Data processing & the DPA

When you use SmartAlex to place, receive, record, transcribe and analyse calls, you remain the controller of the personal data in those interactions, and SmartAlex processes that data on your behalf as your processor. Our Data Processing Addendum (DPA) records the commitments that govern that processing. This page summarises it so you can evaluate it quickly. It is a summary, not the contract.

​

Scope and applicable law

The DPA applies wherever SmartAlex processes personal data on your behalf. It is built to satisfy Article 28 of the GDPR and the equivalent requirements of the other laws it covers, including:

• the Personal Data Protection Act 2012 of Singapore (PDPA)
• the EU General Data Protection Regulation and the UK GDPR
• the Swiss Federal Act on Data Protection (FADP)
• the Protection of Personal Information Act 2013 of South Africa (POPIA)

Where you are yourself a processor acting for a third-party controller, SmartAlex acts as a sub-processor and the same obligations apply on that basis.

​

Controller and processor roles

The DPA draws a clear line between the data SmartAlex handles on your instructions and the limited data it handles for its own operational purposes. The two roles stay separate: SmartAlex does not repurpose data it holds as your processor for its own controller purposes, and it does not treat your instructions as the basis for that controller processing.

​

Purposes of processing

SmartAlex processes personal data on your behalf only to operate the Services as you configure them. That includes:

• placing and receiving calls over the public telephone network, and carrying real-time call media
• recording, transcribing and analysing call audio, and synthesising agent speech
• managing contacts and contact lists, and running outbound calling and messaging campaigns
• generating call outcomes, summaries, qualifications and analytics, and storing and retrieving the above

Your complete instructions are the Agreement, the DPA, and the configuration and feature choices you make in the product. SmartAlex will not process outside those instructions unless the law requires it.

​

The model-training wall

This commitment is stated in the DPA itself and is reinforced in its sub-processor annex. It applies to the categories of provider that carry, transcribe, synthesise and interpret call content.

​

Security measures

SmartAlex maintains appropriate technical and organisational measures, calibrated to the state of the art, the nature of the processing and the risk to individuals. The measures are set out in full in Annex 2 of the DPA. On certifications, the DPA is precise: our infrastructure sub-processors maintain SOC 2 or ISO/IEC 27001 attestations, and SmartAlex is working towards SOC 2 readiness for its own operations. SmartAlex does not represent that it currently holds its own SOC 2 or ISO/IEC 27001 certification.

​

International data transfers

SmartAlex and its sub-processors may process personal data in countries other than the one in which it was collected. Where a transfer is a restricted transfer, an appropriate safeguard is put in place so the data receives protection essentially equivalent to that in the country of export, supported by encryption in transit and at rest and strict access controls. Where the destination benefits from an adequacy decision, or where a provider is certified under a recognised transfer framework, that mechanism may be relied on instead for as long as it remains valid. If a mechanism is invalidated, the parties work in good faith to put an alternative in place without undue delay. A copy of the relevant safeguards, with commercially sensitive terms redacted, is available on request from privacy@getsmartalex.com.

​

Personal data breach notification

This is the single breach-notification standard in the DPA. A notification is not an acknowledgement of fault or liability.

​

Sub-processors and your objection right

You give SmartAlex general written authorisation to engage sub-processors, each bound by written contract to data-protection obligations equivalent in substance to those in the DPA. SmartAlex remains fully responsible to you for each sub-processor’s performance.

• The current sub-processors, the processing each performs, the categories of data each handles and the safeguards that apply are published and kept current.
• SmartAlex updates that list and emails your designated contact at least 30 days before a new or replacement sub-processor begins processing personal data.
• You may object on reasonable data-protection grounds within 30 days. The parties work in good faith to resolve the objection. If it cannot be resolved, you may terminate the part of the Services that cannot be provided without the sub-processor in question, as your sole and exclusive remedy.

​

Data subject requests

Taking into account the nature of the processing, SmartAlex assists you in responding to requests from individuals to exercise their rights of access, rectification, erasure, restriction, portability and objection, and rights relating to solely automated decisions. If an individual contacts SmartAlex directly, SmartAlex notifies you without undue delay, directs the individual to you, and does not respond itself except on your instructions or where the law requires it. The DPA also confirms that SmartAlex does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. You remain responsible for how you use the outputs of the Services in your own workflows.

​

Retention and deletion

SmartAlex retains personal data processed on your behalf only for as long as needed to provide the Services. On expiry or termination, and at your election made before or within 30 days after termination, it deletes or returns that data and deletes existing copies within 90 days, except where the law requires continued retention. Data held in routine encrypted backups is removed as those backups are overwritten on a rolling cycle that does not exceed 180 days.

​

Signing the DPA

The DPA is incorporated into the SmartAlex Terms of Service and takes effect when you accept the Agreement, so its protections apply to every customer without separate paperwork. A signable copy is available for enterprise customers that require an executed instrument for their procurement or compliance records.