Data Processing Addendum - Jodie

Last Updated: 21 October 2026

This Data Processing Addendum (the "DPA") forms part of the Terms of Service (the "Terms") between Jodie AI Limited ("Jodie," "we," "our," or "us") and the subscriber identified in the relevant Subscription (the "Subscriber," "you," or "your") (each a "Party" and together the "Parties"). This DPA applies only where and to the extent Jodie Processes Personal Data on the Subscriber's behalf in the course of providing the Services. In the event of any conflict between this DPA and the Terms strictly in relation to the Processing of Personal Data, this DPA prevails; in all other respects the Terms prevail, subject to section 16.

By subscribing to or continuing to use the Services, the Subscriber accepts this DPA. We are not required to sign a separate or bespoke DPA. If a Subscriber requires a counter-signed copy of this DPA in its current form, contact data-protection-officer [at] heyjodie.com; any departure from this DPA requires our written agreement and may be subject to additional fees.

1. Definitions

Capitalised terms not defined in this DPA have the meaning given in the Terms or the applicable Data Protection Laws.

• "Data Protection Laws" means all applicable laws and regulations relating to the Processing of Personal Data, including the UK GDPR and the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679), the California Consumer Privacy Act as amended (CCPA/CPRA), the Australian Privacy Act 1988 (Cth), the Personal Information Protection and Electronic Documents Act (PIPEDA, Canada), Quebec's Law 25, and the New Zealand Privacy Act 2020.
• "Personal Data", "Controller", "Processor", "Data Subject", "Process / Processing" and "Sub-processor" have the meanings given in the UK GDPR or, where another Data Protection Law applies, the equivalent terms in that law.
• "Subscriber Personal Data" means Personal Data Processed by Jodie on the Subscriber's behalf in connection with the Services, including caller audio, transcripts, AI-generated summaries, messages, bookings and related metadata.
• "Services" has the meaning given in the Terms.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Transfer Mechanism" means the UK International Data Transfer Agreement (IDTA) issued by the UK Information Commissioner's Office, or the UK Addendum to the EU SCCs, as applicable.

2. Roles and Scope

1. The Subscriber is the Controller and Jodie is the Processor of Subscriber Personal Data. The Subscriber may also be a Processor for an upstream Controller; if so, the Subscriber appoints Jodie as a Sub-processor on the same terms and warrants that it has the authority to do so.
2. The Subscriber is solely responsible for complying with its obligations as Controller (or, where applicable, Processor for an upstream Controller) under Data Protection Laws, including: establishing the lawful basis for the Processing; providing all required notices to and obtaining all required consents from Data Subjects (including for AI handling, call recording, transcription and cross-border transfer); responding to Data Subject requests; carrying out any required impact assessments; and notifying supervisory authorities and Data Subjects of Personal Data Breaches where required by Data Protection Laws. This does not relieve Jodie of its own obligations under this DPA or Data Protection Laws.
3. Each Party will comply with the obligations that apply to it under Data Protection Laws.
4. The subject matter, duration, nature and purpose of the Processing, the categories of Data Subjects and the categories of Personal Data are set out in Annex A.
5. This DPA does not cover Personal Data that Jodie Processes as an independent Controller for its own account administration, billing, marketing or direct customer relationships, as described in the Privacy Policy. The same provider may act in different roles for different Processing activities; its inclusion in Annex C does not make all of its activities Sub-processing.

3. Processing Instructions

1. Jodie will Process Subscriber Personal Data only on the Subscriber's documented instructions, including those given through the configuration of the Services, the Terms and this DPA, including in relation to international transfers. Use of the Services in their standard configuration is the Subscriber's standing instruction to carry out the Processing described in Annex A. Additional instructions outside the standard functionality require written agreement and may incur additional fees, subject to section 16. Where Processing is required by law to which Jodie is subject, Jodie will inform the Subscriber of that requirement before Processing, unless that law prohibits such notification on important grounds of public interest. For Processing subject to UK or EU GDPR, this exception applies only to the extent permitted by Article 28(3)(a).
2. The Subscriber warrants that its instructions and configuration of the Services comply with Data Protection Laws. Jodie is not required to provide legal advice or undertake a general review of the Subscriber's compliance. If, in Jodie's opinion, an instruction infringes Data Protection Laws, Jodie will immediately inform the Subscriber and may decline or suspend acting on it without liability to the extent permitted by law.
3. To the extent permitted by law and section 16, Jodie has no liability for any loss or claim arising from acting on the Subscriber's lawful instructions or from the Subscriber's configuration (or misconfiguration) of the Services.
4. The Subscriber instructs Jodie to Process Subscriber Personal Data as necessary to provide, maintain, secure, support and improve the Services provided to the Subscriber, including quality review and evaluation of calls and AI-generated outputs, troubleshooting, and fraud and abuse prevention. This is not an instruction to sell caller information, use it for advertising, or use it for unrelated purposes. The restrictions in section 18 apply where relevant.
5. Jodie may create and use aggregated or anonymised data for any lawful purpose only where it no longer constitutes Personal Data under applicable Data Protection Laws and does not identify the Subscriber. Removing names or replacing identifiers alone is not sufficient: data that can reasonably be linked back to a natural person remains Subscriber Personal Data. Creating anonymised data is itself Processing subject to this DPA; any use of de-identified data under US state law is also subject to section 18.

4. Confidentiality

Jodie will ensure that personnel authorised to Process Subscriber Personal Data are bound by appropriate confidentiality obligations and have received training relevant to their role. The form of those obligations and training is at Jodie's discretion.

5. Security

1. Jodie will implement and maintain appropriate technical and organisational measures to protect Subscriber Personal Data against unauthorised or unlawful Processing and against accidental loss, destruction, damage, alteration or disclosure, having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risks to Data Subjects, in accordance with Article 32 of the UK or EU GDPR where applicable. A summary of the measures is set out in Annex B.
2. The Subscriber is responsible for using the security features made available by the Services (including authentication, access controls and configuration options) and for the security of any Subscriber-controlled environments, accounts and credentials. Jodie is not liable for any incident arising from the Subscriber's failure to do so or from the Subscriber's configuration of the Services.
3. No security measure is fault-free. Jodie does not warrant that the measures will prevent all Personal Data Breaches or other incidents. Jodie's liability for any failure of the measures is subject to section 13.

6. Sub-processors

1. The Subscriber gives Jodie general written authorisation to engage Sub-processors (including affiliates of Jodie) to Process Subscriber Personal Data, subject to this section.

2. Public examples and agreed list. Annex C is a public, non-exhaustive overview of providers Jodie uses or may use, not blanket authorisation for unnamed providers. Before Processing begins under this DPA, Jodie will provide the Subscriber in writing with a complete list of the Sub-processors authorised for its Services (the "Agreed List"), identifying their legal names, addresses and privacy contacts, Processing countries and general Processing activities, together with the information needed to assess the authorisation. The authorisation in paragraph 1 applies to that Agreed List, as updated under paragraph 3. Jodie may choose among already authorised providers at its discretion for quality, availability, cost and other operational reasons; a provider need not handle every Subscriber or call. The Subscriber may request the current Agreed List at data-protection-officer [at] heyjodie.com without signing a separate non-disclosure agreement.

3. Advance notice and objections. Jodie will specifically notify the Subscriber in writing by email or a notification addressed to it in the Services at least fifteen (15) days before adding or replacing a Sub-processor on the Agreed List. The notice will identify the provider, proposed Processing, locations and intended start date, with sufficient information to assess and object to the change. Updating this page alone is not notice.

   The Subscriber may object on reasonable, documented data-protection grounds within that notice period. The Parties will discuss a timely objection in good faith for up to thirty (30) days. Jodie will not allow the proposed Sub-processor to Process that Subscriber's Personal Data before the notice period expires or while a timely objection remains unresolved. Jodie may use an already authorised alternative or suspend the affected functionality while resolving the objection. An outage or security incident does not waive advance notice.

   If no commercially reasonable resolution is available, either Party may terminate the affected Services by written notice before the proposed Sub-processor receives that Subscriber's Personal Data. Subject to section 16, termination is the Subscriber's sole contractual remedy for an unresolved objection to an otherwise compliant change, with no refund or further liability arising solely from that termination. Where the Subscriber is a Processor, it must secure its Controller's authorisation and provide its contact details; Jodie will also notify that Controller and allow it the same advance opportunity to object where SCC Clause 9(a), Module 3, requires this.

4. Jodie will enter into a written agreement with each Sub-processor imposing the same data-protection obligations as this DPA to the extent relevant to its Processing, including sufficient guarantees of appropriate technical and organisational measures and any requirements of the applicable transfer mechanism. Jodie remains responsible to the Subscriber for the Sub-processor's performance of those obligations, subject to sections 13 and 16.

5. Jodie uses business or API accounts with its AI-inference, speech and voice Sub-processors. Where a provider offers a setting for Jodie's account that stops Subscriber Personal Data from being used to train the provider's general-purpose models, Jodie will use reasonable efforts to enable that setting. This does not authorise a provider to use Subscriber Personal Data for purposes outside the documented instructions or applicable Data Protection Laws, or promise that providers retain no data for security or abuse monitoring.

6. Jodie is not required to disclose its detailed architecture, model configuration, commercial terms or call-by-call routing decisions. This does not limit disclosure of Sub-processor identities, general Processing activities, locations or other information required by Data Protection Laws, the SCCs or the UK Transfer Mechanism. Commercially sensitive supporting material may be protected by reasonable confidentiality arrangements that do not obstruct those rights.

7. International Transfers

1. The Subscriber authorises Processing in the locations described in Annex D, subject to this section and section 6. Those locations include Ireland and Germany (within the European Economic Area) and the United States; some telephony configurations also use Australia. A local telephone number does not mean that data stays in that country. This authorisation is an instruction to Process, not Data Subject consent or a substitute for a lawful transfer mechanism. Jodie may change locations subject to the applicable transfer safeguards, the Agreed List and any notice required by section 6 or Data Protection Laws.

2. Jodie will ensure that a lawful transfer mechanism is in place before making a restricted international transfer. An applicable EU adequacy decision or UK adequacy regulations may be used, including the EU-US Data Privacy Framework or its UK Extension only where the recipient's valid certification and the applicable decision cover the transfer. Otherwise, where legally available, the SCCs and, for UK transfers, the UK Addendum described below apply. References to UK law include amendments made by the Data (Use and Access) Act 2025 to the extent in force. A different mechanism, including a separately completed IDTA, may be used where valid for the transfer; merely naming an instrument in this DPA does not complete it or bind a third-party recipient.

3. EU SCCs between the Parties. Where required and legally available for a transfer from the Subscriber to Jodie, the SCCs are incorporated by reference with the Subscriber as exporter and Jodie as importer. Module 2 applies where the Subscriber is a Controller; Module 3 applies where it is a Processor. The following selections apply:

   • Clause 7 (docking) applies. Clause 9(a), Option 2 (general written authorisation) applies, with fifteen (15) days' advance notice and the Agreed List under section 6. Annex C is not the agreed list for Clause 9(a). SCC Annex III is not required under Option 2 and is not populated with the illustrative Annex C.
   • The optional independent dispute-resolution wording in Clause 11(a) does not apply. Clause 17, Option 1, is governed by the laws of Ireland; the courts under Clause 18(b) are the courts of Ireland, without limiting Data Subjects' rights under Clause 18(c).
   • Annex I.A uses the Subscriber's legal name, address and designated contact from its Subscription records, and Jodie AI Limited, company number 16685106, 45 Albemarle Street, Mayfair, London, W1S 4JL, with the Data Protection Officer at data-protection-officer [at] heyjodie.com as contact. Their roles are those above, and their activities are those in Annex A. The Parties' acceptance of this DPA constitutes their signature and date for those purposes to the extent permitted by the applicable law governing formation.
   • Annex I.B is completed by Annex A and the applicable location information supplied under section 6. Annex I.C identifies the competent supervisory authority determined under Clause 13 for the Subscriber, its EU representative or the relevant Data Subjects, as applicable. Annex II uses Annex B, supplemented by the transfer-specific measures required by the SCCs. The Parties will record any missing contact, authority or transfer-specific information in writing before relying on the SCCs for that transfer.

4. UK Addendum between the Parties. For restricted transfers subject to UK GDPR, the ICO's International Data Transfer Addendum, version B1.0 in force on 21 March 2022, including its Part 2 Mandatory Clauses as revised under section 18 of that Addendum, is incorporated by reference. Table 1 uses the Parties and contacts in paragraph 3 and the date this DPA takes effect. Tables 2 and 3 use the SCC modules, selections and Appendix information in paragraph 3. In Table 4, the importer (Jodie) may end the Addendum in accordance with its section 19. The Addendum's mandatory UK modifications, including governing law, courts and regulator, apply. Any missing required information must be completed before reliance on the Addendum.

5. Onward transfers. Jodie will put in place the required binding transfer arrangements with its Sub-processors, using the appropriate roles and module for the actual transfer (including Module 3 for Processor-to-Processor transfers where applicable). This DPA does not purport to sign SCCs on a Sub-processor's behalf. Where required, Jodie will carry out and document transfer risk assessments, implement necessary supplementary safeguards, and suspend a transfer if lawful safeguards cannot be maintained. Jodie will comply with applicable obligations concerning government-access requests, including notification, review and challenge where required by the SCCs or UK Transfer Mechanism. Copies of relevant safeguards will be made available on request, with redactions only to the extent those instruments and Data Protection Laws permit.

6. Where another Data Protection Law (including PIPEDA, the Australian Privacy Act, Quebec Law 25 or the NZ Privacy Act 2020) imposes additional cross-border requirements, each Party will comply with its own obligations. Jodie will provide the assistance required of it, taking into account the nature of the Processing and information available to it. Additional assistance requested by the Subscriber may be charged at Jodie's then-current rates, subject to section 16.

8. Data Subject Requests

1. Taking into account the nature of the Processing and the information available to Jodie, Jodie will provide the Subscriber with reasonable assistance, primarily through the self-service tools and documentation made available in the Services, to enable the Subscriber to respond to requests from Data Subjects exercising their rights under Data Protection Laws. Assistance that materially exceeds the standard self-service tools is provided on a time-and-materials basis at Jodie's then-current professional services rates.
2. If Jodie receives a request directly from a Data Subject relating to Subscriber Personal Data, Jodie will promptly notify the Subscriber, unless prohibited by law, and will not respond substantively except on the Subscriber's instructions or as required by law. Jodie may refer the Data Subject to the Subscriber. Primary responsibility for responding to Data Subject requests rests with the Subscriber.

9. Personal Data Breach

1. Jodie will notify the Subscriber without undue delay after becoming aware of a Personal Data Breach affecting Subscriber Personal Data, without waiting for a completed investigation. The notification will include, to the extent then known, the information required by Article 33(3) of the UK or EU GDPR where applicable; further information may be provided in stages without undue further delay as the investigation progresses.
2. Jodie will take appropriate steps to investigate, mitigate and remediate the Personal Data Breach and, taking into account the nature of the Processing and information available to it, assist the Subscriber in meeting its security and breach-notification obligations under Articles 32 to 34 of the UK or EU GDPR and equivalent Data Protection Laws. Additional assistance requested by the Subscriber may be charged at Jodie's then-current rates, subject to section 16.
3. Notification of a Personal Data Breach is not, by itself, an admission of fault or liability by Jodie. Jodie's liability for any Personal Data Breach is subject to section 13 and the Terms.

10. Data Protection Impact Assessments and Prior Consultation

Where required by Data Protection Laws, Jodie will, taking into account the nature of the Processing and the information available to Jodie, provide the Subscriber with reasonable assistance in carrying out data protection impact assessments and prior consultations with supervisory authorities, primarily by way of the documentation made available with the Services. Assistance that materially exceeds that documentation is provided on a time-and-materials basis at Jodie's then-current professional services rates.

11. Audits

1. Jodie will make available all information necessary to demonstrate compliance with its applicable Processor obligations, including Article 28 of the UK or EU GDPR, and will allow for and contribute to audits and inspections by the Subscriber or an auditor it appoints. The Parties will first use the Services' documentation, security overview, and (where available) third-party audit reports, certifications or summaries where these adequately demonstrate compliance.
2. In the ordinary course, audits are subject to: (a) no more than once in any twelve-month period; (b) at least sixty (60) days' written notice; (c) the Subscriber bearing reasonable costs, including Jodie's reasonable internal costs at its then-current rates; (d) normal business hours and appropriate confidentiality obligations, with any external auditor being qualified, independent and not a competitor of Jodie; (e) scope limited to the relevant Processing and compliance obligations; (f) appropriate safeguards for other customers' Personal Data, source code, security and third-party confidentiality; and (g) prompt sharing of the audit report with Jodie and a reasonable remediation timetable. The Subscriber will indemnify Jodie against loss or claims caused by the Subscriber's or its auditor's misuse of audit information, to the extent permitted by law.
3. These arrangements do not restrict a supervisory authority's powers or any audit, inspection or information right required by Data Protection Laws or a transfer mechanism. More frequent audits or shorter notice will be allowed where required by those obligations, including following a relevant Personal Data Breach or reasonable indications of non-compliance. Confidentiality arrangements and charges must not prevent an effective audit required by law.

12. Return and Deletion

1. At the Subscriber's choice, Jodie will return or delete Subscriber Personal Data after the end of the Services and delete existing copies, unless retention is required by applicable law. The Subscriber may give its choice before termination or within thirty (30) days afterwards, using available tools or by emailing data-protection-officer [at] heyjodie.com. If no choice is given, the Subscriber instructs Jodie to delete the data after that period. Return will be in a commonly used electronic format; bespoke export work may incur reasonable charges, subject to section 16.
2. Jodie will carry out deletion without undue delay following the applicable instruction or return, including copies in support and operational systems, and require its Sub-processors to do the same. Data retained because applicable law requires it will remain protected under this DPA and be Processed only to the extent and for as long as that law requires. This section does not extend a deletion or return deadline required by the SCCs or UK Transfer Mechanism.
3. Where individual deletion from routine backups is not practicable, the data will be put beyond ordinary use and access until overwritten in the ordinary backup cycle, with this DPA continuing to apply. If restored for recovery, the deletion instruction will be reapplied. Copies held by support providers are not treated as backups merely because a recording also exists in primary storage.

13. Liability

1. Subject to paragraph 4 and section 16, the liability of each Party under or in connection with this DPA (whether in contract, tort including negligence, breach of statutory duty or otherwise) is subject to the limitations, exclusions and aggregate cap on liability set out in section 14 of the Terms.
2. Subject to paragraph 4 and section 16, claims by the Subscriber under or in connection with this DPA and the Terms count towards a single aggregate cap under section 14 of the Terms, not separate or additional caps.
3. To the maximum extent permitted by law, neither Party is liable to the other under or in connection with this DPA for any loss of profits, revenue, business, goodwill, anticipated savings or opportunity, loss or corruption of data, or for any indirect, special, incidental, consequential, exemplary or punitive damages.
4. Nothing in this DPA or the Terms limits or excludes liability or remedies under the SCCs or UK Transfer Mechanism, or any liability or Data Subject right that cannot lawfully be limited or excluded (including under Article 82 of the UK or EU GDPR). The commercial limitations otherwise remain in effect to the maximum extent permitted by law.
5. Descriptive information. The illustrative provider overview in Annex C and general location or implementation summaries in this DPA are not an exhaustive, customer-specific technical specification or a promise that a permitted configuration will remain unchanged. Subject to paragraph 6, they create no additional warranty of completeness, continuous accuracy or currency, service level or indemnity beyond the express obligations in this DPA or a separate written agreement. Any claim arising from an error, omission or outdated descriptive information is subject to the exclusions and single aggregate cap in this section to the extent permitted by law.
6. Preserved obligations. Paragraph 5 does not qualify the description of authorised Processing in Annex A, the measures in Annex B, the requirement for a complete and accurate Agreed List, or Jodie's duties to give required information and notice, obtain authorisation, provide appropriate security or maintain lawful transfers. It does not permit inaccurate or misleading legally required disclosures or excuse a failure to comply with sections 5 to 7. Paragraph 4 and section 16 continue to apply.

14. Subscriber Indemnity

The Subscriber will indemnify, defend and hold harmless Jodie and its affiliates, officers, employees and agents against any loss, claim, fine, penalty, regulatory action, cost or expense (including reasonable legal fees) arising out of or in connection with: (a) the Subscriber's instructions to Jodie or the Subscriber's configuration of the Services; (b) the Subscriber's failure to obtain any consent or to give any notice required under Data Protection Laws or applicable call-recording, wiretap, AI-disclosure or telemarketing laws; (c) any breach by the Subscriber of this DPA, Data Protection Laws or the Terms; (d) any data the Subscriber or its callers submit to the Services that the Subscriber was not entitled to submit; or (e) any claim by an upstream Controller, regulator or Data Subject relating to (a) to (d).

15. No Third Party Rights

A person who is not a Party to this DPA has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this DPA. This section does not limit the rights of Data Subjects under the SCCs, the UK Transfer Mechanism or Data Protection Laws to the extent those rights cannot be excluded.

16. Order of Precedence

In the event of a conflict between (a) the SCCs or UK Transfer Mechanism, (b) this DPA, and (c) the Terms, the order of precedence in respect of the subject matter of the conflict is: (a) first, then (b), then (c). Each Party agrees to interpret the documents so as to give effect to the limitations, exclusions and aggregate cap on liability in section 14 of the Terms wherever permitted by law.

Nothing in this DPA makes a mandatory obligation under Data Protection Laws discretionary, or permits fees, notice periods, confidentiality conditions or a sole-remedy clause to obstruct required assistance, disclosure, audits, objections or other statutory rights. Mandatory assistance will not be delayed pending agreement or payment of charges. The DPA continues to protect Subscriber Personal Data for as long as Jodie or its Sub-processors retain it.

17. Governing Law

This DPA is governed by the laws of England and Wales and is subject to the jurisdiction provisions of the Terms, except that the SCCs and the UK Transfer Mechanism are governed by the laws specified within those instruments. Where a mandatory rule of Data Protection Laws requires a different governing law for a specific obligation, that mandatory rule applies only to that obligation.

18. US State Privacy Laws

1. To the extent the CCPA or another US state consumer privacy law applies to Subscriber Personal Data, Jodie acts as the Subscriber's "service provider" or "processor" under that law. The Subscriber discloses that information only for the limited and specified purposes of handling and recording calls and messages, producing transcripts and summaries, arranging bookings, delivering related notifications and integrations, hosting that data, and providing support, quality assurance, security and troubleshooting for those Services, as described in Annex A and section 3.4.
2. Jodie will not: (a) sell or share Subscriber Personal Data as those terms are defined in the CCPA, or use it for targeted advertising where prohibited by applicable law; (b) retain, use or disclose it for purposes other than those specified in paragraph 1, or as otherwise permitted by that law; (c) retain, use or disclose it outside the direct business relationship between Jodie and the Subscriber, except as permitted by that law; or (d) combine it with personal information received from or on behalf of another person, or collected from Jodie's own interactions with individuals, except as permitted by that law. Service improvement does not permit using a Subscriber's identifiable caller information to perform services for another customer where prohibited by that law.
3. Jodie will comply with applicable obligations under those laws, provide the same level of privacy protection they require, and notify the Subscriber if it determines that it can no longer meet those obligations. The Subscriber may take reasonable and appropriate steps to verify compliant use and, on notice, stop and remediate unauthorised use. Jodie will enable compliance with consumer requests and provide required assistance with security, assessments and audits under sections 5 and 8 to 11, without those sections restricting mandatory rights. Sub-processor contracts under section 6.4 will carry through the applicable obligations in this section. Jodie certifies that it understands and will comply with these restrictions.
4. Where Jodie holds de-identified data subject to those laws, it will take reasonable measures to prevent association with an individual or household, publicly commits to maintain and use it in de-identified form and not to attempt re-identification except as permitted by law, and will contractually require recipients to comply with the same restrictions. Data that remains Personal Data under another applicable law continues to be protected under this DPA.

Annex A - Description of Processing

• Subject matter: provision of the Services as described in the Terms.
• Duration: for the term of the Subscriber's Subscription, plus any post-termination period referred to in section 12.
• Nature and purpose: handling calls and messages on the Subscriber's behalf; generating, storing, retrieving and transmitting audio, recordings, transcripts, AI-generated summaries, messages, bookings and related metadata; making them available to the Subscriber and its enabled integrations; and providing the support, quality review, troubleshooting and security activities described in section 3.4. This includes authorised personnel reviewing call content and copies held in support and operational tools.
• Categories of Personal Data: caller name and contact details (where provided), call audio and transcripts, AI-generated summaries, messages, bookings, telephone numbers, call metadata (time, duration, routing), content supplied through connected accounts or the Subscriber's business materials, and authorised-user and support information to the extent Processed on the Subscriber's behalf. Independent-Controller data under section 2.5 is excluded.
• Categories of Data Subjects: the Subscriber's callers, customers, contacts and authorised users, and any other natural persons whose Personal Data is supplied through calls, messages, connected accounts or materials submitted to the Services.
• Sensitive data: call and message content may include health information or other special category, criminal-offence or sensitive Personal Data supplied by callers or the Subscriber. The Subscriber is responsible for any additional lawful basis, notices and safeguards required for that data and must avoid unnecessary collection. Processing is limited to the documented purposes, with access restricted to authorised recipients and personnel under sections 4 to 6 and Annex B. Any additional safeguards required for a particular transfer must be documented before it takes place; this DPA is not a representation that the Services meet any sector-specific compliance regime.
• Frequency of transfers: ongoing as the Services are used, including on a per-call basis.

Annex B - Technical and Organisational Measures

The following is a summary of the measures Jodie maintains. Specific implementation details may evolve; Jodie will not materially reduce the level of protection during the term.

• Encryption: TLS in transit; encryption at rest for Subscriber Personal Data. This is not a claim of end-to-end encryption across public telephone networks.
• Call recordings: backend recordings are stored on Amazon Web Services. Subscriber access is provided through authenticated Services and time-limited playback links; anyone holding a valid link may be able to use it until it expires, so links must be kept confidential. Authorised Jodie personnel can also access recordings through administrative tools. Full recordings and related call content may be copied to support and operational providers, including Slack, for onboarding, quality review and troubleshooting. Those copies are subject to this DPA, including its access, confidentiality, Sub-processing and deletion obligations; they are not confined to the Subscriber's account or governed by the expiry of a playback link.
• Access control: role-based access, least-privilege defaults, multi-factor authentication for administrative access, and logging of administrative actions.
• Network security: segmented production environment, firewalled boundaries, and protection against common web vulnerabilities.
• Application security: secure software development practices, code review, dependency monitoring, and a vulnerability management process.
• Personnel: confidentiality obligations and data-protection training for personnel with access to Subscriber Personal Data.
• Sub-processors: due diligence before engagement, contractual data-protection terms, and ongoing oversight.
• Backups and continuity: regular backups, periodic restore testing, and documented recovery procedures.
• Incident response: documented incident-response process, on-call coverage and breach-notification procedures consistent with section 9.
• Auditability: production logs and audit trails sufficient to support investigations and compliance reporting.

Annex C - Sub-processors

This public overview is non-exhaustive, including but not limited to the providers below. It describes providers Jodie uses or may engage, not a promise that each is active or handles a particular Subscriber's data. The complete Agreed List and change process in section 6 determine authorisation, including for any provider not named here. Jodie chooses among authorised providers without disclosing its detailed architecture or per-call routing. General categories below do not assign a particular feature or call to an individual provider; locations are addressed in Annex D and the Agreed List rather than inferred from a provider's name or headquarters.

Support and operational Processing includes review of call content and storage of full call recordings in tools such as Slack, not only delivery of operational alerts. The permissions and limits in this DPA apply to that Processing.

For transparency, payment services are provided through Paddle, which acts as merchant of record and as an independent Controller for its payment and tax activities, rather than a Sub-processor for those activities. A third-party service the Subscriber independently selects and contracts with is not automatically Jodie's Sub-processor merely because the Services can connect to it; Jodie remains responsible for any Processing it actually subcontracts under section 6.

Annex D - Data Location and Storage

This Annex describes where Subscriber Personal Data is stored and Processed. Jodie may change these locations at any time, subject to section 7.

• Service locations: the Services use Processing locations in Ireland (EU) and the United States, with product analytics in Germany (EU). These are service-wide locations, not a representation that each data type or provider uses all of them. Other locations depend on the authorised provider and configuration, subject to sections 6 and 7.
• Backend storage: call audio and recordings are stored on Amazon Web Services for Jodie's backend. The applicable storage country or countries depend on the deployment configuration and must be identified in the Agreed List under section 6. This statement does not imply that all application data or backups share one provider, storage region or retention period.
• Live calls and AI: audio, transcripts, messages and other call content are Processed by telephony, voice, speech and AI providers, including in the United States and the EU. Some telephony configurations support Australia, but calls to Australian and other local numbers may be Processed in the United States. Telephone-number country is not a data-residency commitment. Business or API providers may retain data for security and abuse monitoring, subject to their agreements with Jodie and the requirements of this DPA.
• Analytics and monitoring: product-analytics data is Processed in Germany (EU). AI-monitoring configuration supports EU hosting, but the applicable monitoring locations must be identified in the Agreed List rather than assumed from a default setting.
• Support, email and notifications: these providers may receive call content, contact details and full recordings for the purposes in Annex A, including copies held in Slack. Those copies are stored and Processed in the relevant provider's locations, which may differ from backend storage and must be identified in the Agreed List. A backend recording's playback-link expiry does not delete a copy in another system.
• Retention and copies: Subscriber Personal Data is retained for the duration and purposes in Annex A, subject to lawful deletion instructions and section 12. Provider-side copies, including operational copies of recordings, remain subject to those obligations; a provider's own policy does not override this DPA. Backup locations and retention must be accounted for separately from primary storage when documenting the Processing and transfer safeguards.
• Single-region hosting: Jodie does not offer a guarantee that Subscriber Personal Data will stay in a single country or region unless this has been agreed in writing and signed by Jodie.

Contact

For questions about this DPA, sub-processor lists, or to request a counter-signed copy, contact:

• Data Protection Officer: data-protection-officer [at] heyjodie.com
• General Email: team [at] heyjodie.com
• Address: 45 Albemarle Street, Mayfair, London, W1S 4JL