Data Processing Agreement

This Data Processing Agreement (the "DPA") forms part of the Terms of Use between Voice2Jobs, Inc. ("Voice2Jobs", "we") and the customer who accepts those terms ("you"). It applies where you use Voice2Jobs to process personal data about other people, which in practice means your customers, your leads, and the members of your team.

It takes effect automatically when you use the service and does not need to be signed. If your organisation requires a countersigned copy, write to legal@voice2jobs.com.

1. Who Is Who

For the personal data you put into Voice2Jobs about your customers and your team, you are the controller and we are the processor. You decide whose details to collect and why. We process them only to provide the service to you.

We are a separate controller for the personal data of your own account: your name, sign-in credentials, billing records, and how you use the product. That processing is described in our Privacy Policy, not here.

2. What We Process, and Why

Subject matter: provision of the Voice2Jobs quoting, invoicing, scheduling, and payment service.
Duration: for as long as your account is open, plus the retention period in section 9.
Nature and purpose: storing, organising, transcribing, drafting, transmitting, and deleting the records you create.

Categories of data subject: your customers and prospective customers, people who submit a booking or enquiry through your public page, and members of your team you invite.

Categories of personal data: names, postal addresses, email addresses, phone numbers, job site details, appointment times, photographs and files you upload, the contents of quotes and invoices, payment status, and voice recordings and their transcripts where you use voice capture.

Special categories: the service is not designed for special category data under GDPR Article 9, nor for payment card numbers, government identity numbers, or health information. You agree not to put such data into free-text fields. Card details are handled by Stripe and are never stored on our systems.

3. Our Obligations

• We process personal data only on your documented instructions. Your use of the product, and this DPA, are those instructions. If we are legally required to process it otherwise, we will tell you first unless the law forbids that.
• We do not sell personal data, and we do not use your customers' personal data to train AI models.
• Everyone with access is bound by confidentiality obligations.
• We keep the technical and organisational measures in section 6.
• We assist you, so far as is reasonable, with data subject requests, impact assessments, and consultation with regulators.
• On termination we delete or return personal data as set out in section 9.
• We make available the information needed to demonstrate compliance with Article 28 and allow for audits as set out in section 10.

4. Your Obligations

You confirm that you have a lawful basis for the personal data you put into Voice2Jobs, that you have given the people concerned any notice the law requires, and that your instructions to us will not put us in breach of data protection law. Recording law in particular varies by jurisdiction: where you use voice capture, obtaining any consent required for a recording is your responsibility, as set out in our Acceptable Use Policy.

5. Subprocessors

You give general authorisation for us to engage subprocessors. Each is bound by written terms no less protective than this DPA, and we remain fully liable to you for their performance. The current list:

We will give at least 30 days' notice before a new subprocessor starts processing personal data, by updating this page and emailing the address on your account. If you object on reasonable data protection grounds within that period, tell us at legal@voice2jobs.com and we will work with you to find an alternative. If we cannot, you may terminate the affected part of the service and receive a pro rata refund of fees paid in advance.

6. Security

We maintain measures appropriate to the risk, including:

• Encryption in transit (TLS) and at rest.
• Row-level access control in the database, so one account cannot read another account's records.
• Access on a least-privilege basis, with credentials held only by staff who need them.
• Multi-factor authentication available on customer accounts, and required on our own administrative access.
• Backups, with restoration tested periodically.
• Logging of administrative access, and review of changes affecting data access.
• A published vulnerability disclosure route, described on our security page.

7. Personal Data Breach

If we become aware of a personal data breach affecting personal data we process for you, we will notify you without undue delay, and in any event within 72 hours of becoming aware. The notice will describe what we know: the nature of the breach, the categories and approximate number of records involved, the likely consequences, and the measures taken. Where we cannot provide everything at once, we will provide it in phases as it becomes available. Notifying regulators and affected individuals is your responsibility as controller, and we will give you the information you reasonably need to do it.

8. International Transfers

Voice2Jobs, Inc. is based in Canada and our subprocessors are located in the United States, so personal data will be transferred outside the European Economic Area and the United Kingdom. Where personal data originates in the EEA or the UK, transfers are made under the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, and those clauses are incorporated into this DPA by reference. Canada holds an adequacy decision from the European Commission for commercial organisations subject to PIPEDA.

9. Deletion and Return

You can export your data at any time while your account is open. When your account is closed, we delete the personal data we hold for you within 90 days, except where we are required by law to keep it, for example financial records required for tax purposes. Backups are purged on their normal rotation, which does not exceed 90 days, and data in a backup is not restored to live systems. You may ask for earlier deletion by writing to legal@voice2jobs.com, and you can start account deletion yourself from the account deletion page.

10. Audit

On reasonable written request, and not more than once in any twelve month period unless a regulator requires otherwise or a breach has occurred, we will provide the information reasonably necessary to demonstrate compliance with this DPA, and respond to a reasonable security questionnaire. Where an on-site audit is genuinely required by law, it will be at your cost, at a mutually agreed time, subject to confidentiality, and must not disrupt the service for other customers.

11. Liability and Precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Use. If this DPA conflicts with those Terms on the processing of personal data, this DPA prevails. Nothing here limits a data subject's rights.

12. Governing Law and Contact

This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, matching the Terms of Use, and without limiting any mandatory rights under the data protection law that applies to you.

Questions, objections to a subprocessor, or a request for a countersigned copy:
Voice2Jobs, Inc.
Attn: Legal Team
Email: legal@voice2jobs.com
2727 Steeles Ave W, Unit 103
North York, ON M3J 3G9, Canada