of the Terms, save where Data Protection Law does not permit it. Nothing here limits a data subject's rights against either party.
This DPA takes effect when you accept the Terms and continues while we process personal data on your behalf. Clauses 11, 12, 13 and 15 survive termination.
Questions, or a countersigned copy: [email protected]