Data Processing Terms

These data processing terms form part of the agreement between Aymex LTD (company number 15515557, "we") and each organisation that uses AymexConnect ("you"). They meet the requirements of Article 28 of the UK GDPR.

You are the controller of the personal data you and your users put into the service: call recordings, voicemail, messages, contacts, transcripts and AI summaries. We are your processor for that data.

We are a controller in our own right for the data we need to run a regulated phone service: account and billing details, call detail records used for billing, fraud prevention, emergency calls and our legal obligations. Our privacy policy covers that data.

• Purpose: providing the AymexConnect service as described in your agreement, including calls, messaging, meetings, voicemail, recording and the AI features you switch on.
• Duration: for as long as your account is open, and then until deletion as described under 'When the agreement ends'.
• People whose data is processed: your users, and the people they call, message or meet with, such as customers, service users, families and suppliers.
• Types of data: names, phone numbers, email addresses, call metadata, the content of calls, voicemails, messages and meetings where recorded, transcripts and AI-generated summaries.
• Special category data: conversations may include health or other special category information. You are responsible for having a lawful basis and an Article 9 condition for processing it, and for choosing whether to record and transcribe calls.

• We process your personal data only on your documented instructions. Your agreement, your account settings and your administrators' actions in the service are your instructions. If the law requires us to process it in another way, we will tell you first unless the law forbids it.
• We will tell you if we believe an instruction breaks data protection law.
• Everyone at Aymex who can access your data is bound by a duty of confidentiality.
• We keep appropriate technical and organisational security measures in place, including encryption in transit (TLS, and SRTP for call media), encryption of recordings at rest, role-based access controls, audit logging and per-device SIP credentials.
• We help you respond to requests from people exercising their data protection rights, mainly through the export, deletion and retention tools in the service.
• We help you meet your obligations on security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the information available to us.

You give us general authorisation to use the sub-processors listed in our privacy policy. We will give your account administrators at least 30 days' notice by email before adding or replacing a sub-processor. If you have a reasonable data protection objection, tell us within that period; if we cannot resolve it, you may end the affected service without an early termination charge.

Every sub-processor is bound by a written contract with data protection obligations equivalent to these terms, and we remain responsible to you for their performance.

Most data is stored in the UK and the European Economic Area. Where a sub-processor processes personal data outside the UK, we transfer it only under a safeguard recognised by UK law, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum.

If we become aware of a personal data breach affecting your data, we will notify your account administrators without undue delay and in any event within 48 hours. We will tell you what happened, the data and people likely to be affected, the likely consequences and what we are doing about it, and we will keep you updated as we learn more.

You remain responsible for deciding whether to notify the ICO or the people affected, and we will help you do so.

We will make available the information you reasonably need to show that we comply with these terms. You may audit our compliance, or appoint an independent auditor bound by confidentiality to do so, once in any 12 month period, on at least 30 days' written notice, during business hours and at your own cost. We may meet an audit request first by answering a written questionnaire or providing relevant certifications or reports.

When your account closes you have 30 days to export your data. After that we delete your content, and backup copies cycle out within a further 60 days, so your content is deleted within 90 days of closure. We keep only what the law requires us to keep, such as billing records and call logs, as described in our privacy policy.

• You make sure you have a lawful basis for the processing you instruct, including recording and transcribing calls and processing any special category data.
• You tell your users and the people they communicate with about recording, transcription and AI processing where the law requires it. The service includes a spoken recording notice you can switch on.
• You set retention periods and AI settings that suit your organisation, and keep your users' access appropriate to their roles.

Each party's liability under these terms is subject to the limits in our terms of service. If these terms conflict with our terms of service, these terms take precedence on data protection matters. A signed order form may add to or change these terms for your organisation.