PolyphonOS Data Processing Agreement

Version dated 5 October 2026. This public text becomes part of a Customer's agreement only when the accepted order expressly incorporates it and identifies the authorized processing schedule.

This Data Processing Agreement (“DPA”) is part of an accepted business order between Polyphonos OÜ (“PolyphonOS”) and the customer named in that order (“Customer”) where PolyphonOS processes personal data on the Customer's behalf. Customer Personal Data means personal data that the Customer submits, connects, or generates through the ordered tenant service for its own purposes or for its upstream controller. The accepted order identifies whether the Customer is a controller or a processor for each relevant processing activity. PolyphonOS acts as processor when the Customer is controller, and as subprocessor when the Customer is processor. PolyphonOS acts as an independent controller for its own website, business-contact, billing, account-administration, and security data as described in its Privacy Notice. This DPA prevails over conflicting Terms and Conditions on the processing of Customer Personal Data.

1. Processing instructions and roles

Where the Customer is controller, it determines the purposes and means of processing and is responsible for its legal basis, notices, data-subject rights, and the lawfulness of instructions and connected data sources. Where the Customer is processor, it must have its controller's authorization to appoint PolyphonOS, enable the applicable subprocessors and transfers, and issue or pass on documented instructions. The Customer must ensure that its instructions to PolyphonOS are authorized by and consistent with its agreement with the upstream controller; the upstream controller remains responsible for controller decisions, while PolyphonOS provides the assistance described below through the Customer. PolyphonOS processes Customer Personal Data only on documented instructions in the order, service configuration, authorized user actions, and this DPA, including any transfer instruction. PolyphonOS will promptly tell the Customer if an instruction appears to infringe applicable data protection law, unless prohibited by law, and may pause the affected processing while the parties resolve it. A legal duty to process outside instructions will be notified to the Customer before processing where lawful.

Annex A describes the subject matter, duration, nature, purposes, data-subject categories, and data types. The Customer must not enable a category or purpose outside that description without a documented amendment. Special-category data under Article 9 GDPR, criminal-offence data under Article 10, biometric identification, and other high-risk data require an express processing schedule and a verified lawful provider route before use. In particular, an AI route subject to a provider's sensitive-data prohibition must not receive such data without that provider's agreed amendment.

2. People, security, and confidentiality

PolyphonOS will ensure that persons authorized to process Customer Personal Data are bound by confidentiality or an appropriate statutory duty. It will implement technical and organizational measures appropriate to the risk under Article 32 GDPR, taking into account the nature and scope of the service. The measures include tenant-scoped access controls, role-based permissions, service identity and secret controls, transport encryption, protected storage, logging and monitoring designed to avoid unnecessary content capture, incident response and the restoration controls actually enabled for the ordered service. Backup frequency or restoration commitments apply only if expressly stated in the accepted order and verified for that deployment. Annex C gives the service-level description. Neither party may treat a marketing statement as a substitute for an agreed security measure or a measured service level.

PolyphonOS will not use Customer Personal Data to train a general model for its own purposes. An enabled AI task can pass only task-relevant data to the authorized inference route. The permitted model provider, region, data-collection rule, and retention policy are established by the Customer's ordered processing policy and the provider configuration actually available for that task. A policy-restricted request must fail or wait if no compliant route is available; it must not silently fall back to a prohibited provider or region.

During a pilot, developer subscription tools that may process outside the EU can be used for general Talent development only after an independent pre-transfer review of the exact source and content establishes that it contains no Customer Data as defined in the Terms, Customer confidential information, or personal data, including information that remains identifiable through linkage or pseudonymization. Customer tasks, tenant artifacts, logs, credentials, and customer-derived examples are excluded. A provider or model's own classification does not establish this fact. If the review cannot establish it, the work must use a Customer-authorized EU route or stop. This exception never authorizes Customer Personal Data on a non-EU development route.

3. Subprocessors

The Customer grants general authorization only for the subprocessors named in the processing schedule incorporated into its accepted order. The schedule must identify each direct subprocessor, its service, the data it may receive, and relevant processing locations; it must also explain any model-provider chain. PolyphonOS will impose data protection obligations on each direct subprocessor that are no less protective, for its service, than this DPA requires. PolyphonOS remains responsible to the Customer for the direct subprocessor's performance of those obligations.

PolyphonOS will give advance notice of an intended addition or replacement of a direct subprocessor, including its purpose and location, with a reasonable opportunity to object on data protection grounds. The ordinary notice period is 30 days. If an urgent replacement is necessary for security or service continuity, PolyphonOS may give shorter notice with reasons and will allow an objection as soon as practicable. If the parties cannot resolve a justified objection by an alternative configuration, the Customer may terminate the affected service without penalty and receive a proportionate refund of prepaid, unused fees. A Customer-approved integration or model-policy change that itself names a new provider constitutes a documented instruction for that route; it does not waive the applicable transfer and security obligations.

4. Data-subject requests and assistance

PolyphonOS will promptly forward a request it receives concerning Customer Personal Data unless law prevents this, and will not answer on the Customer's behalf except as instructed or required by law. Taking account of the nature of the processing and information available to it, PolyphonOS will provide reasonable assistance with access, rectification, erasure, restriction, portability, objection, and applicable automated-decision rights. It will also assist the Customer with security, breach assessment and notification, data protection impact assessments, and prior consultation where Articles 32–36 GDPR require it. The order may allocate reasonable costs for assistance beyond ordinary self-service functions, but cost allocation does not remove mandatory assistance.

5. Personal-data incidents

PolyphonOS will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. The notice will describe the nature of the incident, likely consequences, data categories and approximate scope where known, containment and remediation measures, and a contact point. Initial information may be incomplete and will be supplemented without undue delay as it becomes available. PolyphonOS will cooperate with the Customer's investigation and required notices, preserve appropriate evidence, and take reasonable steps to contain and remedy the breach. A notice is not itself an admission of fault.

6. International transfers and regional processing

Before enabling a route or remote access that transfers Customer Personal Data outside the agreed location or to a third country, PolyphonOS must document the Customer's authorized instruction, the recipient and location, and a valid Chapter V GDPR mechanism in the accepted processing schedule. Where required, the parties and recipient must have executed the appropriate European Commission Standard Contractual Clauses or another lawful mechanism and completed any required transfer assessment and supplementary safeguards before the transfer. If those prerequisites are absent, the route must remain disabled or the affected operation must fail or wait. A legal duty to transfer outside instructions is handled under section 1. This DPA does not by itself assert that a route is EU-only. An EU-only API-payload commitment applies only to the specific order and provider arrangement that expressly enables it and is technically verified. It does not automatically include account, billing, security, support, or integration data.

During a pilot, the Customer may separately opt in to SMS or voice processing in an accepted order or amendment. The order's processing schedule must identify the enabled channel, actual provider and onward recipients, phone numbers, message and call content and metadata involved, processing locations, retention, and the applicable transfer mechanism and safeguards. The Customer's opt-in acknowledges that this channel is not guaranteed EU-only; it is an instruction to enable the channel, not the data subject's consent or a substitute for a lawful basis or Chapter V mechanism. PolyphonOS must not activate a route for Customer Personal Data until these conditions and any required notices or consents have been addressed. An EU-only commitment for another service function does not silently override or authorize this separate channel. A later order must separately define and authorize its channel and regional scope.

7. Return, deletion, and audit

At the Customer's choice following the end of the service, PolyphonOS will return or delete Customer Personal Data, including copies, within the agreed export and deletion schedule, unless Union or Member State law requires continued storage. Until deletion, retained data remains protected under this DPA. Any backup copies enabled for the ordered service will be removed under the verified schedule in the accepted order and protected against routine access in the meantime. PolyphonOS will identify any legally retained category and its reason on reasonable request. Customer-controlled exports and deletions during the term remain available to the extent implemented for the ordered function.

PolyphonOS will make available information reasonably needed to demonstrate Article 28 compliance and allow for and contribute to an audit, including an inspection, by the Customer or its mandated independent auditor. The parties will first use current security documentation, certifications, and written responses where these suffice. Any further audit must use reasonable notice, confidentiality, a defined scope, and measures that protect other tenants and system security; it must not block a competent authority's lawful audit right. The parties will agree reasonable cost allocation for extraordinary audits, except where an audit establishes a material breach by PolyphonOS.

8. Duration and changes

This DPA applies for as long as PolyphonOS processes Customer Personal Data under an accepted order, including any post-termination return, deletion, or lawful retention period. A material change requires the parties' agreement or the notice and objection mechanism for subprocessors; a website update alone does not amend this DPA. If a Standard Contractual Clause applies, it prevails over a conflicting provision here to the extent required by law.

Annex A — Processing details

• Subject matter and duration: operation of the Customer's selected PolyphonOS tenant and enabled digital-employee workflows during the accepted order and the agreed export/deletion period.
• Nature and purpose: hosting, storage, retrieval, tenant-user access, workflow execution, authorized communications and integrations, AI inference, support, security, audit, export, and deletion needed to supply the ordered service, plus backup or restoration only when expressly included in the accepted order.
• Data subjects: Customer users and personnel; the Customer's clients, suppliers, applicants, contacts, and other persons whose data the Customer lawfully submits or connects within the agreed scope.
• Data categories: identifiers and contact details; phone numbers; messages and correspondence; call audio, transcripts, and communications metadata where the ordered channel uses them; documents and attachments; business records; account and permission metadata; task inputs, outputs, and execution records. Where the Customer enables voice recognition: voiceprints (biometric data, a special category under Article 9 GDPR) of Customer users who gave explicit consent in the tenant application, with the consent record and recognition results; they are processed only inside the Customer's tenant runtime in the EU and deleted on withdrawal, on deletion of the user, or with the tenant. Exact enabled integrations and any sensitive-data categories require the order's processing schedule.
• Instructions: the order, authorized tenant configuration and user actions, this DPA, and documented later instructions consistent with the service and law.
• Retention: the Customer's agreed retention settings and export/deletion schedule, with limited legal or security retention identified separately.

Annex B — Subprocessor and route authorization

The accepted order must identify the enabled services and the customer-specific processing schedule. That schedule states each authorized direct subprocessor, its service and data categories, processing region, any onward model-provider arrangement, applicable transfer safeguards, and the notice contact for changes. A provider or route is not authorized for Customer Personal Data merely because it appears in this public document, a marketing page, or a provider catalog.

DigitalOcean supplies the current Frankfurt tenant infrastructure. Its DPA covers hosted customer data when its customer acts as either a controller or a processor. Its subprocessor list includes providers and operations outside the selected server region. The processing schedule must identify the actual tenant services and regions rather than treating Frankfurt server placement as a blanket EU-only guarantee.

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, is a subprocessor for connection data on customers' tenant domains: IP addresses, request metadata, TLS handshake data, and security events. It provides content delivery (CDN), DDoS protection, a web application firewall (WAF), TLS termination, and the protected tunnel to tenant servers. Cloudflare also serves the public website as described in our Privacy Notice. Processing may take place outside the EEA, including in the United States. Transfers covered by Cloudflare's EU-U.S. Data Privacy Framework (DPF) certification rely on the DPF. Its Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses for restricted transfers, with Module 3 applying where PolyphonOS acts as a processor, including as a fallback if the DPF certification ceases to be valid. See also Cloudflare's Privacy Policy. The Customer's processing schedule must identify this connection-data processing, its locations, and applicable transfer safeguards; Frankfurt tenant hosting does not make Cloudflare processing EU-only.

OpenRouter can provide an AI gateway for an authorized route. Its Terms incorporate its published DPA for organizational or commercial users. The published DPA describes OpenRouter's customer as a controller and its EU-only API-payload addendum requires a written election; it excludes certain account, billing, security, and operational data from that regional commitment. Its Privacy Policy describes its own processing. Before customer personal data is sent through this route, the order's processing schedule and applicable upstream terms must support PolyphonOS's processor role, the permitted model-provider chain, the required regional and transfer controls, and the data categories involved. A zero-data-retention request or EU endpoint setting alone is not that authorization.

Twilio can provide SMS or voice functions only after the Customer separately opts in under section 6 and the accepted schedule authorizes the route. Its published Data Protection Addendum describes processor or subprocessor activity alongside separate controller processing of account, communications usage, and limited content data. Its subprocessor list identifies onward processing and regional limitations. The current adapters call Twilio's standard API endpoint; Twilio states that US1 is its default region, so United States processing is possible unless an applicable regional route is independently verified. The schedule must record the exact channel and provider arrangement, data categories, recipients and locations, retention, safeguards, and notice contact. An EU-hosted tenant alone does not establish an EU-only Twilio route.

Other inference, voice, or communication services are enabled only where the accepted processing schedule identifies their provider, role, purpose, data, region, transfer basis, and any relevant provider terms. If an authorized route becomes unavailable or ceases to meet the agreed policy, PolyphonOS will pause or fail the affected operation rather than select an unauthorized provider or location. The notice and objection mechanism in section 3 applies to a proposed replacement.

Annex C — Technical and organizational measures

The service is designed around tenant-scoped identity and authorization; separated tenant runtime and data; protected service credentials; encrypted network transport; protected file storage; recorded administrative and consequential actions; worker-based execution with bounded concurrency; monitoring and incident handling; and a documented retention/deletion lifecycle. The exact enabled controls and any customer-specific commitments belong in the accepted order and security schedule. Where a feature or control is not available in the ordered deployment, PolyphonOS must not describe it as active.