Data Processing Addendum

1. Roles

“Woise” and “we” mean Stele Labs Private Limited, Street No. 8, Habsiguda, Hyderabad, Telangana, India. “You” means the business with the Woise account. For the personal data your agents handle, such as call audio, transcripts, messages, contact lists and the details an agent collects, you are the data fiduciary (or controller) and we are your processor. For your own account data, the Privacy Policy applies instead. The people involved are those who call or are called by your agents, chat or message with them, or appear in contact lists you upload, and your own staff who use Woise. We process their data for as long as you use Woise, until it is deleted under section 7. You are responsible for having a lawful basis for the data your agents collect, including any sensitive data.

2. Instructions

We process this data only to provide Woise as you set it up, under this addendum and the Terms. If we believe an instruction breaks data protection law, we will tell you. If the law requires us to process data in some other way, we will tell you first, unless the law forbids it.

3. Confidentiality and security

Anyone who processes your data for us is bound to keep it confidential. We protect it with encryption in transit and at rest and with limited access, and we review these measures as Woise changes.

4. Sub-processors

You allow us to use the categories of sub-processors listed at woise.ai/sub-processors. We bind each to terms at least as protective as these and remain responsible for their work. We will email you at least 30 days before adding a new one. If you object and we cannot find a fix, you may stop using the affected part of Woise without penalty.

5. Requests and assistance

We will help you answer people's requests to access, correct or delete their data, and pass on any we receive through our privacy request form. We will also give you the information you reasonably need for security reviews and regulators.

6. Breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and within 48 hours, and keep you updated, so you can meet your own duties to notify regulators and the people affected.

7. Deletion and return

You can ask us to delete your data at any time. When your account ends, we will delete or return it, as you choose, unless the law requires us to keep it.

8. Audits

We will answer reasonable security questions. If that is not enough, you or an independent auditor bound by confidentiality may audit us once a year, with 30 days' notice, at your cost. A regulator's request or a breach can justify an extra audit.

9. Transfers

India data is stored in India. Some sub-processors handle data in other countries. We transfer data only to countries the Government of India has not restricted, and where laws such as the GDPR require it, we rely on safeguards such as standard contractual clauses.

10. Law

This addendum follows the Digital Personal Data Protection Act, 2023 and its rules, and, where they apply to you, the GDPR and the UK GDPR. On personal data, it takes precedence over the Terms of Service.

Contact

Questions, or to request a signed copy: contact@woise.ai. Grievance Officer: Sreepath Kumar Mankena, contact@woise.ai.