Legal

Data Processing Agreement

How ADB Voices processes personal data on a customer's behalf. It forms part of the Terms of Service for every workspace.

Effective 29 October 2026 · version 2026-10-29

  1. 1. Parties and roles
  2. 2. Scope and duration of processing
  3. 3. Nature and purpose of processing
  4. 4. Types of personal data and data subjects
  5. 5. Processor obligations
  6. 6. Sub-processors
  7. 7. Security measures
  8. 8. Personal data breaches
  9. 9. Assistance with data subject requests
  10. 10. International transfers
  11. 11. Audits
  12. 12. Deletion and return of data
  13. 13. Liability
  14. 14. Signing a DPA

1. Parties and roles

This agreement is between the customer (the controller) and ADB TECHNOLOGY FZCO (the processor), and applies to personal data in the audio, transcripts and results that the customer processes with ADB Voices. It forms part of the Terms of Service; a signed DPA, if you have one, takes precedence.

2. Scope and duration of processing

ADB processes customer personal data only to provide ADB Voices to the customer, for as long as the customer uses it, and then until the data is deleted as set out below.

3. Nature and purpose of processing

Storing recordings; transcribing them; and, when the customer asks, translating, summarising, extracting entities, scoring sentiment, redacting and labelling speakers; storing and returning the results; and delivering them to the destinations the customer connects.

4. Types of personal data and data subjects

Voices and anything said in recordings, which may include names, contact details, identifiers and, depending on the customer's use, special categories of data such as health information. Data subjects are the people who speak or are mentioned in the customer's recordings, and the customer's users.

5. Processor obligations

ADB will: process customer personal data only on the customer's documented instructions, which are these terms and the customer's use of the service, and tell the customer if an instruction appears to break the law; ensure that people authorised to process it are bound by confidentiality; and not use it for any other purpose, including training models, without the customer's written agreement.

6. Sub-processors

The customer authorises the sub-processors listed on the sub-processors page. ADB imposes data protection terms on each of them that are no less protective than these, and remains responsible for them. ADB will give at least 30 days' notice of a new sub-processor on that page and by email to workspace admins; the customer may object on reasonable data protection grounds, and if we cannot resolve the objection, may end the affected service and be refunded any unused prepaid amounts for it.

7. Security measures

ADB maintains appropriate technical and organisational measures, including: encryption in transit and at rest; isolation between workspaces; hashed API keys and encrypted connector credentials; role-based access with optional two-step sign-in; least-privilege staff access; rate limiting; logging of every access, export and deletion in the workspace audit log; monitoring; and backups.

8. Personal data breaches

ADB will notify the customer without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting customer data, with the information the customer needs to meet its own obligations, and will take reasonable steps to contain and remedy it.

9. Assistance with data subject requests

Taking into account the nature of the processing, ADB will help the customer respond to requests from data subjects, mainly through the console's search, export and deletion features, and will pass on to the customer any request it receives directly.

10. International transfers

Where customer personal data is transferred to a country without an adequate level of protection, ADB will use an appropriate safeguard recognised by the applicable law, such as standard contractual clauses. A sovereign licence keeps processing within the customer's own infrastructure.

11. Audits

ADB will make available the information reasonably needed to show compliance with this agreement, including security documentation and certifications. Where that is not enough, the customer may carry out an audit, at its own cost, no more than once a year, with 30 days' notice, during business hours, and under confidentiality.

12. Deletion and return of data

During the service the customer can export and delete its data at any time. When a workspace is erased, or within 30 days after the service ends, ADB deletes the customer's audio, transcripts and results, except billing records and audit entries kept, with their content removed, where the law requires. Backups are overwritten on a rolling schedule.

13. Liability

Each party's liability under this agreement is subject to the limitations in the Terms of Service, except where the law does not allow them.

14. Signing a DPA

This agreement applies automatically. To receive a signed copy for your records, write to hello@adbtech.ai.